Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About k_harini
k_harini
Communicator
Member since:
09-26-2016
09-24-2021
Community Statistics
| Posts | 131 |
| Solutions | 4 |
| Karma Given | 10 |
| Karma Received | 2 |
| Member Since | 09-26-2016 |
Activity Feed
- Karma Re: How do I calculate the average over time when the count keeps changes every month? for woodcock. 06-05-2020 12:48 AM
- Karma Re: calculate Field count and pass it for percent calculation for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Custom single value icon not displaying with non-count field for dcoomer. 06-05-2020 12:48 AM
- Karma Re: Issue with Field other than _time to represent in x-axis for gcusello. 06-05-2020 12:48 AM
- Karma Re: splunklib client giving SSLError for kbarker302. 06-05-2020 12:48 AM
- Got Karma for condition match tag in drill down condition based on form input token and drilldown value not working. 06-05-2020 12:48 AM
- Karma Re: Find events matching a multi-value field for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Conditional count in stats function for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to create a new field with values in existing field based on the values in other field. for Gilberto_Castil. 06-05-2020 12:46 AM
- Karma Re: Splunk closing TCP port 9997 (forwarder port) for mikelanghorst. 06-05-2020 12:46 AM
- Karma Re: Rex mode=sed diff between replace and substitute for dwaddle. 06-05-2020 12:46 AM
- Got Karma for Re: indexing congestion consistenly happening. 06-05-2020 12:46 AM
- Posted Re: Subsearch in eval not working on Splunk Search. 03-09-2018 02:48 AM
- Posted Subsearch in eval not working on Splunk Search. 03-09-2018 01:07 AM
- Posted Re: How to set a token based on another token on Deployment Architecture. 02-02-2018 05:33 AM
- Posted How to set a token based on another token on Deployment Architecture. 02-02-2018 02:29 AM
- Posted Re: latest events which are indexed are not pulled correctly based on time filter on Getting Data In. 01-17-2018 05:25 AM
- Posted Re: latest events which are indexed are not pulled correctly based on time filter on Getting Data In. 01-17-2018 04:56 AM
- Posted Re: latest events which are indexed are not pulled correctly based on time filter on Getting Data In. 01-17-2018 04:55 AM
- Posted Re: timezone issue with custom log time date stamp on Getting Data In. 01-17-2018 04:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-09-2018
02:48 AM
FY18, FY17 are the tokens that are passed from another search. Would like to compare that and get corresponding year values - 2017 and 2018
... View more
03-09-2018
01:07 AM
I'm trying to get the eval value in subsearch and use it for further searching in the query. I guess there is issue with case condition. Case statement works fine outside subsearch. This query is not working. It shows this error - Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).
index=test_idx|spath|dedup Project_ID|search Op_Completed_status="Completed" |table Op_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval cdate_mon = strftime(cdate ,"%m")| eval cyr=[search index=test_idx|spath|dedup Project_ID|search Opera_Completed_status="Completed" |table Opera_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")|table yr]|table cyr
Can some one please assist?
`
... View more
- Tags:
- splunk-enterprise
02-02-2018
05:33 AM
Yes.. I used depends for the below panel.. but I want to unset this when another token is set like $field4$ from different panel. That I cannot do directly.. so I tried with condition match..
... View more
02-02-2018
02:29 AM
Hi,
I tried to set token based on another token set from drilldown. But the condition match here is not satisfied. can someone please assist
`
|makeresults|eval test= "$form.field3$" |table test
showing
</condition>
<condition>
<set token="hide">hiding</set>
</condition>
</preview>
</search>
</table>
</panel>
</row>`
form.field3 is set on drilldown. if it is null it is going to other condition and not immediate one. I want to hide and show two panels based on this token setting. can some one please assist?
... View more
- Tags:
- splunk-enterprise
01-17-2018
05:25 AM
Should the props.conf be as per server time?
... View more
01-17-2018
04:56 AM
I guess this is issue with timezone.. its indexing ahead of time and not shown in time filter. How to correct this?
