Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About spisiakmi
spisiakmi
Communicator
Member since:
06-26-2019
04-25-2024
Community Statistics
| Posts | 87 |
| Solutions | 10 |
| Karma Given | 2 |
| Karma Received | 5 |
| Member Since | 06-26-2019 |
Activity Feed
- Posted Re: run specific query depens on token value on Splunk Enterprise. 04-25-2024 01:08 AM
- Posted run specific query depens on token value on Splunk Enterprise. 04-24-2024 11:26 PM
- Posted Re: how to read from lookup table on Splunk Enterprise. 12-13-2023 07:04 AM
- Posted how to read from lookup table on Splunk Enterprise. 12-13-2023 05:31 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-06-2023 04:13 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-06-2023 01:24 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-06-2023 12:53 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 11:25 PM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 09:56 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 09:53 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 09:42 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 09:20 AM
- Posted Re: column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 07:13 AM
- Posted column chart of the range between 2 times on Splunk Enterprise. 12-05-2023 02:26 AM
- Posted Re: Invalid key in stanza [webhook] alert_actions.conf splunk forwarder on Splunk Enterprise. 07-21-2023 03:18 AM
- Posted Invalid key in stanza [webhook] alert_actions.conf splunk forwarder on Splunk Enterprise. 07-17-2023 11:17 PM
- Got Karma for How to unset token if I choose other values from dropdown. 04-19-2023 06:32 AM
- Posted Re: query from mulivalue attibute on Splunk Search. 03-29-2023 09:05 AM
- Posted How to create query for multi value attribute? on Splunk Search. 03-29-2023 06:47 AM
- Got Karma for Re: How can I write in summary index from dashboard input on change?. 03-23-2023 09:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-25-2024
01:08 AM
Hi ITWhisperer, exactly this very simple elegant solution I needed. Thank you very much. Works fine.
... View more
04-24-2024
11:26 PM
Hi, on a dashboard I have a simple check box element: LastOne_tkn (token name). If the check box is enabled, the LastOne_tkn=TRUE. There is simple small table view, which shows some results. I would like to run query in that table view based on LastOne_tkn condition. LastOne_tkn=TRUE (dedup activated) index=machinedata | dedup Attr1 | table Attr1, Attr2 LastOne_tkn=otherwise (dedup deactivated) index=machinedata | table Attr1, Attr2 Any idea, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
12-13-2023
07:04 AM
Hi dtburrows3, thank you very much. It works. I like that solution with the temporary field.
... View more
12-13-2023
05:31 AM
Hi, can anybody help with this task? inputs: "nice_date",sFaultInverter1,sFaultInverter2,sFaultInverter3,sFaultPFC,"sFaultSR-Plaus",sFaultSR,sFaultSpeed "05.12.2023 10:46:53",0,0,1,0,"-1",0,0 "05.12.2023 10:43:27","-1","-1","-1","-1","-1","-1","-1" "05.12.2023 10:41:17",0,320,0,0,"-1",0,0 "05.12.2023 10:30:32",0,0,1,0,"-1",0,0 "05.12.2023 10:28:51",0,0,1,0,"-1",0,0 "05.12.2023 10:28:10","-1","-1","-1","-1","-1","-1","-1" Lookup Attribut,Value,ErrorCode sFaultInverter1,-1,NoCommunication sFaultInverter1,0,noError sFaultInverter1,1,CompressorCurrentSensorFault sFaultInverter1,2,FactorySettings sFaultInverter1,4, sFaultInverter1,8, sFaultInverter1,16,InverterBridgeTemperatureSensorFault sFaultInverter1,32,DLTSensorFault sFaultInverter1,64,ICLFailure sFaultInverter1,128,EEPROMFault sFaultInverter1,256,UpdateProcess sFaultInverter1,512, sFaultInverter1,1024, sFaultInverter1,2048, sFaultInverter1,4096, sFaultInverter1,8129, sFaultInverter1,16384, sFaultInverter1,32768, sFaultInverter2,-1,NoCommunication sFaultInverter2,0,noError sFaultInverter2,1,CommunicationLos sFaultInverter2,2,DcLinkRipple sFaultInverter2,4, sFaultInverter2,8,AcGridOverVtg sFaultInverter2,16,AcGridUnderVtg sFaultInverter2,32,DcLinkOverVtgSW sFaultInverter2,64,DcLinkUnderVtg sFaultInverter2,128,SpeedFault sFaultInverter2,256,AcGridPhaseLostFault sFaultInverter2,512,InverterBridgeOverTemperature sFaultInverter2,1024, sFaultInverter2,2048, I would like to have table with e.G. 3 columns: "nice_date",sFaultInverter1,ErrorCode "05.12.2023 10:46:53",0,noError "05.12.2023 10:43:27","-1",NoCommunication "05.12.2023 10:41:17",0,noError "05.12.2023 10:30:32",0,noError "05.12.2023 10:28:51",0,noError "05.12.2023 10:28:10","-1",NoCommunication for each value of sFaultInverter1 an ErrorCode from the lookUp table. Any help?
