Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About lakromani
lakromani
Builder
Member since:
09-03-2013
03-01-2021
Community Statistics
| Posts | 210 |
| Solutions | 4 |
| Karma Given | 48 |
| Karma Received | 37 |
| Member Since | 09-03-2013 |
Activity Feed
- Got Karma for Re: How to remove "missing" forwarders from the Distributed Management Console?. 12-27-2023 12:52 AM
- Got Karma for Re: What is the cron time for every day at 9 AM. 11-05-2021 05:24 AM
- Got Karma for Re: How to get a list of all emails sent out by Splunk and all associated reports and alerts?. 09-22-2021 12:40 AM
- Posted Re: How to determine how long splunk has been up? on Monitoring Splunk. 10-25-2020 11:34 AM
- Posted Re: Getting error "sendemail:1370": Users can't send mail after upgrade from 7.2.6 to 8.0.5. on Splunk Enterprise. 09-02-2020 10:35 PM
- Got Karma for Re: How to remove "missing" forwarders from the Distributed Management Console?. 08-26-2020 10:58 AM
- Got Karma for Re: Upgrading from Splunk 6.3.2 to 6.3.3 on an Ubuntu server, why am I unable to start Splunk?. 06-20-2020 05:21 PM
- Karma Re: Where did Splunk 7.3.1 go? for claudio_manig. 06-05-2020 12:50 AM
- Karma Re: How to count unique events pr class for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: Using color in reports (saved search) table based on content of field. for niketn. 06-05-2020 12:50 AM
- Got Karma for Re: Using color in reports (saved search) table based on content of field.. 06-05-2020 12:50 AM
- Got Karma for Re: How to count unique events pr class. 06-05-2020 12:50 AM
- Got Karma for Re: How to count unique events pr class. 06-05-2020 12:50 AM
- Got Karma for Re: Where did Splunk 7.3.1 go?. 06-05-2020 12:50 AM
- Karma Re: Can you differentiate between various Splunk servers using different colors? for renjith_nair. 06-05-2020 12:49 AM
- Karma Re: Background color in navbar is gone in 7.1 and 7.2 for AzJimbo. 06-05-2020 12:49 AM
- Karma Re: Background color in navbar is gone in 7.1 and 7.2 for spayneort. 06-05-2020 12:49 AM
- Got Karma for Re: Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
- Got Karma for Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
- Got Karma for Background color in navbar is gone in 7.1 and 7.2. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 |
10-19-2016
12:21 PM
Try this without any rex .
.... | search "ALTER" | head 1
to see how one line looks like.
... View more
10-19-2016
12:00 PM
Is your data multi lined?
... View more
10-19-2016
11:12 AM
If you like to get the first word of a string inn to a variable, this should do:
ALTER DATABASE [DBA] MODIFY FILE ( NAME = N'DBA', FILEGROWTH = 1048576KB )
your search | rex "^(?<AlertType>\S+)"
Gives
AlertType=ALTER
The ^ in the regex tells to get text from the line until the first space.
... View more
10-18-2016
10:57 PM
Problem is that in Free License mode, you can not click on the user.
There are no button to the left of Messages .
... View more
10-18-2016
11:03 AM
Make your search work giving you the map.
Then save it as an Dashboard.
Open Dashboard
Edit Source
Paste the <option name="mapp.... to the option section.
Save.
... View more
10-18-2016
08:59 AM
1 Karma
Not sure what you are looking for, but if you in the dashboard add this:
<option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
You get a much more detailed map.
You search could be some like this:
your search | iplocation src_ip | eval City = if(isnull(City) OR City="" ,"Unknown",City), home=vpn_user."-".src_ip | geostats globallimit=0 count by home
... View more
10-18-2016
06:08 AM
Try this:
query - index="myindex"| stats values(Category) | replace "Change Request" WITH "CR" IN Category
All in one go:
query - index="myindex"
| stats values(Category)
| replace "Change Request" WITH "CR"
, "Central Functions" WITH "CF"
, "Materials Management (MM)" WITH "MM" IN Category
... View more
10-18-2016
01:13 AM
Thanks, I did give you +1 for this, since it work as well.
Only pitfall that I needed to add 0 to the transpose or I lost rows. (default 5 rows)
transpose 0 header_field=client column_name=value
... View more
10-17-2016
12:18 PM
Thanks
I will accept this, since this gave me the idea for my solution.
my search
| eventstats count by client
| where count<3
| table client value count
| chart count over value by client limit=0
| addtotals fieldname=Total
| table channel Total *
| sort - Total | head 10
| fields - Total
The last part from addtotals , is just to get the value with most hit.
... View more
10-17-2016
08:06 AM
This does not work, since for the search I like to see a graph like this:
yellow XX
black X
blue x
Yellow 2 hits
Black 1 hits
Blue 1 hits
No green, since column house is removed
... View more
10-17-2016
05:36 AM
This was close. But after testing it out, I did see that I have mixed up row and column in my example. This has now been edited. So I like to get the sum of column, and then remove it if its larger than x not sum the row. Sorry for my mistake.
... View more
10-17-2016
05:19 AM
This does not work. It only remove all yellow after the first found, so there will be one yellow in the table. I would like to remove yellow 100% if it occurs more than one time, or more than x time.
