Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ashanka
ashanka
Explorer
Member since:
06-10-2019
06-05-2020
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 06-10-2019 |
Activity Feed
- Got Karma for Re: HOw to setup alerts for 2 differnt condition in single saves search?. 06-05-2020 12:50 AM
- Got Karma for Re: HOw to setup alerts for 2 differnt condition in single saves search?. 06-05-2020 12:50 AM
- Posted Re: How to convert time format? on Splunk Search. 05-26-2020 12:22 PM
- Posted Re: How to convert time format? on Splunk Search. 05-26-2020 11:44 AM
- Posted How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Tagged How to convert time format? on Splunk Search. 05-26-2020 11:29 AM
- Posted Re: Filter/search Rows based on Current date on Getting Data In. 05-01-2020 12:25 PM
- Posted Re: Filter/search Rows based on Current date on Getting Data In. 05-01-2020 12:25 PM
- Posted Re: Filter/search Rows based on Current date on Getting Data In. 05-01-2020 12:07 PM
- Posted Re: Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:56 AM
- Posted Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:27 AM
- Tagged Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:27 AM
- Tagged Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:27 AM
- Tagged Filter/search Rows based on Current date on Getting Data In. 05-01-2020 11:27 AM
- Posted How to merge text in Splunk table? on Splunk Dev. 03-17-2020 04:55 PM
- Tagged How to merge text in Splunk table? on Splunk Dev. 03-17-2020 04:55 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-26-2020
12:22 PM
| eval startTime=strptime(startTime,"%Y-%m-%d %H:%M")
| eval endTime=strptime(endTime,"%Y-%m-%d %H:%M")
| eval MTTR=tostring((endTime-startTime),"duration")
This is how i got the duration
... View more
05-26-2020
11:29 AM
I have a column duration with this time format: 01:20:00.000000 .
How do I convert time format from 01:20:00.000000 to "1 Hr 20 Mins"?
... View more
05-01-2020
12:07 PM
Now i have re-Written the query to have 2 columns like below.
Have to filter rows when these two matches .. can i use where or search?
Plan_Start_date , today_date
May 03 May 01
May 01 May 01
... View more
05-01-2020
11:56 AM
Thanks for the resposne. But its not fetching any results now.
When i add only the eval command.. not seeing any difference in result.
... View more
05-01-2020
11:27 AM
I have 3 rows like below. I need to filter rows that equals current date. Current date being may 1.
Plan Start Time
May 01, 08:00 PM
May 03 10:00 PM
Apr 30 07:00 AM
... View more
03-17-2020
04:55 PM
Have a table like this , how
Type Country
Reporting US
reporting CAN
Reporting IND
COnsolidated US
Consolidate CAN
Consolidated IND
How do i display as
Type Country
Reporting US
CAN
IND
Consolidated US
CAN
IND
... View more
- Tags:
- splunk-enterprise
03-05-2020
12:29 PM
2/11/2020 11:49:00 AM 2/11/2020 9:55:00 PM
How to convert this into Secs.. Conersion of AM and PM is not working as expected
2/11/2020 9:55:00 PM
| eval "Bridge End Date In Sec"=tonumber(strftime(strptime('Bridge End Date',"%m/%d/%Y %H:%M:%S %p"),"%s"))
1581440100
2/11/2020 11:49:00 AM
| eval "Bridge Start Date In Sec"=tonumber(strftime(strptime('Bridge Start Date',"%m/%d/%Y %H:%M:%S %p"),"%s"))
1581446940
%p is not wrking?
1581440100 1581446940 Values retued as this which is not correct. End is lesser thatn the start date
... View more
03-05-2020
12:26 PM
2/11/2020 11:49:00 AM 2/11/2020 9:55:00 PM
How to convert this into Secs.. Conersion of AM and PM is not working as expected
| eval "Bridge End Date In Sec"=tonumber(strftime(strptime('Bridge End Date',"%m/%d/%Y %H:%M:%S %p"),"%s"))
| eval "Bridge Start Date In Sec"=tonumber(strftime(strptime('Bridge Start Date',"%m/%d/%Y %H:%M:%S %p"),"%s"))
... View more
01-23-2020
10:16 AM
but that does not valdiate the total count..only of the count is above 200 i need head -5
... View more
01-22-2020
02:36 PM
index= aab sourcetype=topconnections earliest=-10m latest=-5m
| table SESSION_AUTH_ID , CONNECTION_COUNT
| addcoltotals labelfield=SESSION_AUTH_ID label=TotalCount
SESSION_AUTH_ID CONNECTION_COUNT
a 178
b 65
v 36
d 21
e 12
f 12
g 10
h 8
h 5
f 4
f 4
l 3
o 2
z 2
TotalCount 201
how do i get the top 5 rows from table when the total count is greater than 200.
when the total count reached 200 i need to get the top 5 SESSION_AUTH_ID and its CONNECTION_COUNT
... View more
- Tags:
- splunk-enterprise
09-20-2019
11:36 AM
I have a extracted a field, which has mutiple values
applname = app1, app2 , app3
when i form a table with applname column it lists all the app names. But i need only app2 and app3, Not app1
How do i remove only app1 from table
... View more
yes it worked:) thanks
... View more
