Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mhornste
mhornste
Path Finder
Member since:
06-14-2016
06-05-2020
Community Statistics
| Posts | 33 |
| Solutions | 2 |
| Karma Given | 7 |
| Karma Received | 1 |
| Member Since | 06-14-2016 |
Activity Feed
- Karma Re: How do I count occurrences with wildcard in count by field? for renjith_nair. 06-05-2020 12:50 AM
- Got Karma for How do I count occurrences with wildcard in count by field?. 06-05-2020 12:50 AM
- Karma Re: Error parsing dashboard XML: Duplicate search type primary is not allowed. Go to "Edit Source" to fix. for niketn. 06-05-2020 12:49 AM
- Karma Re: Calculate average execution time for a known field for woodcock. 06-05-2020 12:48 AM
- Karma Re: Merge two disjunct number fields into one for davebrooking. 06-05-2020 12:48 AM
- Karma Re: fields - values search command breaks dashboard when edit mode was activated for lguinn2. 06-05-2020 12:48 AM
- Karma Re: How to create a table listing users and unique values for other associated fields as HostName or Access? for aljohnson_splun. 06-05-2020 12:47 AM
- Karma Re: Pie Charts in splunk for _d_. 06-05-2020 12:46 AM
- Posted Re: change data upon indexing Admin-0, Admin-1, Admin-2 --> Admin on Getting Data In. 08-22-2019 12:34 AM
- Posted Re: change data upon indexing Admin-0, Admin-1, Admin-2 --> Admin on Getting Data In. 08-21-2019 07:21 AM
- Posted Re: change data upon indexing Admin-0, Admin-1, Admin-2 --> Admin on Getting Data In. 08-21-2019 07:10 AM
- Posted Re: change data upon indexing Admin-0, Admin-1, Admin-2 --> Admin on Getting Data In. 08-21-2019 06:37 AM
- Posted change data upon indexing Admin-0, Admin-1, Admin-2 --> Admin on Getting Data In. 08-21-2019 05:59 AM
- Tagged change data upon indexing Admin-0, Admin-1, Admin-2 --> Admin on Getting Data In. 08-21-2019 05:59 AM
- Posted Re: How do I count occurrences with wildcard in count by field? on Splunk Search. 10-25-2018 06:45 AM
- Posted Re: How do I count occurrences with wildcard in count by field? on Splunk Search. 10-25-2018 05:53 AM
- Posted How do I count occurrences with wildcard in count by field? on Splunk Search. 10-25-2018 04:59 AM
- Tagged How do I count occurrences with wildcard in count by field? on Splunk Search. 10-25-2018 04:59 AM
- Tagged How do I count occurrences with wildcard in count by field? on Splunk Search. 10-25-2018 04:59 AM
- Posted Re: Error parsing dashboard XML: Duplicate search type primary is not allowed. Go to "Edit Source" to fix. on Splunk Search. 04-15-2018 10:41 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-22-2019
12:34 AM
That worked, thanks so much!
... View more
08-21-2019
07:21 AM
https://imgur.com/a/pktkt3s
... View more
08-21-2019
07:10 AM
Hi,
thanks, that worked! There is one small issue left: the label field sometimes still has the ACL (Admin/ User) left. See result of the new indexed data below:
Screenshot result
... View more
08-21-2019
06:37 AM
marking the interesting lines bold did not work
"(?[^,]),(?[^"])"
the above regex splits the two values already into two fields. ACL should have only Admin or User (without -0 etc.)
... View more
08-21-2019
05:59 AM
Hi,
I'm reading data from a JMeter test. One field is either named Admin or Admin-0, Admin-1 or Admin-2. The field is named ACL
I want Splunk to index this only as Admin. As written above, there is a value Admin which should be kept but the others should be renamed to Admin (instead of Admin-0 etc.).
