Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cmcdole
cmcdole
Path Finder
Member since:
05-24-2016
03-08-2023
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 05-24-2016 |
Activity Feed
- Got Karma for Re: Multivalue to single value from XML. 03-10-2023 07:04 AM
- Posted Re: Multivalue to single value from XML on Splunk Search. 03-10-2023 05:16 AM
- Posted How to create a multivalue to single value from XML? on Splunk Search. 03-09-2023 04:58 PM
- Tagged How to create a multivalue to single value from XML? on Splunk Search. 03-09-2023 04:58 PM
- Got Karma for Re: Comparing search results to lookup. 03-08-2023 08:24 AM
- Got Karma for Re: Comparing search results to lookup. 03-07-2023 03:31 PM
- Got Karma for Re: Comparing search results to lookup. 03-07-2023 02:11 PM
- Posted Re: Comparing search results to lookup on Splunk Enterprise. 03-07-2023 01:58 PM
- Posted Re: Comparing search results to lookup on Splunk Enterprise. 03-03-2023 05:57 AM
- Posted Re: Comparing search results to lookup on Splunk Enterprise. 03-03-2023 05:53 AM
- Got Karma for Comparing search results to lookup?. 03-02-2023 04:52 PM
- Posted Comparing search results to lookup? on Splunk Enterprise. 03-02-2023 04:06 PM
- Posted Re: How do you display AVG, MIN, and MAX as row headers by Service? on Splunk Search. 03-29-2019 06:35 AM
- Posted How do you display AVG, MIN, and MAX as row headers by Service? on Splunk Search. 03-28-2019 08:59 AM
- Tagged How do you display AVG, MIN, and MAX as row headers by Service? on Splunk Search. 03-28-2019 08:59 AM
- Posted Is it possible to highlight a value within a multi-value cell? on Dashboards & Visualizations. 10-23-2018 02:42 PM
- Tagged Is it possible to highlight a value within a multi-value cell? on Dashboards & Visualizations. 10-23-2018 02:42 PM
- Tagged Is it possible to highlight a value within a multi-value cell? on Dashboards & Visualizations. 10-23-2018 02:42 PM
- Posted Re: How do I show results from a panel in another panel? on Dashboards & Visualizations. 07-10-2018 09:02 AM
- Posted Re: How do I show results from a panel in another panel? on Dashboards & Visualizations. 07-09-2018 07:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-10-2023
05:16 AM
1 Karma
Your awesomeness is much appreciated. This works!! Thank you very much!!
... View more
03-09-2023
04:58 PM
I need to create a single field named MemberOf from the XML snippet below. It should look like this:
memberOf
CN=Buttercup,OU=SAP Service Accounts and Groups,OU=Service Accounts,DC=corp,DC=Buttercup,DC=com
CN=Corp-Hypr,OU=Hypr,OU=Groups,DC=corp,DC=Buttercup,DC=com
CN=Everyone - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com
CN=Contractors – Buttercup- Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com
CN=Contractors – US – Buttercup- Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com
CN=ButtercupLocation - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com
CN=Everyone - M to Q - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com
CN=O365-Buttercup,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com
CN=Contractors - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com
CN=Buttercup-MNOPQ,OU=CIT-WS,OU=Groups,DC=corp,DC=Buttercup,DC=com
<entry key="memberOf">
<value>
<Map>
<entry key="CN=Buttercup Location - Group,OU=SharePoint,OU=Groups,DC=corp,DC=buttercup,DC=com"/>
<entry key="CN=Contractors - Group,OU=SharePoint,OU=Groups,DC=corp,DC=buttercup,DC=com"/>
<entry key="CN=Contractors – Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=buttercup,DC=com"/>
<entry key="CN=Contractors – US – Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com"/>
<entry key="CN=Corp-Hypr,OU=Hypr,OU=Groups,DC=corp,DC=Buttercup,DC=com"/>
<entry key="CN=Everyone - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com"/>
<entry key="CN=Everyone - Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com"/>
<entry key="CN=O365-Buttercup2,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com"/>
<entry key="CN=Buttercup ,OU=SAP Service Accounts and Groups,OU=Service Accounts,DC=corp,DC=Buttercup,DC=com"/>
<entry key="CN=Buttercup-MNOPQ,OU=CIT-WS,OU=Groups,DC=corp,DC=Buttercup,DC=com"/>
</Map>
</value>
</entry>
... View more
- Tags:
- multivalue
Labels
- Labels:
-
field extraction
03-07-2023
01:58 PM
3 Karma
This is just an update to say that I haven't left you hanging. I'm still looking into this.
... View more
03-03-2023
05:57 AM
I'll research this and let you know if it works for me or not. Give me a couple days.
