Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kiran_mh
kiran_mh
Explorer
Member since:
06-02-2016
06-05-2020
Community Statistics
| Posts | 24 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 06-02-2016 |
Activity Feed
- Got Karma for How to mac address for a particular user?. 11-26-2020 12:04 AM
- Karma Re: Hiding the "Manage Apps..." menu. for Damien_Dallimor. 06-05-2020 12:46 AM
- Posted Re: Machine Learning Toolkit: Why is Predication showcase not working as expected? on All Apps and Add-ons. 01-04-2017 12:54 AM
- Posted Re: Machine Learning Toolkit: Why is Predication showcase not working as expected? on All Apps and Add-ons. 01-03-2017 01:04 AM
- Posted Machine Learning Toolkit: Why is Predication showcase not working as expected? on All Apps and Add-ons. 12-23-2016 01:35 AM
- Posted Re: How to get a progressive chart of hosts added over time using the metadata command firstTime field on Splunk Search. 12-19-2016 10:45 PM
- Posted Re: Hosts added to Splunk instance on Deployment Architecture. 11-18-2016 12:06 AM
- Posted Re: How to edit my regular expression to extract fields that contain "CASE" but not "Case" or "case"? on Splunk Search. 11-18-2016 12:03 AM
- Posted How to edit my regular expression to extract fields that contain "CASE" but not "Case" or "case"? on Splunk Search. 11-17-2016 10:26 PM
- Tagged How to edit my regular expression to extract fields that contain "CASE" but not "Case" or "case"? on Splunk Search. 11-17-2016 10:26 PM
- Tagged How to edit my regular expression to extract fields that contain "CASE" but not "Case" or "case"? on Splunk Search. 11-17-2016 10:26 PM
- Tagged How to edit my regular expression to extract fields that contain "CASE" but not "Case" or "case"? on Splunk Search. 11-17-2016 10:26 PM
- Posted Hosts added to Splunk instance on Deployment Architecture. 10-20-2016 04:06 AM
- Tagged Hosts added to Splunk instance on Deployment Architecture. 10-20-2016 04:06 AM
- Posted Search Activity app set up in Splunk Cloud on All Apps and Add-ons. 10-19-2016 05:24 AM
- Tagged Search Activity app set up in Splunk Cloud on All Apps and Add-ons. 10-19-2016 05:24 AM
- Posted Re: How to get list of hosts added to our instance in the last 7 days? on Deployment Architecture. 09-21-2016 01:59 AM
- Posted how to get the license usage of other hosts which do not match a pattern? on Installation. 09-20-2016 12:22 AM
- Tagged how to get the license usage of other hosts which do not match a pattern? on Installation. 09-20-2016 12:22 AM
- Posted How to get list of hosts added to our instance in the last 7 days? on Deployment Architecture. 09-16-2016 01:16 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
01-04-2017
12:54 AM
It ranges from "700" to "800".
Please find the Inputs.
_time Info Warning Critical
2016-12-04 0.00000 0 0
2016-12-05 724.14825 0 0
2016-12-06 772.61592 0 0
2016-12-07 789.88528 0 0
2016-12-08 774.01143 0 0
2016-12-09 751.44294 0 0
2016-12-10 581.31427 0 0
2016-12-11 560.07010 0 0
2016-12-12 695.39823 0 0
2016-12-13 733.44824 0 0
Please find the Prediction results.
Info predicted(Info) residual _time Critical Warning
724.14825 605.99 118.16 05-12-2016 0 0
772.61592 607.35 165.27 06-12-2016 0 0
560.0701 614.18 -54.11 11-12-2016 0 0
733.44824 616.91 116.54 13-12-2016 0 0
696.90872 621.01 75.9 16-12-2016 0 0
731.71623 626.47 105.25 20-12-2016 0 0
690.88541 629.2 61.69 22-12-2016 0 0
656.51752 630.56 25.96 23-12-2016 0 0
601.12301 634.66 -33.54 26-12-2016 0 0
676.66416 637.39 39.27 28-12-2016 0 0
The prediction result is continuously increasing from 600. There should be up and down in the results as per the input. we are expecting a approx. results based on the inputs.
... View more
01-03-2017
01:04 AM
All fields are numeric including Info filed. "GB" was just to specify them as we have used the License usage query.
Its "700 to 800".
... View more
12-23-2016
01:35 AM
Hi All,
This is regarding Predication showcase of Machine Learning Toolkit App. I am using License usage query, there are three fields "Info", "Warning" and "Critical". Please find the current fields value.
Info : More than 700 GB and less than 800 GB
Warning : 0
Critical: 0
Prediction Query : | fit LinearRegression fit_intercept=true "Info" from "_time" "Critical" "Warning" into "default_model_name" .
"Info" field is used for prediction. "Warning", "Critical" and "_time" fields are used for predicting the value. I am not getting the corresponding actual prediction result. Please check and let us know to proceed further.
... View more
12-19-2016
10:45 PM
Hi somesoni2,
Using your query is it possible to get the hosts name as well?
We want to know which hosts were added in the last 7 days , a report to be generated weekly once which gives us the list of hosts which were added in the last 7 days.
Thanks in Advance
... View more
11-18-2016
12:06 AM
Hi lguinn,
"added in the last week" refers to hosts that are added in the past week irrespective of they are sending data or not, the very first existence of the host in the splunk instance.
In our instance host refers to the names in the host field that users can see....
... View more
11-18-2016
12:03 AM
Thank you gokaroid,
We need only the logs that contain "CASE"- all upper case, rest like "Case" should be discarded
Please help with this..