... View more
01-17-2018
04:55 AM
_time=2018-01-17 17:12:47,u_comments="",child_incidents="0",sys_tags="",u_sla="",u_resolved="",work_notes_list="",work_end="",u_approve_reject="",u_priority_type="Downgrade",approval_history="",u_external_reference_id="",rfc="",u_resolved_by="",sla_due="UNKNOWN",u_peer="",u_proposed_critical="false",u_production_server_risk="false",u_business_unit="De Beers Canada"
This is one sample event
... View more
01-17-2018
04:42 AM
Did this work? I'm facing same issue
... View more
01-17-2018
04:11 AM
I have real time events pulled through rest api call. The latest events are present in index but not visible when we select time filter as 4 hours. Events are visible with All time filter.
what could be the issue
(before 1/17/18 12:07:20.000 PM) This is what i see when i select all time
But in events - I see this 1/17/18
5:12:47.000 PM and events with _time=2018-01-17 17:12:47
so when filter is selected as 4 hours events are not visible. Kindly help.. its urgent
DATETIME_CONFIG =
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TZ=UTC
... View more
- Tags:
- splunk-enterprise
11-28-2017
02:51 AM
Title should be displayed with ig_tok value. There are around 10 unique values. By default we have * .. when All is selected,(' *') would appear in title. Requirement is - Star alone should not be displayed. Anything else should be displayed. I tried with 2 panels to see if i can remove star from title. It dint work.
... View more
11-27-2017
08:33 PM
Basically the ask is this - if we have * then in title it should not display anything and if the token has any other value other than * it should display the value. Please find the code here
`
PDF
<panel depends="$show_panel$">
<html>
<div class="left_logo">
<div class="right_logo">
<h2 align="center">
<b>
A&PD Dashboard $my_test$
</b>
</h2>
</div>
</div>
</html>
</panel>
<panel rejects="$show_panel$">
<html>
<div class="left_logo">
<div class="right_logo">
<h2 align="center">
<b>
A&PD Dashboard $IG_tok$
</b>
</h2>
</div>
</div>
</html>
</panel>
<panel>
<input type="dropdown" token="IG_tok" searchWhenChanged="true">
<label>IG</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>IG</fieldForLabel>
<fieldForValue>IG</fieldForValue>
<search>
<query>index=aof_* |dedup IG|table IG</query>
</search>
<change>
<condition match="'IG_tok'=="*"">
<set token="my_test"> </set>
<set token="show_panel">true</set>
</condition>
<condition match="'IG_tok'!="*"">
<unset token="show_panel">false</unset>
</condition>
</change>
</input>
</panel> `
Please help. This looks simple. but I spent good amount of time here. unable to resolve. Any help is highly appreciated
... View more
11-27-2017
09:04 AM
I have a condition where i should display token value in title. If value is *, nothing needs to be displayed. Anything else then that value needs to be displayed from drop down.
`
<set token="my_test">$IG_tok$</set>
</condition>
<condition match="'IG_tok'=="*"">
<set token="my_test"> </set>
</condition>
</change>`
I tried the above. but here if IG_tok is any value other than * - it takes previous value of IG_tok and not current one that we select,
I also tried this
<eval token="my_test">if($IG_tok$="*"," ",$IG_tok$)</eval>
DId not work. Takes previous value here as well. how to do this? please help in resolving this issue
... View more
- Tags:
- splunk-enterprise
11-08-2017
08:53 AM
Thanks for your help
... View more
11-06-2017
10:35 PM
I have below text and i need to extract "Successfully Sent" FTP Ipaddress and store number. I could extract first portion post which it is not working.
index="biztalk_idx" sourcetype="biztalk"|dedup Description|table Description|rex field=Description "(?<ExecutionStart>.* starting to execute)"|rex field=Description "(?<SendSales>Sending sales.*)"|rex field=Description "(?<SuccessSent>SUCCESSFULLY sent\s\w+)"
"Message SUCCESSFULLY sent to FTP ftp://10.23.18.8:21/Foljesedel_171026152046_135060.xml for store: S135060."
Also for extracting different fields from different values, do we have to add rex command each time or is there any other better way?
Can someone please help. Thanks!
... View more
- Tags:
- splunk-enterprise
10-30-2017
11:19 PM
Thanks for your time. I will try this..