My props.conf already looks like this
[mySourceType]
REPORT-jmeter = REPORT-jmeter
EXTRACT-full = ^(?<timeStamp>[^,]*),(?<elapsed>[^,]*),**"(?<label>[^,]*),(?<ACL>[^"]*)"**,(?<responseCode>[^,]*),(?<responseMessage>[^,]*),(?:(?<targetHost>[^\s]*)\s(?<JMeterThread>[^,]*))?,(?<dataType>[^,]*),(?<success>[^,]*),(?<failureMessage>[^,]*),(?<bytes>[^,]*),(?<sentBytes>[^,]*),(?<grpThreads>[^,]*),(?<allThreads>[^,]*),(?<URL>[^,]*),(?<Latency>[^,]*),(?<IdleTime>[^,]*),(?<Connect>[^$]*)
Example data:
2019/08/21 14:52:14.222,2003**,"Upload Document TXT, User-0"**,302,OK,hostname 1-1,text,true,,1234,0,1,1,https://FQDN,2003,0,0
So the above props.conf already splits two strings into two fields.
May I ask someone to help me to achieve this?
Thanks in advance!
... View more
10-25-2018
06:45 AM
thanks, the replace works great!
... View more
10-25-2018
05:53 AM
Hi,
thanks. That returns a count of each distinct field value. I need a count of all occurences no matter which ID is within the Arguments string.,Hi,
thank you, unfortunately, this does not ignore the ID in the middle of Arguments. I just need a count of all occurrences no matter what ID is in there.
... View more
10-25-2018
04:59 AM
1 Karma
Hi,
I have the following values from my search result:
/api/v2/nodes/107757943/nodes
/api/v2/nodes/107758003/nodes
/api/v2/nodes/107823072/nodes
/api/v2/nodes/107823076/nodes
/api/v2/nodes/11245276/nodes
/api/v2/nodes/11245277/nodes
/api/v2/nodes/11252545/nodes
/api/v2/nodes/11261495/nodes
/api/v2/nodes/11262557/nodes
/api/v2/nodes/11265162/nodes
/api/v2/nodes/11345880/nodes
What I need is a count of these occurrences ignoring the number between the "nodes". The number represents a folder which is browsed.
I used the following query for the above result:
index=otcs host=hostname sourcetype=Timings FunctionAction=api
Arguments="/api/v2/nodes/*/nodes"
I'm using a wildcard to show all results of the condition above no matter which number is there.
Is it possible to do a stats count by with a wildcard condition (Arguments="/api/v2/nodes/*/nodes" )?
... View more
04-15-2018
10:41 PM
Hi niketnilay,
thanks, that worked. All Validation issues are now gone since I have implemented your suggested changes and have also moved the etc. tags into the search tag.
Is there a way in Splunk 7.x to activate legacy mode? The error is gone, but all Dashboards now say "bad allocation" and one is saying " Error in 'eval' command: The expression is malformed. A comparison term is missing. "
Those with bad allocation have e.g. the following search string: QueueDepthFilter | stats QueueDepthFunction(QueueTime) as QueueDepth by host | eval Threshold= QueueDepthThreshold
Thanks
... View more
04-15-2018
05:33 AM
Hi,
I have an entire Dashboard which works with Splunk 6.5.x. very well. Unfortunately, since I upgraded to Splunk 7 (currently 7.0.3, issue also exists with 7.0.1), the following error is displayed when opening the Dashboard:
Error parsing dashboard XML: Duplicate search type primary is not allowed. Go to "Edit Source" to fix.
The dashboard on edit session says "2 Validation errors, 49 validation warnings". I can't find the lines where the errors happen.
Pleas find two screenshots here:
https://imgur.com/a/FlJoF
I'm happy to do the analysis myself, but I don't know where to look.
