Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About thirumalreddyb
thirumalreddyb
Communicator
Member since:
01-30-2013
06-05-2020
Community Statistics
| Posts | 50 |
| Solutions | 3 |
| Karma Given | 8 |
| Karma Received | 7 |
| Member Since | 01-30-2013 |
Activity Feed
- Got Karma for Re: How to keep the results for each day from a daily scheduled search on dashboard for the last 1 month?. 12-30-2021 05:10 AM
- Karma Re: Can you verify my plans for a search head cluster configuration? for jdosch1. 06-05-2020 12:49 AM
- Got Karma for How to configure a different replication port for each splunk instance on same unix instance?. 06-05-2020 12:49 AM
- Got Karma for Re: How do I consume tokens from the URL?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I consume tokens from the URL?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I consume tokens from the URL?. 06-05-2020 12:47 AM
- Got Karma for Re: How to handle a daily changing CSV file and avoid indexing duplicate events/rows?. 06-05-2020 12:47 AM
- Karma Re: saving result of a search query to a variable in order to use in another search for bmacias84. 06-05-2020 12:46 AM
- Karma Re: mapping headers to data in csv for the_wolverine. 06-05-2020 12:46 AM
- Karma Re: How to create a new field with values in existing field based on the values in other field. for Gilberto_Castil. 06-05-2020 12:46 AM
- Karma Re: dynamic change of bg color based on single value for stephanefotso. 06-05-2020 12:46 AM
- Karma Re: Build data from index for lukejadamec. 06-05-2020 12:46 AM
- Karma Re: Build data from index for somesoni2. 06-05-2020 12:46 AM
- Got Karma for compare three searches in one timechart by month wise. 06-05-2020 12:46 AM
- Posted Re: How to configure a different replication port for each splunk instance on same unix instance? on Deployment Architecture. 08-21-2017 04:51 PM
- Posted Re: How to configure a different replication port for each splunk instance on same unix instance? on Deployment Architecture. 08-20-2017 06:56 PM
- Posted How to configure a different replication port for each splunk instance on same unix instance? on Deployment Architecture. 08-20-2017 08:53 AM
- Tagged How to configure a different replication port for each splunk instance on same unix instance? on Deployment Architecture. 08-20-2017 08:53 AM
- Posted Re: why is eval function not working for calculated field but works when run as a search using two different source type on Splunk Search. 06-21-2017 06:29 AM
- Posted Re: Splunk Login page on Security. 06-21-2017 06:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-21-2017
04:51 PM
Yes, purely to test. Luckily Splunk + Linux is the best way to play around.
... View more
08-20-2017
06:56 PM
Ok., increased to three.
... View more
08-20-2017
08:53 AM
1 Karma
I have an uncommon situation.
We have multiple Splunk instances on a single unix instance; two search heads, one deployer, and two indexers. The problem now is to setup a search head cluster.
Would someone please help with the configurations?
Thanks in advance.
... View more
06-21-2017
06:29 AM
You query would work only if all the fields that you are using in the eval expression are under the same sourcetype/source/host based on the stanza that you are using in your props.
... View more
06-21-2017
06:11 AM
What about the same errors on search head in distributed environment?
... View more
06-10-2017
11:30 PM
I downvoted this post because this is not an answer. this prevented others from looking into the question.
... View more
06-08-2017
05:22 AM
We collect them in xml format.
... View more
06-08-2017
05:06 AM
Yes, this is that format => %Y-%m-%dT%H:%M:%S.%9NZ
... View more
06-08-2017
03:24 AM
Splunk is not parsing the milliseconds into _time field. How to parse it during the index time?
I have updated my TIME_FORMAT in props in all the search peers; yet it is not parsing properly.
Thanks in advance.
... View more
06-08-2017
03:20 AM
Exactly what I was looking for.
Many thanks!
... View more
05-29-2017
09:35 PM
Hello,
I was looking for a best way to check app updates, like a bulk way. Is there any Splunk app which would generate a dashboard/report which has the name of the app and the associated update.
If not app, any best way?
Thanks in advance.
... View more
01-30-2017
08:35 PM
| top limit=0 Questions should do your work.
... View more
10-20-2016
02:24 AM
com.Intersplunk is misisng and it is a package part of Splunk's python sdk. For some reason it is not loading properly. Have you upgraded Splunk in recent times or a fresh install?
Also check if there is a package with that name here SPLUNK_HOME$/lib/python2.7/site-packages/splunk.
... View more
06-07-2016
06:05 AM
I have a folder with plenty of zip files. Every zip is a zipped folder with folder inside a folder and the deepest folder contains an XML file.
The zip contains file like this;
ZipFolder > src > log > 20160605183045.xml.
The zip files are present in the below location,
D:\BrowniesApp\Logs[zip files present here]
... View more
05-16-2016
10:37 AM
What if those tokens should work on a sub-search?
... View more
01-04-2016
03:56 AM
Yes! You can use custom javascript to do this and use HTML or webframework to build your dashboards instead of simple xml.
... View more
01-04-2016
03:52 AM
your search query with data ..... | lookup msgId msg OUTPUT critical
... View more
01-04-2016
03:49 AM
If your data has millions of records, then definitely it is not advisable to use lookups. Try joins !
... View more
01-04-2016
03:47 AM
1 Karma
If your number of results are less then,
your search query.... | append [|inputlookup RESULTS.csv | eval epoch_date=strptime(date,"%Y-%m-%d") (or whatever the format) | where epoch_date>=now-(30*86400) ]outputlookup RESULTS.csv
Now schedule this search to run at 00:01 hours everyday and use the RESULTS.csv to power your dashboard.
P.S: Accept the answer if it is useful.
... View more
12-30-2015
05:50 AM
| stats latest(created) as last, list(msg), list(filename) by jobid, created | sort last | fields - last
This should solve your problem.
... View more
12-30-2015
05:16 AM
You need to write custom javascript that does the trick for you. I hope you are doing this in webframework and hence you can include your js within the page and read the value from the javascript and then based on the value, you can set it to either green or red.
... View more
12-30-2015
05:16 AM
Print the search query to a file/log and run the same query in the Splunk UI. This might help you understand whether your query has any other errors and search violations or any. As I know of, there isn't any such limit for OR.
... View more
12-30-2015
05:10 AM
your query ...... | eval splits=split(value,".") | eval count=mvcount(splits) | eval value=if(count>1,value,mvindex(splits,0)) | eval value=value."%" | table value
Now choose your visualization to be "single value".
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
