Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ashanka
ashanka
Explorer
Member since:
06-10-2019
06-05-2020
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 06-10-2019 |
Activity Feed
- Got Karma for Re: HOw to setup alerts for 2 differnt condition in single saves search?. 06-05-2020 12:50 AM
- Got Karma for Re: HOw to setup alerts for 2 differnt condition in single saves search?. 06-05-2020 12:50 AM
- Posted Re: How to convert time format? on Splunk Search. 05-26-2020 12:22 PM
- Posted Re: How to convert time format? on Splunk Search. 05-26-2020 11:44 AM
- Posted How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Posted Re: Filter/search Rows based on Current date on Getting Data In. 05-01-2020 12:25 PM
- Posted Re: Filter/search Rows based on Current date on Getting Data In. 05-01-2020 12:25 PM
- Posted Re: Filter/search Rows based on Current date on Getting Data In. 05-01-2020 12:07 PM
- Posted Re: Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:56 AM
- Posted Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:27 AM
- Tagged Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:27 AM
- Tagged Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:27 AM
- Tagged Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:27 AM
- Posted How to merge text in Splunk table? on Splunk Dev. 03-17-2020 04:55 PM
- Tagged How to merge text in Splunk table? on Splunk Dev. 03-17-2020 04:55 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-26-2020
12:22 PM
| eval startTime=strptime(startTime,"%Y-%m-%d %H:%M")
| eval endTime=strptime(endTime,"%Y-%m-%d %H:%M")
| eval MTTR=tostring((endTime-startTime),"duration")
This is how i got the duration
... View more
05-26-2020
11:29 AM
I have a column duration with this time format: 01:20:00.000000 .
How do I convert time format from 01:20:00.000000 to "1 Hr 20 Mins"?
... View more
05-01-2020
12:07 PM
Now i have re-Written the query to have 2 columns like below.
Have to filter rows when these two matches .. can i use where or search?
Plan_Start_date , today_date
May 03 May 01
May 01 May 01
... View more
05-01-2020
11:56 AM
Thanks for the resposne. But its not fetching any results now.
When i add only the eval command.. not seeing any difference in result.
... View more
05-01-2020
11:27 AM
I have 3 rows like below. I need to filter rows that equals current date. Current date being may 1.
Plan Start Time
May 01, 08:00 PM
May 03 10:00 PM
Apr 30 07:00 AM
... View more
03-17-2020
04:55 PM
Have a table like this , how
Type Country
Reporting US
reporting CAN
Reporting IND
COnsolidated US
Consolidate CAN
Consolidated IND
How do i display as
Type Country
Reporting US
CAN
IND
Consolidated US
CAN
IND
... View more
- Tags:
- splunk-enterprise
03-05-2020
12:29 PM
2/11/2020 11:49:00 AM 2/11/2020 9:55:00 PM
How to convert this into Secs.. Conersion of AM and PM is not working as expected
2/11/2020 9:55:00 PM
| eval "Bridge End Date In Sec"=tonumber(strftime(strptime('Bridge End Date',"%m/%d/%Y %H:%M:%S %p"),"%s"))
1581440100
2/11/2020 11:49:00 AM
| eval "Bridge Start Date In Sec"=tonumber(strftime(strptime('Bridge Start Date',"%m/%d/%Y %H:%M:%S %p"),"%s"))
1581446940
%p is not wrking?
1581440100 1581446940 Values retued as this which is not correct. End is lesser thatn the start date
... View more
03-05-2020
12:26 PM
2/11/2020 11:49:00 AM 2/11/2020 9:55:00 PM
How to convert this into Secs.. Conersion of AM and PM is not working as expected
| eval "Bridge End Date In Sec"=tonumber(strftime(strptime('Bridge End Date',"%m/%d/%Y %H:%M:%S %p"),"%s"))
| eval "Bridge Start Date In Sec"=tonumber(strftime(strptime('Bridge Start Date',"%m/%d/%Y %H:%M:%S %p"),"%s"))
... View more
01-23-2020
10:16 AM
but that does not valdiate the total count..only of the count is above 200 i need head -5
... View more
01-22-2020
02:36 PM
index= aab sourcetype=topconnections earliest=-10m latest=-5m
| table SESSION_AUTH_ID , CONNECTION_COUNT
| addcoltotals labelfield=SESSION_AUTH_ID label=TotalCount
SESSION_AUTH_ID CONNECTION_COUNT
a 178
b 65
v 36
d 21
e 12
f 12
g 10
h 8
h 5
f 4
f 4
l 3
o 2
z 2
TotalCount 201
how do i get the top 5 rows from table when the total count is greater than 200.
when the total count reached 200 i need to get the top 5 SESSION_AUTH_ID and its CONNECTION_COUNT
... View more
- Tags:
- splunk-enterprise
09-20-2019
11:36 AM
I have a extracted a field, which has mutiple values
applname = app1, app2 , app3
when i form a table with applname column it lists all the app names. But i need only app2 and app3, Not app1
How do i remove only app1 from table
... View more
yes it worked:) thanks
... View more
Thanks shankar, it worked
... View more
06-10-2019
08:47 PM
trying to setup an alert for certificate expiry. First alert will say, certificate will expire on 90 days. How to setup next alert when the expiry days = 60 days within the same alert?
ns=application_logs "Cert DN = CN=E3.certificate"
| table Number, DN,Date
| dedup Number, DN,Date
|eval dateDue=strptime('Date',"%a %b %d %H:%M:%S %Z %Y")
| eval days = round((dateDue-now())/86400)
| table Number, DN,Date,dateDue,days
| search days = 90
Here i have setup an alert when condition satisfies expiry days = 90. I need to setup a another alert when expiry days = 60.
First alert will be on when days = 90, next should be on days = 60
... View more
- Tags:
- splunk-enterprise
06-10-2019
03:48 PM
do we have an option of creating an alert for days <= 90 and days <= 60 in a single serach in splunk. or it has to be a separate alert?
... View more
06-10-2019
02:33 PM
That worked, How can i do dateDue - today date.
I will have to send alert if dateDue is less than 90 days
... View more
06-10-2019
01:22 PM
Hi
I have date format in logs as below.
Expiry date : Sun Apr 11 05:00:00 MST 2021
I need to create an alert if the expiry date less than 90 days from today.
This is what I tried with no luck. Can anyone help?
ns=application_logs "Cert DN = CN=E3.certificate"
| table Number, Cert DN, Expiry Date
| dedup Number, Cert DN, Expiry Date
| eval dateDue=strptime('Days_to_Expire', "%Y-%m-%d %H:%M:%S.%6N")
| eval days = round((now()-dateDue)/86400)
| table Number, DN,Date,Days_to_Expire
... View more
