Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kris99
kris99
New Member
Member since:
06-18-2014
06-05-2020
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-18-2014 |
Activity Feed
- Posted Re: Why am I unable to use comparison operators "greater than or equal to" with a timechart? on Splunk Search. 10-14-2014 05:09 PM
- Posted Why am I unable to use comparison operators "greater than or equal to" with a timechart? on Splunk Search. 10-13-2014 11:05 PM
- Tagged Why am I unable to use comparison operators "greater than or equal to" with a timechart? on Splunk Search. 10-13-2014 11:05 PM
- Tagged Why am I unable to use comparison operators "greater than or equal to" with a timechart? on Splunk Search. 10-13-2014 11:05 PM
- Tagged Why am I unable to use comparison operators "greater than or equal to" with a timechart? on Splunk Search. 10-13-2014 11:05 PM
- Posted Why is my search eval not returning all expected fields? on Splunk Search. 10-08-2014 04:58 PM
- Tagged Why is my search eval not returning all expected fields? on Splunk Search. 10-08-2014 04:58 PM
- Tagged Why is my search eval not returning all expected fields? on Splunk Search. 10-08-2014 04:58 PM
- Tagged Why is my search eval not returning all expected fields? on Splunk Search. 10-08-2014 04:58 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-07-2014 07:29 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 08:03 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 07:26 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 06:33 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 06:06 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 05:56 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 05:36 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 05:34 PM
- Posted Re: How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 05:29 PM
- Posted How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 05:12 PM
- Tagged How to use rex to remove the domain from the "User name" field and use the username only as a named extraction? on Splunk Search. 10-06-2014 05:12 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-14-2014
05:09 PM
thank you for your response. This is close however.. I have a table which calculates the avg as below.
stats avg(value) AS la BY host User | eval la=round(la,2) | where la >=0
Also as suggested by you i want to display timechart. Tried below but i see entries from below search but not from the table above. Is it because its _time ? (i.e if i see 10 users from timechart, i see only one from the previous table. both need to match)
stats avg(value) as la by _time host User | eval la=round(la,2) | where la >=0 | timechart avg(la) by User
... View more
10-13-2014
11:05 PM
unable to use where >= with timechart
timechart max(value) AS la by User | eval la=round(la,2) | where la >=10
... View more
10-08-2014
04:58 PM
stats count host. Below search only returning "Server and Count" not the Desktop.
index| dedup host | eval "Type"=case(host=="xxx*","Desktop", host!="xxx*","Server") | stats count(host) by Type | rename count(host) AS Count | table Type Count
Need two row with Server & Desktop. If the host name starts with xxx its Desktop else its Server with count displayed
... View more
10-07-2014
07:29 PM
yes i did.
just so i learn how to write regex, if it was seperated by : what would i replace it with ?
... View more
10-06-2014
08:03 PM
works like a charm.. thank you !
... View more
10-06-2014
06:33 PM
only using this.. no luck
rex field=domainUsername "(?<domain>\S+)\\(?<userName>\S+)"
... View more
10-06-2014
06:06 PM
still getting same error. tried both options above
Error in 'rex' command: Encountered the following error while compiling the regex '(?<domain>\S+)\(?<userName>\S+)': Regex: unmatched parentheses
... View more
10-06-2014
05:56 PM
getting an error as below. domain includes domain-22\username
Error in 'rex' command: Encountered the following error while compiling the regex '(?<domain-22>\S+)\(?<userName>\S+)': Regex: unmatched parentheses
... View more
10-06-2014
05:34 PM
editor is removing backward slash
... View more
10-06-2014
05:29 PM
just "\"
"User name"=domain\username
... View more
10-06-2014
05:12 PM
How do I use regex within search to remove the domain from the field "User name" and use the username only as named extraction.
domain\username
something like this i think but don't know who to write regex to extract username or extract everything after "\" from field "User name"
| rex field="User name" "" | eval UserName=lower(UserName) | where UserName=lower(UserName) | search UserName="*"
... View more
10-01-2014
11:55 PM
doesn't work..
its adding new count column and returning Available and Unregistered as 1 only
... View more
10-01-2014
10:35 PM
How do I get latest events for the below search
i.e count should get the latest RegistrationState and SessionState if i search for last 15mins or 60mins. Always should get latest events to count. So I can get latest count of Available and Unregistered.
index=xx InMaintenanceMode=False |dedup MachineName,RegistrationState | eval avail=if(SessionState=="","t","f")|eval unreg=if(RegistrationState=="Unregistered","t","f") | stats count(eval(avail="t")) AS Available, count(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName
... View more
- Tags:
- latest
10-01-2014
08:45 PM
Thank you. That works.