The Dashboard has the following XML source:
<form>
<label>Performance</label>
<description>Displays current performance status derived from summary timings logs.</description>
<fieldset submitButton="false">
<input type="time">
<label/>
<default>
<earliestTime>-1h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>
<row>
<panel>
<html>
<a href="correlation_charts"><b>Correlation Charts >></b></a> . . | . . <a href="requests_by_function"><b>Performance Analytics >></b></a>. . | . . <a href="queue_time_charts"><b>Queue Time Charts >></b></a>
</html>
</panel>
</row>
<row>
<panel>
<html>
<a href="performance_time_charts?form.metric=ThreadConcurrency">Click for time charts</a>
</html>
<chart>
<title>Thread Usage (Concurrent Threads)</title>
<searchString>| savedsearch ThreadConcurrencyAlert | stats max(concurrency) as "Max Concurrent Treads" by host | eval Threshold = `ThreadConcurrencyThreshold`</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<drilldown>
<link>
<![CDATA[
performance_time_charts?form.metric=ThreadConcurrency
]]>
</link>
</drilldown>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.overlayFields">Threshold</option>
<option name="charting.axisY.maximumNumber">32</option>
<option name="charting.axisLabelsY.majorUnit">8</option>
</chart>
</panel>
<panel>
<html>
<a href="performance_time_charts?form.metric=QueueDepth">Click for time charts</a>
</html>
<chart>
<title>Maximum Queue Depth (requests)</title>
<searchString>`QueueDepthFilter` | stats `QueueDepthFunction(QueueTime)` as QueueDepth by host | eval Threshold=`QueueDepthThreshold`</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<drilldown>
<link>
<![CDATA[
performance_time_charts?form.metric=QueueDepth
]]>
</link>
</drilldown>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.overlayFields">Threshold</option>
<option name="charting.axisY.maximumNumber">16</option>
<option name="charting.axisLabelsY.majorUnit">4</option>
</chart>
</panel>
<panel>
<html>
<a href="performance_time_charts?form.metric=QueueTime">Click for time charts</a>
</html>
<chart>
<title>Average Queue Time (s)</title>
<searchString>`QueueTimeFilter` | stats `QueueTimeFunction(QueueTime)` as QueueTime | eval QueueTime = round(QueueTime, 3) | eval Threshold=`QueueTimeThreshold`</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<drilldown>
<link>
<![CDATA[
performance_time_charts?form.metric=QueueTime
]]>
</link>
</drilldown>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.rangeValues">[0,0.75,1,"2"]</option>
<option name="charting.gaugeColors">[0x84E900,0xFFE800,0xBF3030]</option>
</chart>
</panel>
<panel>
<html>
Click a UserName for details
</html>
<table>
<title>Heavy Users</title>
<searchName>ActiveClientAlert</searchName>
<searchString>| savedsearch HeavyUserAlert</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
<drilldown target="User in Content Server">
<link>
<![CDATA[
https://URL
]]>
</link>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<html>
<a href="performance_time_charts?form.metric=ExecutionTime">Click for time charts</a>
</html>
<chart>
<title>Average Execution Time (s)</title>
<searchString>`ExecutionTimeFilter` | stats `ExecutionTimeFunction(ExecutionTime)` as ExecutionTime | eval ExecutionTime = round(ExecutionTime, 3) | eval Threshold=`ExecutionTimeThreshold`</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<drilldown>
<link>
<![CDATA[
performance_time_charts?form.metric=ExecutionTime
]]>
</link>
</drilldown>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.rangeValues">[0,"0.8","1","2"]</option>
<option name="charting.gaugeColors">[0x84E900,0xFFE800,0xBF3030]</option>
</chart>
</panel>
<panel>
<html>
<a href="performance_time_charts?form.metric=SqlTime">Click for time charts</a>
</html>
<chart>
<title>Average SQL Time (s)</title>
<searchString>`SqlTimeFilter` | stats `SqlTimeFunction(SqlTime)` as SqlTime | eval SqlTime = round(SqlTime, 3) | eval Threshold=`SqlTimeThreshold`</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<drilldown>
<link>
<![CDATA[
performance_time_charts?form.metric=SqlTime
]]>
</link>
</drilldown>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.rangeValues">[0,".4",".5","1"]</option>
<option name="charting.gaugeColors">[0x84E900,0xFFE800,0xBF3030]</option>
</chart>
</panel>
<panel>
<html>
<a href="performance_time_charts?form.metric=SearchTime">Click for time charts</a>
</html>
<chart>
<title>Median Search Time (s)</title>
<searchString>`SearchTimeFilter` | stats `SearchTimeFunction(SearchTime)` as SearchTime | eval SearchTime = round(SearchTime, 3) | eval Threshold=`SearchTimeThreshold`</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<drilldown>
<link>
<![CDATA[
performance_time_charts?form.metric=SearchTime
]]>
</link>
</drilldown>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.chart.rangeValues">[0,"8","10","20"]</option>
<option name="charting.gaugeColors">[0x84E900,0xFFE800,0xBF3030]</option>
</chart>
</panel>
<panel>
<html>
Click an ObjectId for details
</html>
<table>
<title>Slow Objects</title>
<searchString>| savedsearch SlowObjectAlert</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<drilldown target="Object in Content Server">
<link>
<![CDATA[
https://URL
]]>
</link>
</drilldown>
</table>
</panel>
</row>
</form>
... View more
04-11-2018
11:47 PM
Hi,
I have several fields which should be summed up to one count. I tried the following but the field is not showing up (even with fields + fieldname).
index=otcs sourcetype=OtcsSummaryTimings FunctionAction="doc.fetch" OR FunctionAction="doc.Fetch" OR FunctionAction="fetch" | eval sumFetch=doc.Fetch+doc.fetch+fetch | timechart span=7d count by FunctionAction
The result only shows the fields without the calculated one. I unfortunately can't attach files (karma).
