Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About spisiakmi
spisiakmi
Communicator
Member since:
06-26-2019
08-18-2020
Community Statistics
| Posts | 60 |
| Solutions | 6 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 06-26-2019 |
Activity Feed
- Posted Re: How to count the delta of the first and the last event on Splunk Enterprise. 07-02-2020 04:39 AM
- Posted Re: How to count the delta of the first and the last event on Splunk Enterprise. 07-02-2020 04:30 AM
- Posted Re: How to count the delta of the first and the last event on Splunk Enterprise. 07-02-2020 04:17 AM
- Posted How to count the delta of the first and the last event on Splunk Enterprise. 07-02-2020 02:11 AM
- Posted Error: External search command <file.bat> returned error code 1. on Splunk Enterprise. 06-30-2020 01:09 AM
- Got Karma for Re: How to use search from summary index as a condition in another search?. 06-05-2020 12:50 AM
- Got Karma for Re: How to create new field combined from existing fields. 06-05-2020 12:50 AM
- Posted Re: How to search in an index conditioned from the summary index. on Knowledge Management. 06-02-2020 06:12 AM
- Posted How to search in an index conditioned from the summary index. on Knowledge Management. 06-02-2020 04:37 AM
- Tagged How to search in an index conditioned from the summary index. on Knowledge Management. 06-02-2020 04:37 AM
- Posted How to define custom color of the Sankey diagram? on All Apps and Add-ons. 05-18-2020 11:56 PM
- Posted Re: How to unset token if I choose other values from dropdown on Dashboards & Visualizations. 04-29-2020 01:42 AM
- Posted Re: How to unset token if I choose other values from dropdown on Dashboards & Visualizations. 04-29-2020 12:49 AM
- Posted How to unset token if I choose other values from dropdown on Dashboards & Visualizations. 04-29-2020 12:32 AM
- Posted Re: Wrong indexed fields. on Getting Data In. 04-14-2020 07:23 AM
- Posted Wrong indexed fields. on Getting Data In. 04-03-2020 04:52 AM
- Tagged Wrong indexed fields. on Getting Data In. 04-03-2020 04:52 AM
- Posted Re: How to search in index with a condition from another index on Splunk Search. 11-18-2019 05:34 AM
- Posted How to search in index with a condition from another index on Splunk Search. 11-14-2019 01:03 AM
- Tagged How to search in index with a condition from another index on Splunk Search. 11-14-2019 01:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-02-2020
04:39 AM
@to4kawa ou yeah. very very elegant.
... View more
- Tags:
- range()
07-02-2020
04:30 AM
Hi @gcusello no, you need to do max-min. The counter always increase.
... View more
07-02-2020
04:17 AM
@enjith_nair you have absolutely right. It was so easy and I made it already so many times. Thank you very much.
... View more
07-02-2020
02:11 AM
Hi, can you help me to solve this problem, please? I have index=index1 In a specified time range, e.g. 3 hours, I have these events. Time is a regular time point, where the electric power has been measured. ID is the name of the electrical counter, which counts the electrical measurements. Value is the measured electrical power [kW]. Time ID Value 02.07.2020 06:00:00 counter1 1000 02.07.2020 06:00:00 counter2 2000 02.07.2020 06:00:00 counter3 3000 02.07.2020 07:00:00 counter1 2000 02.07.2020 07:00:00 counter2 3000 02.07.2020 07:00:00 counter3 4000 02.07.2020 08:00:00 counter1 3000 02.07.2020 08:00:00 counter2 4000 02.07.2020 08:00:00 counter3 5000 How can I count the consumption of each counter in this time range? I need this output ID consumption counter1 2000 counter2 2000 counter3 2000 Thank you
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-30-2020
01:09 AM
Hi. I create simple file.bat file, which I placed it into .etc/apps/appname/bin I created commands.conf in ./etc/apps/appname/local and its content is: [sps_export_vitocharge] filename = sps_export_vitocharge.bat chunked = true I restarted teh Splunk instance I try to run this search: my_search | outputcsv sps_export_vitocharge | script sps_export_vitocharge and I receive error message: Error: External search command <file.bat> returned error code 1. The file.bat is only simple move of this generated csv file. It works from the shell window. Can anybody help me, please?
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-02-2020
06:12 AM
Hi 493669. Your answer/help is amazing. It works absolutely great. Thank you very much.