But how do I use range / rangemap with that search ?
No Errors is Green Tick , Warning is Orange & Error is Red cross
... View more
09-29-2014
08:58 PM
how do I join below two searches and return within same SingleValue with following conditions..
If "ConnectionStatus" is "On" and "Events" is "0" , display "No Errors" with low range
If "ConnectionStatus" is "On" and "Events" is greater than "0" , display "Warning" with elevated range
If "ConnectionStatus" is NOT "On" and "Events" is greater than "0" , display "Error" with severe range
ConnectionStatus
index=xxx sourcetype="ConnectionStatus" State!="On" |stats first(State) as State | stats count | appendpipe [ stats count | eval Status="Up" | where count==0 ] | eval Status=if(count==0,"Up","Down") | eval range = if(Status=="No Errors","low","severe")
Events
index=yyy sourcetype="Events" Type!=Information (EventCode>="3012" AND EventCode<="3054") | stats count | eval StateBool = if (count==0, 0, 1) | eval Status=if(count==0,"No Errors","Warning") | rangemap field=StateBool low=0-0 elevated=1-1 | table Status range
... View more
09-29-2014
05:36 PM
tried using the same technique to join multiple searches but getting an error.
What am i doing wrong ?
index=xx sourcetype="ConnectionStatus" State!="On" | stats count(State) as down_count | appendcols [search index=yy sourcetype="Events" Type!=Information (EventCode>="3012" AND EventCode<="3054") |stats count | rename count as evt_count] | eval StateBool = if(down_count==0 AND evt_count==0, 0, down_count==0 AND evt_count >0, 1, down_count>0 AND evt_count>0, 2) | eval Status = if(down_count==0 AND evt_count==0,"Ok", down_count==0 AND evt_count>0,"Warning", down_count>0 AND evt_count>0,"Error")| rangemap field=StateBool low=0-0 elevated=1-1 severe=2-2 | table Status range
... View more
09-28-2014
10:36 PM
Based on the above search, how do I join below two searches and return the following within same SingleValue
If "ConnectionStatus" is "On" and "Events" is "0" , display "No Errors" with low range
If "ConnectionStatus" is "On" and "Events" is greater than "0" , display "Warning" with elevated range
If "ConnectionStatus" is NOT "On" and "Events" is greater than "0" , display "Error" with severe range
index=xxx sourcetype="ConnectionStatus" State!="On" |stats first(State) as State | stats count | appendpipe [ stats count | eval Status="Up" | where count==0 ] | eval Status=if(count==0,"Up","Down") | eval range = if(Status=="No Errors","low","severe")
index=yyy sourcetype="Events" Type!=Information (EventCode>="3012" AND EventCode<="3054") | stats count | eval StateBool = if (count==0, 0, 1) | eval Status=if(count==0,"No Errors","Warning") | rangemap field=StateBool low=0-0 elevated=1-1 | table Status range
... View more
09-23-2014
11:54 PM
following not displaying colour within the form.
If search finds events between 3012 - 3054, display Warning in Yellow (i.e elevated).
If I search and view as elevated, its displays the count of events in Yellow. But this is not working in form.
HV-test
<single>
<title>HV Err</title>
<searchString>index =xxx Type!=Information (EventCode>="3012" AND EventCode<="3054") | stats count | appendpipe [ stats count | eval Status="No Errors" | where count==0 ] | eval Status=if(count==0,"No Errors","Warning") | eval range = if(Status=="No Errors","low","elevated")</searchString>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
<option name="list.wrap">1</option>
<option name="classField">range</option>
<option name="field">Status</option>
</single>
... View more
09-16-2014
11:25 PM
how can i rename the wording. . If state = On, Show as "Up" else show "Down"
... View more
09-13-2014
12:50 PM
how do i use range to display green tick or red cross for the following
index=xx sourcetype="yyy" State!="On"
If 'State' not equal to 'On' display red cross else green tick. I want it to take the latest event to check.
Thanks in advance for your help
... View more
- Tags:
- range
09-10-2014
06:23 PM
Is it possible to send the following to two different indexes via Universal Forwarder ?
[perfmon://CPU]
index=aaaa
index=bbbb
[perfmon://Memory]
index=aaaa
index=bbbb
... View more
07-25-2014
12:04 AM
No receiving any session information for XenDekstop 7 app. No User Latencym IOPS, etc.
Appreciate if anyone can assist.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