Thanks!
... View more
- Tags:
- sum
06-08-2017
08:13 AM
Hi,
I have a working search which returns me IDs for specifing meanings of the values. I also have a working inputlookup file which has the sime IDs and the meaning of the IDs. I'd like to display the meaning value from the inputlookup file instead of the IDs. Is this possible?
Search:
index=rc sourcetype=OtcsRemoteCache Operation="1*"
| stats count by Operation
The lookup looks as follows:
OperationCode,Meaning,Direction
1001,Create Document,Remote Cache
1002,Get Version Metadata, Remote Cache
1003,Get Version Metadata from Cache, Remote Cache
1004,Get Version Content,Remote Cache
1005,Get Web Page, Remote Cache
1006,Get Document, Remote Cache
1007,Add Web Pages,Remote Cache
1008,Add Version,Remote Cache
1009,Promote Version,Remote Cache
1010,Delete,Remote Cache
1011,Get SNF for Document ID,Remote Cache
1012,Get Component Stream,Remote Cache
1013,Get Component Stream from Cache,Remote Cache
1014,Set Component Stream,Remote Cache
1015,Get Component Info,Remote Cache
1016,Get Component Info from Cache,Remote Cache
1017,Delete Component,Remote Cache
1018,Create Component,Remote Cache
The following search returns the correct values:
| inputlookup otcs_remote_cache_lookup.csv
| where Direction="Remote Cache"
| table Meaning, OperationCode
How can I display the Meaning field from the lookup in the pie chart instead of the IDs?
Thanks!
Martin
... View more
06-08-2017
07:46 AM
Hi,
I have execution times in my index. I want to show statistics of long running queries (e.g. longer than 10 seconds). I'd like to display it in a pie chart.
The following query provides the correct counts, however, the pie chart is not working.
index=rc sourcetype=OtcsRemoteCache Operation=1001 Time_ms >= 10000| stats count
| rename count as "Long Running Requests"
| append [search index=rc sourcetype=OtcsRemoteCache Operation=1001 Time_ms <10000| stats count
| rename count as "Normal Requests"]
I know that I have to use "Stats count by comparison_category" but I can't make it work.
Any suggestions please?
... View more
06-02-2017
03:27 AM
Hi,
thank you for your response. I'm afraid I explained not well enough.
I'd like to see the "Get Version Content" in the Description of the Dashboard, e.g.:
"Performance by Operation for Get Version Content "
I can use the DropDown Token $RCFunctionSelector$ but then I only get the Value (in this case 1001) instead of the meaning of the operation.
Thanks!
... View more
06-02-2017
02:40 AM
Thank you, it worked. I must have been blind not to see it.
Do you know if there is a way to access the Label value of the drop down in a search or description? On top of the dashboard, I'd like to display the currently selected Value (=Meaning).
Thank you!
... View more
06-01-2017
10:59 PM
Hi,
I have prepared an input lookup file which has the following contents:
OperationCode,Meaning,Direction
1001,Create Document,RemoteCache
I have managed to create a drop down which loads the Meaning field from the input lookup as Field for Label.
The drop down looks as follows:
<input type="dropdown" token="RCFunctionSelector">
<label>field1</label>
<default>1001</default>
<fieldForLabel>Meaning</fieldForLabel>
<fieldForValue>OperationCode</fieldForValue>
<search>
<query>| inputlookup otcs_remote_cache_lookup.csv
| table Meaning, OperationCode</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<initialValue>1001</initialValue>
</input>
I'd like to achieve now that the Field for Value (= OperationCode in lookup) can be used in a search.
I started with the query which doesn't work:
index=rc sourcetype=OtcsRemoteCache Operation=$OperationCode$
| table _time,Time_ms
How can I access the Field for Value variable of a drop down for a search?