... View more
10-30-2017
11:19 PM
Awesome.. This worked.. 🙂 Thanks a lot
... View more
10-25-2017
03:32 AM
I could do this by passing it as token from different query. Just want to know if it can be done in a single query instead of calling index twice
... View more
10-24-2017
10:07 PM
This worked with some slight modifications. Thanks!
... View more
10-24-2017
10:05 PM
I want to pass latest_date for null value so that inprogress count sits there as there is no completion date for inprogress records. Thats the ask. Here latest_date is not passed as token. Im just getting string latest date. is this doable? can some one help?
index="test" IG="*" |rename "Completion Date" as completed_date "Savings in k" as Dollar_Savings|eventstats last(completed_date) as latest_date|fillnull value=latest_date completed_date | stats count(eval(('Assessment Status'="Closed") OR ('Assessment Status'="Completed"))) as "# of Assessments completed (Projects)" sum(Dollar_Savings) as "Cost Savings Committed (K $)" sum("FTE impact") as FTE_impact sum("Baseline FTE") as baseline_FTE count(eval('Assessment Status'="In Progress")) as "# of Assessments In-progress" by completed_date
... View more
10-24-2017
09:37 AM
This did not work.. none of files got indexed 😞
... View more
10-23-2017
11:59 PM
Thanks a lot. I will try this now
... View more
10-23-2017
10:10 PM
Hi,
I would like to index files into different indexes which are residing in same folder. I did whitelisting. But only first file in folder got indexed successfully. Other 2 files are not indexed.
[monitor://C:\Program Files\Splunk\etc\apps\test\testdata\certification_data\]
disabled = false
index = aof_prime_idx
sourcetype = aof_tm_source
whitelist = (prime.*\.csv)
crcSalt = <SOURCE>
[monitor://C:\Program Files\Splunk\etc\apps\test\testdata\certification_data\]
disabled = false
index = aof_architect_idx
sourcetype = aof_tm_source
whitelist = (Architect.*\.csv)
crcSalt = <SOURCE>
[monitor://C:\Program Files\Splunk\etc\apps\test\testdata\certification_data\]
disabled = false
index = aof_archade_idx
sourcetype = aof_tm_source
whitelist = (archade.*\.csv)
crcSalt = <SOURCE>
what could be the reason. ? How can i achieve this in a different way? please provide some pointers
... View more
- Tags:
- splunk-enterprise
10-22-2017
02:57 AM
I want to sort based on the 2nd column generated dynamically post using xyseries command
index="aof_mywizard_deploy_idx" sourcetype="aof_tm_source" | rename "Timelines_FY17 FY18_Q1" as "Completetion_date" |eval c_status=upper('Current Week Status') |search c_status!="TBC"| stats count(c_status) as count by Completetion_date c_status |eventstats sum(count) as Total by Completetion_date| eval ragcount% = (round((count/Total)100))."%"| xyseries c_status Completetion_date count ragcount%|rename "count: *" as ":Count" "ragcount%: " as ":Percent%" |table c_status *|rename c_status as "RAG STATUS"
Columns generated are Rag status, FY17:Count FY17:percent% Fy18-Q1:count.. etc. I want to sort with the first count (in this case FY17:Count) . How can i do that? can some one please help? if i give sort - "FY17:Count" it works.. but since its dynamically generated , is there a way to handle this?
... View more
08-25-2017
04:08 AM
@somesoni2, can you please help here.
I have exactly similar case and I tried the answer you gave, its taking only first value and not all the values.
index=xxx_index| search Project="abc Online" AND [|gentimes start=-1|eval ref_incident_u_n_1_group = "abc Online MDT Support, abc Online Support" | makemv delim="," ref_incident_u_n_1_group|mvexpand ref_incident_u_n_1_group|table ref_incident_u_n_1_group|format ] |stats count by ref_incident_u_n_1_group work_queue
I will be passing token to ref_incident_u_n_1_group with , delimiter as in the query. Here for stats I get results for "abc Online MDT Support" but not for "abc Online Support". Is it because of spaces..? what could be the reason? please suggest
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-24-2021
05:20 AM
|