... View more
03-03-2023
05:53 AM
I have to compare against each threshold....literally thousands 🙂
... View more
03-02-2023
04:06 PM
1 Karma
I am trying to create a query to compare thousands of thresholds given in a lookup without having to hardcode the thresholds in eval statements. Example
Query:
index=abc | stats count field1 as F1, field2 as F2, field3 as F3, field4 as F4
Lookup: (thresholds.csv)
Val1
Val2
Val3
Val4
Threshold1
15
50
60
60
Threshold2
52
75
85
95
Condition: if ((F1>Val1 AND F2>VAL2 AND F3>Val3 AND F4>Val4), "Violation", "Compliant")
Hopefully this makes sense.
... View more
Labels
- Labels:
-
splunk-assist
-
troubleshooting
03-29-2019
06:35 AM
This worked perfectly!! Thanks!
... View more
03-28-2019
08:59 AM
I have several services that I need to calculate Avg/min/max for.
{basesearch} | stats avg(transTime) as "Avg", min(transTime) as "Min", max(transTime) as "Max", values(JBossService) as JBoss_Service by JBossService
I need the display to look something like this.
Service1|Service2|Service3|Service4
Avg ____###__|__###__|__##____|__##____
Min ____###__|__###__|__##____|__##____
Max ____###__|__###__|__##____|__##____
Please help!! Thanks 🙂
... View more
- Tags:
- x-axis
10-23-2018
02:42 PM
I am monitoring jobs that run multiple times a day. The query returns the times the job runs per day. Here's an example of how the multi-value field looks. 4:40:32 8:32:55 12:51:40 16:01:03
I want to highlight 4:40:32 green, since it completed before 5:00, then highlight 16:01:03 red because it completed after 16:00. Is it possible to highlight certain values within a cell?
... View more
- Tags:
- highlight
- multivalues
07-10-2018
09:02 AM
This worked perfectly. I only had to incorporate my original queries. Thank you so much!!
... View more
07-09-2018
07:22 AM
Thanks for responding. I see how to set the tokens in panel 2, 3, and 4. I don't understand how to call the tokens in Panel 1.
... View more
07-06-2018
01:11 PM
Here is the layout I'm going for. I need the Availability results from panels 2, 3 and 4 to populate panel 1
|Panel 1
|App1 Availability | App2 Availability | App3 Availability | App4 Availability|
|100% 100% 100% 100% |
|Panel 2 - App2
|Field 1 Field2 Availability
|blah blah 100%
|Panel 3 - App3
|Field 1 Field2 Availability
|blah blah 100%
|Panel 4 - App4
|Field 1 Field2 Availability
|blah blah 100%
... View more
- Tags:
- splunk-enterprise
01-30-2018
07:28 AM
Situation: I have jobs that start running at different times because they are dependent on previous jobs to run successfully. There are two events I am concerned with. One event for "job started" and another event for "job finished".
Goal: Alert when the job has been running for 5 hours or more, regardless of when it started, and has not finished
My approach was to calculate the duration based on the _time from "job started" but I can't determine the syntax on how to prevent an alert if the job finished on time since the "job finished" _time is in a separate event.
I am able to determine the duration using | eval secondsAgoStr=tostring(now() - _time, "duration"
I am also able to calculate the delta of the time using | delta _time AS timeDeltaSeconds p=1
I can't use either of these when the job is currently running because the "job finished" event has not occurred.
... View more
11-03-2017
08:11 AM
That worked..Thank you!!
... View more
11-03-2017
06:33 AM
My lookup is just a 1 column file with the names of the jobs.
My search query of the logs return the jobs that ran last night.
I want to compare the jobs in the search results to the jobs in the lookup.
If a job didn't not run there will not be a match to the lookup.
... View more
11-03-2017
05:51 AM
I have a lookup file of jobs that I must report on. I need to know if the jobs ran then alert if the job didn't run. If it did not run, there will be no log sent to splunk. Here's what I have:
Column 1 - List of jobs from lookup file
Column 2 - Results from search query
Here's what I'm looking to achieve:
Column 1 Column 2 Status
Job1 Job1 Success
Job2 Job2 Success
Job3 Null Failure
Job4 Job4 Success
If the job runs, match the name to its equivalent from the lookup.
If the job fails, leave blank or return null.
If column1 != column2 then trigger alert
I can display the lookup file as well as get results from the query. I can't figure out the one for one match up. I'm sure it's something simple.
... View more
05-24-2016
06:37 AM
Thank you for the fast replies. I will take a look at this and let you know if that does it.
... View more
05-24-2016
06:14 AM
Both the indexers are standalone.
... View more
05-24-2016
05:55 AM
For example, if I needed the logs dated from January 1, 2016 - January 31, 2016 moved to a different indexer. How can this be achieved?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-08-2023
07:04 AM
|