Thanks!
... View more
02-15-2017
12:14 AM
Hi,
I have added one stanza for each sourcetype since the host can change. Unfortunately, it is not working (I have restarted Splunk).
If I use the searches with the regular expression (I slightly changed the fields), I can access the fields and the data is displayed properly
https://i.imgsafe.org/40cb74e826.png
My props.conf looks as follows:
# ignore JMeter Header
TRANSFORMS-IgnoreJMeterHeader = JMeterHeader_ignore
# assign fields
REPORT-JMeter = JMeterFields
[Augsburg]
EXTRACT-label = ^(?<labelNew>[^,]+),(?<ACL>.+) in label
EXTRACT-targetHost = ^(?<targetHostNew>[^\s]+)\s(?<JMeterThread>.+) in threadName
[localhost]
EXTRACT-label = ^(?<labelNew>[^,]+),(?<ACL>.+) in label
EXTRACT-targetHost = ^(?<targetHostNew>[^\s]+)\s(?<JMeterThread>.+) in threadName
[Augsburg_Workstation]
EXTRACT-label = ^(?<labelNew>[^,]+),(?<ACL>.+) in label
EXTRACT-targetHost = ^(?<targetHostNew>[^\s]+)\s(?<JMeterThread>.+) in threadName
[Holeby]
EXTRACT-label = ^(?<labelNew>[^,]+),(?<ACL>.+) in label
EXTRACT-targetHost = ^(?<targetHostNew>[^\s]+)\s(?<JMeterThread>.+) in threadName
[Kopenhagen]
EXTRACT-label = ^(?<labelNew>[^,]+),(?<ACL>.+) in label
EXTRACT-targetHost = ^(?<targetHostNew>[^\s]+)\s(?<JMeterThread>.+) in threadName
[Oberhausen]
EXTRACT-label = ^(?<labelNew>[^,]+),(?<ACL>.+) in label
EXTRACT-targetHost = ^(?<targetHostNew>[^\s]+)\s(?<JMeterThread>.+) in threadName
I have gone through the props.conf documentation and have also checked the splunkd log file but couldnt find a hint. Is there a way to check if these EXTRACTs are loaded by splunk?
... View more
02-14-2017
11:17 PM
Oh, yes I have restarted splunkd!
... View more
02-14-2017
11:12 PM
Hi,
of course, thank you!
props.conf:
#[JMeterOutput]
#Eval-TargetHost = substr(threadName, 1, len(threadName)-4)
#Eval-JMeterThread = substr(threadName, len(threadName)-2, 3)
# ignore JMeter Header
TRANSFORMS-IgnoreJMeterHeader = JMeterHeader_ignore
# assign fields
REPORT-JMeter = JMeterFields
EXTRACT-label = ^(?<label>[^,]+),(?<ACL>.+) in label
EXTRACT-targetHost = ^(?<targetHost>[^\s]+)\s(?<JMeterThread>.+) in threadName
transforms.conf:
#
# Discarding the header lines in the jmeter logs (directed to the nullQueue)
#
[JMeterHeader_ignore]
REGEX = ^timeStamp,elapsed,label,responseCode,
DEST_KEY = queue
FORMAT = nullQueue
#
# Extracting CSV fields from JMeter logs
#
[JMeterFields]
DELIMS = ","
#CHECK_FOR_HEADER = true
#HEADER_MODE = firstline
FIELDS = timeStamp,elapsed,label,responseCode,responseMessage,threadName,dataType,success,failureMessage,sentBytes,grpThreads,allThreads,field14,Latency,Hostname,IdleTime,Connect
I have several JMeter Source types since I'm seperating several locations by the sourcetype. Will I have to add one stanza per sourcetype then?