... View more
06-02-2020
04:37 AM
Hi. I have summary index_sum, which has 2 events, 2 attributes:
A1_sum, A2_sum
1590482539, 7722527
1591080961, 7722525
I have also index2, where a lot of time events are stored. The index time _time is important. I want to search the max(A1_sum) from index_sum and use this value to filter values from the index2.
something like this:
index2
| where _time>max(A1_sum)
can you help me, please, with this problem?
... View more
Labels
- Labels:
-
summary indexing
05-18-2020
11:56 PM
Hi, it is possible to change the default color of the sankey diagram? E.g. in xml. I have very simple sankey diagram with 1 start point and 10 end points. I want to change the color of the start point. Can you help me, please?
... View more
04-29-2020
01:42 AM
Hi vnravikumar,
unbelievable. Really many thanks for such perfect solution. And it is so simple.
... View more
04-29-2020
12:49 AM
Hi vnravikumar,
this is the set of all values of the dropdown:
1;2;3;4;5;6;7;8;9;10.
The default value of the dropdown ist 3.
Many objects of the dashboard should be visible, if the value 3 has been choosen. Otherwise should be hidden.
So if I choose 1OR 2 OR 4 OR 5 OR 6 OR 7 OR 8 OR 9 OR 10 from the dropdown, the objects should be invisible.
... View more
04-29-2020
12:32 AM
Hi,
I have dropdown, where are 30 values. This count can be dynamically changed depends on the search. I want to show some panels, rows, objects in the dashboard ony by choosing 1 value from the dropdown. Otherwise I want to hide these objects. I can do it. I know, if I write hard in xml set and unset condition for all of the values from the dropdown. But, ist there any possibility to do it dynamicaly? E.G. with some OTHERWISE condition for unset the token?
I also tried this method. Everytime at change in the dropdown, unset at first the token.
<change>
<condition>
<unset token="show_token"></unset>
</condition>
<condition label="show">
<set token="show_token">true</set>
</condition>
</change>
but it didn't work. By default should be the token show_token set to true. Can you help me, please?
... View more
04-14-2020
07:23 AM
Hi richgalloway. Thank you for your reaction. Unfortunately it didn't work. Nothing changed.
... View more
04-03-2020
04:52 AM
Hi,
I want to index this csv file:
run_time;field1;field2;field3;field4;field5;field6;field7;field8;
80s;"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;
inputs.conf is
[monitor://\\srv\Log Sicherung\]
disabled = false
index = machinedata_w48
sourcetype = systest
crcSalt=<SOURCE>
ignoreOlderThan = 24h
and props.conf is
[systest]
BREAK_ONLY_BEFORE_DATE =
CHARSET = WINDOWS-1252
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1
In splunk will be indexed only
run_time;field1
and the field1 with the value:
"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;
Can you help me, please, how to solve this problem? I want to have indexed all fields* with proper values (separated with ;).
... View more
11-18-2019
05:34 AM
Hi Sukisen1981,
many thanks for your answer. Can you explain me, please, this note? It is not clear for me.
NOTE - When i took the sample from your index 1 _time became time, so please check the field name for _time in your actual splunk instance.
... View more
11-14-2019
01:03 AM
Hi, I have 2 different indexes.
Index1:
_time Fehlermeldungtext
2019-07-01 22:01:30 Streckenüberwachung Auslauf!
2019-09-09 04:28:56 Streckenüberwachung Auslauf!
2019-08-26 05:40:59 Streckenüberwachung Auslauf!
2019-08-25 11:18:30 Streckenüberwachung Auslauf!
2019-08-25 11:16:52 Streckenüberwachung Auslauf!
2019-08-25 11:12:30 Streckenüberwachung Auslauf!
2019-08-24 18:37:55 Streckenüberwachung Auslauf!
2019-08-24 18:37:15 Streckenüberwachung Auslauf!
2019-08-24 18:36:36 Streckenüberwachung Auslauf!
2019-08-24 18:35:57 Streckenüberwachung Auslauf!
2019-08-24 17:03:51 Streckenüberwachung Auslauf!
Index2:
Datum_Einlauf Datum_Auslauf
2019-07-01 21:59:37 2019-07-01 22:03:09
2019-07-01 21:58:25 2019-07-01 22:02:02
2019-07-01 21:56:22 2019-07-01 21:59:55
2019-07-01 21:54:37 2019-07-01 21:58:14
2019-07-01 21:54:04 2019-07-01 21:57:42
2019-07-01 21:52:36 2019-07-01 21:56:12
2019-07-01 21:52:15 2019-07-01 21:55:50
2019-07-01 21:50:14 2019-07-01 21:53:45
2019-07-01 21:49:53 2019-07-01 21:53:27
2019-07-01 21:45:19 2019-07-01 21:48:52
2019-07-01 21:44:35 2019-07-01 21:48:12
2019-07-01 21:44:01 2019-07-01 21:47:31
2019-07-01 21:41:45 2019-07-01 21:45:22
2019-07-01 21:41:11 2019-07-01 21:44:49
I want to find such events in Index2, where Datum_Einlauf<_time (from the Index1) AND Datum_Auslauf>_time (from the Index1).
