About ndkhoiits

ndkhoiits · ‎06-24-2014

Would you like to give me a clear explanation or a sample

ndkhoiits · ‎06-24-2014

This example is my real world data

ndkhoiits · ‎06-24-2014

Thanks for your answer, however in my requirement there are 3 sites which need to be included in the report, so I don't know how to use mvzip in this case

ndkhoiits · ‎06-24-2014

The chart can be something like that https://docs.google.com/file/d/0B_zzVMkc4PNJN1p3LU1fMGZ4cWs

ndkhoiits · ‎06-24-2014

Today, I have to create a chart from log in json format. The log is something like that: Expired token in next 3 days {"data":[{"date":"2014-06-25","Site1":100,"Site2":23,"Site3":133},{"date":"2014-06-26","Site1":200,"Site2":223,"Site3":232},{"date":"2014-06-24","Site1":150,"Site2":342,"Site3":422}]} Output should be a chart (column chart) which contains information about date and number of expired token for each site The log will show the list of expire token from 3 sites for next 3 days. The json format can be changed to whatever for suitable. Anyone please help to give me any suggestion.

ndkhoiits · ‎02-16-2014

Would you like to explain me more detail about how to configure the props.conf

ndkhoiits · ‎02-14-2014

I have a log file which contains a log like following: 2014-02-14 01:49:22,938 Updated this customer: email: [email protected], created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY. once I search in splunk [email protected] I have this result 2012-03-11 02:11:34 email: [email protected], created: 2012-03-11 02:11:34, firstname: XXX, lastname YYY. Splunk considers time in the log as event time, it should returns full event (include 2 lines as my example) instead of. How can I config splunk to fix this problem, event time always is at the first line

ndkhoiits · ‎02-10-2014

I have 5 sites S1, S2, S3, S4, S5, I used splunk to monitor all requests to these sites. Now I want to statistic number of user who access site S1, S2, S3, S4, S5 per day. For example my data is u1 accessed site s1 u1 accessed site s2 u1 accessed site s3 u2 accessed site s1 u1 accessed site s2 u2 accessed site s4 u3 accessed site s2 u1 accessed site s1 u1 accessed site s2 u3 accessed site s2 u4 accessed site s1 My expected report is: S1 S2 S3 S4 S5 3 3 1 1 0 Even s1 was accessed 4 times, but number of user is 3. Same as other sites How can I have this statistic with splunk 6. Thank for any suggestion.

ndkhoiits · ‎01-24-2014

I need a statistic which show total events in 1 month, 1 week and 1 day and create a dashboard, for example column chart which has 3 columns, first for total request in 1 month, second for 1 week and third for 1 day. How to do that in splunk

ndkhoiits · ‎01-24-2014

I need a statistic which show latest 50 events in the log, can we do this with splunk?

ndkhoiits · ‎12-24-2013

Thank @guilmxm, however there are no results found with group per_index_thruput

ndkhoiits · ‎12-24-2013

I used the REST endpoint /services/licenser/pools to get current usage data for licenser, however I need to report the usage in 1 month or 1 week, does Splunk has any endpoints that support that?

ndkhoiits · ‎12-24-2013

Thanks for your answer, I'm using Splunk 6, I see there is a feature named 'licenseusage' however the page was rendering with js. So I have to query for the information.

ndkhoiits · ‎12-23-2013

I use Splunk to index the log files from several server, today I have to report the indexed log size everyday as a chart, data is only 1 week for reporting. Anyone has idea for creating a query and make a chart

ndkhoiits · ‎12-09-2013

I used your query and always returns no result for that

ndkhoiits · ‎12-08-2013

Hi @somesoni2, what you mean about sourcetype command in your query?

ndkhoiits · ‎12-08-2013

Hi, I'm using splunk for caching the log and reporting, now I need to query in splunk for user action and generate a report. My case will be showed as following I had several events in a log like : e1: [[email protected]] Login system with username:email1 e2: [[email protected]] Read articleId:art1 e3: [[email protected]] Read articleId:art2 e4: [[email protected]] Login system with username:email2 Now I want to list all actions made by user who read article with articleId is art1. Which search statement can help me?

Posts	17
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎08-27-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Extract JSON data to chart

Wrong event time in multiple lines events

Count number of user access the site

Get total events for the last 1 month, 1 week and ...

Get latest 50 events in the search

REST service endpoint for licenser used in a perio...

How can I statistic daily indexed log size

Combine multiple events for reporting

Re: Extract JSON data to chart

Re: Extract JSON data to chart

Re: Extract JSON data to chart

Re: Extract JSON data to chart

Extract JSON data to chart

Re: Wrong event time in multiple lines events

Wrong event time in multiple lines events

Count number of user access the site

Get total events for the last 1 month, 1 week and ...

Get latest 50 events in the search

Re: How can I statistic daily indexed log size

REST service endpoint for licenser used in a perio...

Re: How can I statistic daily indexed log size

How can I statistic daily indexed log size

Re: Combine multiple events for reporting

Re: Combine multiple events for reporting

Combine multiple events for reporting

Join the Conversation