# Augsburg Server
[monitor://\\jmeterhost\Jmeter\Log\Augsburg\Augsburg.csv]
disabled = 0
host = jmeterhost.fqdn
index = jmeter
sourcetype = Augsburg
followTail = 0
initCrcLength = 512
# local Frontend 1
[monitor://\\jmeterhost\Jmeter\Log\localhost\localhost.csv]
disabled = 0
host = jmeterhost.fqdn
index = jmeter
sourcetype = localhost
followTail = 0
initCrcLength = 512
# Augsburg Workstation
[monitor://\\jmeterhost\Jmeter\Log\Augsburg_Workstation\workstation.csv]
disabled = 0
host = jmeterhost.fqdn
index = jmeter
sourcetype = Augsburg_Workstation
followTail = 0
initCrcLength = 512
# Location Holeby
[monitor://\\jmeterhost\Jmeter\Log\Holeby\holeby.csv]
disabled = 0
host = jmeterhost.fqdn
index = jmeter
sourcetype = Holeby
followTail = 0
initCrcLength = 512
# Kopenhagen
[monitor://\\jmeterhost\Jmeter\Log\Kopenhagen\kopenhagen.csv]
disabled = 0
host = jmeterhost.fqdn
index = jmeter
sourcetype = Kopenhagen
followTail = 0
initCrcLength = 512
# Oberhausen
[monitor://\\jmeterhost\Jmeter\Log\Oberhausen\oberhausen.csv]
disabled = 0
host = jmeterhost.fqdn
index = jmeter
sourcetype = Oberhausen
followTail = 0
initCrcLength = 512
... View more
02-14-2017
06:55 AM
Hi,
thanks, the rex both work quite fine. I have added both lines to thte props.conf but unfortunately, they don't show up/ doesn'd work.
I have extracted the fields (label and threadName) and can select them.
https://i.imgsafe.org/31a7074be4.png
... View more
02-14-2017
02:23 AM
Hi,
I have source data comma delimited like this from JMeter:
timeStamp,elapsed,label,responseCode,responseMessage,threadName,dataType,success,failureMessage,bytes,sentBytes,grpThreads,allThreads,Latency,Hostname,IdleTime,Connect
2017/02/14 10:28:42.845,2645,"Login,Admin",200,OK,hostname 5-1,text,true,,66355,0,1,8,2109,JMeterServerHost,0,0
I would like to split the following two fields into four:
field name = label
Login,Admin to be split into these fields upon indexing:
--> label = Login
--> ACL = Admin
field name = threadName
hostname 5-1 to be split into these fields upon indexing:
--> targetHost = hostname
--> JMeterThread = 5-1
How can I configure this in props.conf/ transforms.conf to make it work?
I have already tried the following in props.conf (confirmed with a Splunk search:
Eval-TargetHost = substr(threadName, 1, len(threadName)-4)
--> removes the 5-1
Eval-JMeterThread = substr(threadName, len(threadName)-2, 3)
--> removes the hostname
Unfortunately, it doesn't work or I can't access the fields. I'm pretty new to regular expressions and splitting fields in props/ transforms.conf.
In additon, I found a regex which removes everything after the comma (,) for Login,Admin but I don't know how to also split them. Here's the regex I have tested : \,.*$. It removes everything after Login, since there is a comma. But how can I create two new fields which contain Login and Admin?
Thanks!
... View more
- Tags:
- index
- split-indexing
02-01-2017
11:37 PM
Thanks, it worked!
... View more
01-31-2017
11:51 PM
Hi,
I'm running Splunk 6.4.0 with two customers.
When using the fields - values search command, the dashboard is not showing any data after I have clicked on Edit --> Panels. The spaces are automatically removed from fields - values --> fields-values resulting in the dashboard not showing any data any more (I can't attach a screenshot due to missing karma points). This is really annoying.
Maybe external links are allowed: http://imgur.com/a/4tGWt
I'm using the following search string:
index=otcs eventtype="SummaryTiming" | stats count values(FunctionAction), avg(ExecutionTime) by ContextUserName| fields - values(FunctionAction) | $user_avgexecution_sort$ | Rename ContextUserName as "Requesting User" | Rename count as "Number of Requests" | Rename avg(ExecutionTime) as "Average Execution Time"
Is this a bug of Splunk 6.4.x?
... View more
09-01-2016
06:28 AM
I have the same problem. I'm not using SSL and enable_query_wrapping = 0/ 1 don't work (both of them).
... View more
09-01-2016
06:15 AM
dbx2.log.29160901 says:
2016-09-01T15:07:18+0200 [ERROR] [modular_input_event_writer.py], line 102: action=converting_incoming_data_in_csv_to_event_stream_failed input_mode=batch dbinput="mi_input://DTreeNotify" error="invalid literal for float(): 1472735238,704"
The SQL returns by default an integer.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