... View more
Labels
- Labels:
-
using Splunk Enterprise
12-06-2023
04:13 AM
And here is the solution
| eval row=mvrange(0,6)
| mvexpand row
| addinfo
| eval _time=case(row=0,info_min_time,row=1,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=2,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=3,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=4,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=5,info_max_time)
| eval value=case(row=0,0,row=1,0,row=2,1,row=3,1,row=4,0,row=5,0)
| table _time, value
... View more
12-06-2023
01:24 AM
This is, what I want to achieve. 3.jpg. Time range from the time range picker. In this case the day 05.12.2023.
... View more
12-06-2023
12:53 AM
1. there is a time range picker object on the dashboard. If I select any range, e.G. the whole day 05.12.2023, this time range I would like to have on x-axis in area chart. 2. in this case,
| eval _time=case(row=0,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=1,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=2,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=3,strptime(EndTime,"%Y-%m-%d %H:%M:%S"))
| eval value=case(row=0,0,row=1,1,row=2,1,row=3,0)
the time range of the x-axis in area chart is from the first StartTime (05:30) ... last EndTime (13:30).
... View more
12-05-2023
11:25 PM
I have 1 question. The solution shows the time range in restricted _time. It is possible to expand it into/show in selected time range, which is defined in the time range picker? To the range addinfo.info_max_time, addinfo.info_min_time?
... View more
12-05-2023
09:56 AM
Attached result 2.jpg
... View more
12-05-2023
09:53 AM
Hi ITWhisperer, I fixed it. Thank you very very much for your help, with this, it is working properly (look attached 2.jpg): | sort StartTime | eval row=mvrange(0,4) | mvexpand row | eval _time=case(row=0,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=1,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=2,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=3,strptime(EndTime,"%Y-%m-%d %H:%M:%S")) | eval value=case(row=0,1,row=1,1,row=2,1,row=2,0) ´here is the difference | table _time value
... View more
12-05-2023
09:42 AM
But, if I use this code on the content, which I mentioned in the main describtion, I receive these results (see attch 1.jpg). And this is quiet good for me, except the triangel step. Any idea, how to fix it? | eval row=mvrange(0,4) | mvexpand row | eval _time=case(row=0,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=1,strptime(StartTime,"%Y-%m-%d %H:%M:%S"),row=2,strptime(EndTime,"%Y-%m-%d %H:%M:%S"),row=3,strptime(EndTime,"%Y-%m-%d %H:%M:%S")) | eval value=case(row=0,1,row=1,1,row=2,1,row=3,0) | table _time value
... View more
12-05-2023
09:20 AM
From your code I recived this: "_time",value ,0 ,1 ,1 ,0
... View more
12-05-2023
07:13 AM
Hi ITWhisperer, thx for sharing it. Unfortunately, if I run your code I receive no results.