For example: for the 1. row from Index1 2019-07-01 22:01:30 Streckenüberwachung Auslauf!
should appear 2 events from Index2:
2019-07-01 21:59:37 2019-07-01 22:03:09
2019-07-01 21:58:25 2019-07-01 22:02:02
Can anybody help me, please?
... View more
10-14-2019
06:33 AM
Finally I used the Powershell script, which picks only (indexed from 0) rows 1, 6:
Get-ChildItem *\*.protocol | ForEach { Get-Content $_.Fullname | Select-Object -Index 1,6 | Out-File "$($_.Directory)\$($_.BaseName).csv" -Encoding utf8}
... View more
10-11-2019
05:50 AM
Hi ololdach,
I used the spath and it worked. I had only problem with mvexpand, because of the error message: command.mvexpand: output will be truncated at 300 results due to excessive memory usage. Memory threshold of 500MB as configured in limits.conf / [mvexpand] / max_mem_usage_mb has been reached.
I solved it, with the command: |fields - _*
But thank you anyway.
... View more
10-06-2019
11:47 PM
Hi ololdach,
Thank you for your message.
I used the spath, but I lost the data relation. E.g. In CSV file there is a relation data model guarantied by the first row (header). How would I select here all test name where testResultCode is failed? Using spath of course. And than using the spath the subTest names, which are failed, depending on testname?
... View more
10-05-2019
05:41 AM
Hi Giuseppe,
thank you, but your regex generates more steps, than mine. Mine has 8099, but your 8871. Sorry.
... View more
10-05-2019
04:03 AM
Hi I have a problem with the error message of the Splunk: Error in 'rex' command: regex="(?ms)]+^\s\" has exceeded configured match_limit, consider raising the value in limits.conf
The problem is, that the regex regex="(?ms)\<test[^\>]+[^\s](?P<tmp>.*?)\</test\>" for + xml file generates 8099 steps.
I tested it on this xml file:
<?xml version="1.0" encoding="UTF-8" ?>
<unitData endtime="2019-09-30T05:39:08+02:00" equipment="eq1" equipmentClass="eqc1" locale="german" operator="ADMINISTRATOR" senderID="sender1" starttime="2019-09-30T05:38:09+02:00" state="nok" unit="74375513159930675" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="unitData-1.1.xsd">
<subUnitData position="1" positionType="Panel Nr." state="ok" subUnit="74375513159930675">
<test description="A10-007 7437551" name="CU102_BAY2_QR" testResultCode="passed">
<subTest name="Verbindung zum Pr³fling aufbauen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Initialisierung" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Fehlerflag lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ID lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Sachnummer lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Trigger setzen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ADC Abschalten" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
</test>
</subUnitData>
<subUnitData position="2" positionType="Panel Nr." state="ok" subUnit="74375513159930676">
<test description="A10-007 7437551" name="CU102_BAY2_QR" testResultCode="passed">
<subTest name="Verbindung zum Pr³fling aufbauen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Initialisierung" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Fehlerflag lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ID lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Sachnummer lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Trigger setzen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ADC Abschalten" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
</test>
</subUnitData>
<subUnitData position="3" positionType="Panel Nr." state="ok" subUnit="74375513159930678">
<test description="A10-007 7437551" name="CU102_BAY2_QR" testResultCode="passed">
<subTest name="Verbindung zum Pr³fling aufbauen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Initialisierung" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Fehlerflag lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ID lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Sachnummer lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Trigger setzen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ADC Abschalten" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
</test>
</subUnitData>
<subUnitData position="4" positionType="Panel Nr." state="nok" subUnit="74375513159930677">
<test description="A10-007 7437551" name="CU102_BAY2_QR" testResultCode="failed">
<subTest name="FLOAT" testPosition="unknown">
<subPositions>
<subPosition name="{27}"/>
</subPositions>
<subTestResult testResultClass="fail" testResultCode="failed"/>
</subTest>
<subTest name="Components not tested" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
</test>
</subUnitData>
</unitData>
Can you help me, please, to optimize the regex? I want to extract the test tag.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2020
10:38 AM
|