Thanks in advance
... View more
11-17-2016
10:26 PM
Hi,
I have the following expression (?=[^C]*(?:CASE|C.*CASE))^(?:[^:\n]*:){5}\s+\w+(?P.+) , which is used to extract fields but I only want fields that contain "CASE" and not "Case" or "case".
Thank you
Regards,
KIran
... View more
10-20-2016
04:06 AM
Hi,
How to get list of hosts added to our splunk instance in the past week?
Thanks in Advance
... View more
- Tags:
- splunk-cloud
10-19-2016
05:24 AM
HI,
We want to know how to set up the 'Search Activity' App in our splunk instance, we are using 'splunk cloud 6.4'
Kindly, help us.
... View more
- Tags:
- splunk-cloud
09-21-2016
01:59 AM
thanks for your reply..
In the given query we are getting hosts which were added way before 7 days , actually we wanted to get a list of only new hosts added to our instance
... View more
09-20-2016
12:22 AM
Hi,
We have the following query:
index =_internal source =*license_usage.log type ="Usage" | eval Team =case(h like "%-ec2%" OR h like "%-usnw%" OR h like "%-usw%" OR h like "IP-%" OR h like "%-EU%" OR h like "%-SYD%" OR h like "%-BR%" OR h like "%-AP%" OR h like "%-JP%" OR h like "%-load%" OR h like "ens-%", "AWS", h like "%-IAD" OR h like "%-FRA" OR h like "%-LAS" OR h like "%-AMS" OR h like "%-STAGE", "COLO" , h like "STORAGE-BIGDATA-%" OR h like "SF-AZUZE-%" OR h like "STORAGE-USE-%" OR h like "STORAGE-USNC-%" OR h like "STORAGE-APE-%" OR h like "STORAGE-EUN-%", "AZURE") | eval GB=(b/(1024*1024*1024)) | stats sum(GB) by Team | rename sum(GB) as License_Usage_GB | sort -License_Usage_GB
which gives us the license usage of hosts in a particular team,
we want to get the license usage of other hosts which do not match the given patterns above.
Thanks in advance.........
... View more
- Tags:
- splunk-cloud
09-16-2016
01:16 AM
Hi,
I wanted to know hosts added to our instance in the last 7 days,
We want to create a report for this,
Kindly help..
Thanks in advance
... View more
- Tags:
- splunk-cloud
09-06-2016
11:29 PM
we wanted to create an alert that triggers each time when a message is displayed in our splunk cloud instance...
help with this...
Thanks..in advance
... View more
- Tags:
- splunk-cloud
08-04-2016
12:29 AM
Thank you.
One more thing, we have the following query
index=msexchange sourcetype="MSExchange:2013:HttpProxy" host="ftlpex02cas01.citrite.net" RpcHttp AND "/rpc/rpcproxy.dll" |timechart span=1d count | trendline sma2(count) as trend |stats latest(count) as count latest(trend) as trend | eval alert=if(trend > count, "yes", "no")
But in this query the timechart is not working , we are not getting the _time field.
Thanks in advance
... View more
08-03-2016
06:44 AM
1 Karma
Hi,
I wanted to get the mac address for a particular user, user=paraga
The problem was the user account got locked out
so we want to know which caused this issue...
Thanks in advance.
... View more
- Tags:
- splunk-cloud
08-03-2016
03:26 AM
hi,
index=msexchange sourcetype="MSExchange:2013:HttpProxy" host="ftlpex02cas01.citrite.net" RpcHttp AND "/rpc/rpcproxy.dll" |timechart span=1d count | trendline sma2(count) as trend | stats latest(count) as Count latest(trend) as trend | eval alert=if(trend > Count, "yes", "no")
i have the above query which has three fields count , trend and alert
But i am not able to get the values for the three fields for the last 7 days i.e i want the values for the three fields to displayed along with date for last 7 days
Thanks in advance
... View more
- Tags:
- splunk-cloud
07-01-2016
04:45 AM
how to get the number of logins per user for the past 30 days
in splunk
also, if there is a metric we can see how long users are logged into the splunk
We also need to know how much hours a user is accessing splunk per day
... View more
06-30-2016
11:15 PM
We want to know how to get the number of logins per user for the past 30 days? and also, if there is a metric we can see how long users are logged into the system .
... View more
- Tags:
- splunk-cloud
06-20-2016
05:16 AM
We don't have a license master , each heavy forwarder have licenses installed in them itself....
... View more
06-16-2016
11:51 PM
thanks for your reply ryanoconnor.....but I m not getting results when I run the query
Currently we have 8 heavy forwarders and 1 deployment server in our instance, splunk cloud 6.4
... View more
06-16-2016
03:56 AM
Hi
Is there a way an alert can be created to notify us about the license expiration of a heavy forwarder?
For example, we want to get notified when the license for heavy forwarder is about to expire in say 30 days...?
... View more
06-08-2016
06:48 AM
How can I get the index volume for a particular sourcetype, for example sourcetype=perfmon*..?
... View more
06-02-2016
04:32 AM
Hi...I wanted to know how we can create an alert when the license usage of a "heavy forwarder" reaches a threshold say about 90% of license usage. We want to get alerted when such a thing occurs. Currently I have the following search:
index =_internal source = *license_usage.log* type = Usage earliest=-7d@d latest=now | search h=ftlpsplunkfwd01.citrite.net | eval MB=b/(1024*1024) | eval date=strftime(_time, "%1m/%0d/%Y") | stats sum(MB) as Usage(MB) by date
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