... View more
12-05-2023
02:26 AM
Hi, I have StartTime,EndTime "2023-12-05 05:30:00.0000000","2023-12-05 08:00:00.0000000" "2023-12-05 08:00:00.0000000","2023-12-05 09:30:00.0000000" "2023-12-05 10:28:00.0000000","2023-12-05 13:30:00.0000000" I need to visualize a column chart, with 3 columns (in this case) with height 1 (y axis). The width of the first column is between "2023-12-05 05:30:00.0000000","2023-12-05 08:00:00.0000000", second one between "2023-12-05 08:00:00.0000000","2023-12-05 09:30:00.0000000", the third between "2023-12-05 10:28:00.0000000","2023-12-05 13:30:00.0000000". The x axis should be the time. Attached example. Any idea, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
07-21-2023
03:18 AM
The problem has been fixed by splunk admins. Unfortunately I don't know how. Problem appeared when they deleted old indexers from the cluster and the still have been configured on the FW side.
... View more
07-17-2023
11:17 PM
Hi, can anybody help, please? I'm using Splunk Universal Forwarder 9.0.4 (build de405f4a7979) and from 15.07.2023 I have no indexed data in Splunk. .After restart there is only 1 error: Invalid key in stanza [webhook] in C:\Program Files\SplunkUniversalForwarder\etc\system\default\alert_actions.conf, line 229: enable_allowlist (value: false). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' I tried this step: 1. removed [webhook] enable_allowlist = false or 2. changed it into true nothing helped. Any advice, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
03-29-2023
09:05 AM
Hi somesoni2, this is amazing simple. Absolutely perfect. Thank you very much. Works fine.
... View more
03-29-2023
06:47 AM
Hi, can I ask you for helping me with this small problem, please?
If I read the content of the lookUp using any criteria I receive attribute Attr1. This Attr1 is multivalue attribute.
Attr1
7470486
7470487
7470597
7470543
I want to create query, where will be index=test ID=7470486 OR 7470487 OR 7470597 OR 7470543
... View more
03-23-2023
09:19 AM
1 Karma
Hi richgalloway, thank you for response, I solved this problem. In fact you were absolutely right. I sent the value through a token to search of any element, can be also hidden, and this search ends like | collect index=machinedata_w48_sum testmode=false
... View more
03-23-2023
03:55 AM
Hi, can anybody help, please?
Problem:
In dashboard I have label. If I write something in the label <number> and press Enter, I would like to make an action: write something in summary index.
Label: serial_num Index: index_sum Fields to be saved in summary index: $Label$, <actual_time>, identifier
... View more
Labels
- Labels:
-
using Splunk Enterprise
12-06-2022
03:09 AM
Hi @gcusello I wanna thank you very much. Your solution with calculated field was brilliant. Very simple and effective. Thank you.
... View more
12-02-2022
08:10 AM
Hi @gcusello I try calculated field definitely. If you have a time to help me with it, it would be perfect. In this exact example. m
... View more
12-02-2022
07:22 AM
Hi, I want to index simple xml file.
<?xml version="1.0" encoding="utf-8"?> <unitData xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xsi:noNamespaceSchemaLocation="unitData-1.0.xsd" unit="0000006000" equipment="W052A-22G0014" operator="admin" starttime="2022-11-22T06:10:53+01:00" endtime="2022-11-22T06:15:07+01:00" state="ok"> </unitData>
Before indexing I would like to create new additional attribute machine which should have value depended of these conditions:
case equipment="W052A-22G0014" machine =machine1
case equipment="W052A-22G0013" machine =machine2
Can anybody help, please?
... View more
Labels
- Labels:
-
props.conf
-
transforms.conf
-
XML
09-22-2022
08:35 AM
Hi Giuseppe, I stopped splunk fw and defined DATETIME_CONFIG = CURRENT in props.conf. After that I started the service again and I will run it till tomorrow. I will observe if all events become the proper _time. I think, it could help. I cannot combine these 2 time/date variables, because it isn't the real time of the event. I will let you know. Thank you and enjoy the day.
... View more
09-22-2022
08:16 AM
Hi Giuseppe, thank you very much for a help. I have 2 important attributes in the event. Time and Date. How it is possible to define indextime from these 2 attributes?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-25-2024
11:05 AM
|
Karma from