PS I already have:
my search .. | dedup value client | chart count by client, value
This then only show 0 hits or 1 hits in the table.
... View more
10-17-2016
05:07 AM
I have data in this format:
client=green value=house
client=yellow value=appartement
client=black value=bungalow
client=blue value=flat
client=yellow value=house
Using a search like this my search ... | chart count by client, value I get Statistics result like this:
appartement bungalow flat house
black 0 1 0 0
blue 0 0 1 0
green 0 0 0 1
yellow 1 0 0 1
If I would like to remove the column value with more that one hit in the table, how to do it.
In this example house should be removed, since it is listed in both green and yellow .
Or even better setting a number as a limit. If more than x hit, remove it from the table.
... View more
10-16-2016
12:54 PM
No need to include all the text in front and " does not need to be escaped in the [] , so this should do \"(?<loginid>[^"]+)\"$
... View more
10-16-2016
04:22 AM
Try to change from startswith="login_status=logoff" endswith="login_status=login" to startswith="logoff" endswith="login" . I was not able to use field parameters, but data from raw line seems to work.
... View more
10-13-2016
11:19 PM
You do not need it inner parentheses, and you do not need to escape the ; , so this should do:
your base search | rex "(Android|iPhone OS) (?<os>[^\s;]+)"
... View more
10-12-2016
10:11 AM
You are trying to add it to a dashboard. Instead of "<" and ">" user "<" and ">"
... View more
10-11-2016
12:00 PM
I work fine, I just like it more clean. This is work around and I can not see in my search that its a Timechart search.
... View more
10-10-2016
12:23 PM
That looks better than mine. But you have a small error. token="span" and $Span$
... View more
10-10-2016
11:37 AM
I would like to use a drop-down menu to select span.
1 min
5 min
10 min
20 min
1 hour
2 hour
default
Problem is not to handle the drop-down, but to get the default to work.
span= needs a value.
This is is how I get it to work. But can it be simplified?
<input type="dropdown" token="Span" searchWhenChanged="true">
<label>Time span</label>
<default>timechart</default>
<choice value="timechart">Default</choice>
<choice value="timechart span=1m">1 min</choice>
<choice value="timechart span=5m">5 min</choice>
<choice value="timechart span=10m">10 min</choice>
<choice value="timechart span=20m">20 min</choice>
<choice value="timechart span=1h">1 hour</choice>
<choice value="timechart span=2h">2 hour</choice>
</input>
And then my search:
my search .. | $Span$ count by server limit=0
I would like some like this:
my search .. | timeshart span=$Span$ count by server limit=0
or
my search .. | timeshart $Span$ count by server limit=0
But I am not able to get the default to work.
... View more
10-02-2016
07:28 AM
This I know, but I am surprised that a function like this has not been added to the GUI. It has been like this for a very long time. Lets hope 6.6 will resolve it.
... View more
10-02-2016
12:50 AM
Hi, I updated my post, by modifying your example. The Host input should not show host outside periode of the Global.Time. Example works correctly, but you need to use Source Edit to create it.
... View more
10-01-2016
05:43 AM
I do use a lot of Input to narrow down my graphs in my dashboard.
Since I do not like the drop down list in the input to be flooded, I like to use the same global time picker in Input as well in Panel.
If I add a Panel, I can go to Edit Search->Time Range Scope and select Shared Time Picker(some name)
But if I do the same for an Input, I only have the button for selecting a time range. No option for selecting the Shared Time Picker
Workaround is to do it manually by using earliest, latest option.
<input type="dropdown" token="Host" searchWhenChanged="true">
<search>
<query>sourcetype=master |
top host</query>
<earliest>$global_time.earliest$</earliest>
<latest>$global_time.latest$</latest>
</search>
<choice value="*">Any</choice>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<default>*</default>
</input>
This is equal to the setup done for the Panel
So my request is that this is fixed in next version.
I did hope this was fixed in 6.5, but it was not.
UPDATE:
This example should explain the problem.
Look at line 15 and 16. There you see the Global_Time used in the input.
It can be done using source edit, but not from the gui edit.
<form>
<label>dctest3</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="Global_Time">
<label>`Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="Host" searchWhenChanged="true">
<search>
<query>index=main |
top host</query>
<earliest>$Global_Time.earliest$</earliest>
<latest>$Global_Time.latest$</latest>
</search>
<choice value="*">Any</choice>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=main host=$Host$ |stats count by host</query>
<earliest>$Global_Time.earliest$</earliest>
<latest>$Global_Time.latest$</latest>
</search>
<option name="drilldown">row</option>
</table>
</panel>
</row>
</form>
This picture is from the Panel and show the correct Time Range Scope
You can see the Global Time selected.
.
Now, take a look at time range section for the Input
You can only select the built in value and not the Global Time from the Time Input
... View more
10-01-2016
05:27 AM
Ahh, Not only me.
I did posted this some days ago.
https://answers.splunk.com/answers/455118/syntax-highlighting-and-autocomplete-in-your-accou.html
Also did an upgrade.
... View more
09-29-2016
03:23 AM
This should do:
... | rex field=source ".*\/(?<new>\S+)"
https://regex101.com/r/QEsDmB/1
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-01-2021
12:34 PM
|
Karma given to
