Activity Feed
- Karma Is it possible to display the annotation by default on line chart without placing cursor on the annotation label? for shekharpogula. 06-05-2020 12:50 AM
- Karma Re: Joining two searches based on a common field for gcusello. 06-05-2020 12:50 AM
- Karma Re: To include 80+ applications in SPL for KailA. 06-05-2020 12:50 AM
- Karma Re: System failures for diogofgm. 06-05-2020 12:50 AM
- Karma Re: How to get TOP 3 values from STATS list() for kamlesh_vaghela. 06-05-2020 12:50 AM
- Posted Using TimeWrap for specific time window. on Splunk Search. 10-08-2019 06:49 PM
- Tagged Using TimeWrap for specific time window. on Splunk Search. 10-08-2019 06:49 PM
- Tagged Using TimeWrap for specific time window. on Splunk Search. 10-08-2019 06:49 PM
- Posted Re: How to get TOP 3 values from STATS list() on Splunk Search. 09-23-2019 12:39 AM
- Posted Re: How to get TOP 3 values from STATS list() on Splunk Search. 09-22-2019 04:47 PM
- Posted Re: How to get TOP 3 values from STATS list() on Splunk Search. 09-22-2019 04:43 PM
- Posted Re: How to get TOP 3 values from STATS list() on Splunk Search. 09-20-2019 04:49 AM
- Posted Re: How to get TOP 3 values from STATS list() on Splunk Search. 09-20-2019 04:22 AM
- Posted How to get TOP 3 values from STATS list() on Splunk Search. 09-20-2019 03:37 AM
- Tagged How to get TOP 3 values from STATS list() on Splunk Search. 09-20-2019 03:37 AM
- Posted Re: System failures on Monitoring Splunk. 09-05-2019 11:00 PM
- Posted Re: System failures on Monitoring Splunk. 09-05-2019 09:37 PM
- Posted System failures on Monitoring Splunk. 09-05-2019 01:04 AM
- Tagged System failures on Monitoring Splunk. 09-05-2019 01:04 AM
- Posted To include 80+ applications in SPL on Splunk Search. 08-22-2019 06:30 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 | |||
0 | |||
0 | |||
0 | |||
0 |
10-08-2019
06:49 PM
Hello Everyone,
I am trying to count the events for the window 8PM(Day1) to 6AM(Day2) for last 3 days so that I can compare the count of the events for last 2 time windows.
Assuming I am running the query today (i.e. 9/10/2019) then:-
Window 2:- 8PM(7/10/2019 i.e. Day3) to 6AM(8/10/2019 i.e. Day2)
Window 1:- 8PM(8/10/2019 i.e. Day2) to 6AM(9/10/2019 i.e. Day1)
Is there any way to count events for these specific windows and then do a compare using TIMECHART/TIMEWRAP
I tried to use the below query after working out the earliest and latest times using the time picker advanced tab but that is not giving me the results for the 2 time windows I am trying to compare.
Index=syslog JOBNAME="XX*" earliest=-3d@h+32h latest=@d+06h
| timechart useother=f count as count
| timewrap d
Or if there is any other better way of doing/representing it then please let me know.
Thanks,
Rajat
... View more
09-23-2019
12:39 AM
Thanks @kamlesh_vaghela i accepted the answer. However I noticed that I am not able to apply color codes on the output, I can see the option in the column to format based on the colour codes but when I apply it does nothing. Is there a way I can color the cells of "elapseJobTime" column based on the high and low values appearing in this column... I was able to do it with the normal table values but it seem getting these values in the list format is causing this issue.. Anything if you can suggest that will be great.. Thanks Rajat
... View more
09-22-2019
04:47 PM
This worked - Perfect !! Thank you Rajat
... View more
09-22-2019
04:43 PM
Hello @dpeukert
This didn't worked. I am getting "Error in 'stats' command: The argument 'limit=3' is invalid."
Thanks Rajat
... View more
09-20-2019
04:49 AM
The output is coming as below along with the list of all the values in the fields
tJOBID tJOBNAME telapseJobTime
Multivalue Multivalue Multivalue
From the previous query with mvrange the output was
desc JOBID JOBNAME elapseJobTime
desc1
desc2
... View more
09-20-2019
04:22 AM
Thanks @kamlesh_vaghela , Just tried it now. I am only getting the "desc" values and rest of the fields are coming blank.
... View more
09-20-2019
03:37 AM
Hello Everyone,
I am trying to get the top 3 max values of a field "elapseJobTime" for all the instances associated with the field "desc".
In order to achieve this, I first sorted the field "elapseJobTime" in descending order and then executed the STATS command to list out the values of all the respective fields I was looking for. I am getting the output in the sequence as expected but the only issue is that my search lists down 100's of values for the fields JOBNAME JOBID elapseJobTime but I want to restrict my output to just top 3 values. I tried to use HEAD 3 after the STATS but no luck.
Please assist.
| sort -elapseJobTime
| stats list(JOBNAME) as JOBNAME list(JOBID) as JOBID list(elapseJobTime) as elapseJobTime by desc
The output should be like
desc JOBNAME JOBID elapseJobTime
desc1 JOB1 J1 .31
JOB1 J2 .27
JOB3 J3 .27
desc2 JOB4 J4 .71
JOB5 J5 .11
JOB5 J6 .10
Thank you
Rajat
... View more
- Tags:
- splunk-enterprise
09-05-2019
11:00 PM
Hello @diogofgm , I was able to figure out that basically the JOBNAME is multivalue filed which contained both the global job XX along with actual jobs AB or DE so i just picked the actual job from the JOBNAME field using mvindex() function and then ran the stats on the actual job . This finally gave me the expected results.
Thank you very much !!
... View more
09-05-2019
09:37 PM
Thanks @diogofgm , your SPL works like a charm, Thank you very much. But somewhere in my actual data I have a global job which is associated with every actual job and it shares the same JOBID . Because of this i am always getting this global JOB as XX with every instance of actual JOB AB or DE for this example. Since this global job shares the same JOBID as the actual jobs so I issued | dedup JOBID before the last stats command in your SPL. And i am getting the results as
AB 2
XX 2
DE 1
XX 2
I also tried to give | where NOT JOB == "XX" but then it gives me no results.
is there any way i can suppress/hide XX for the results??
Thank you very much
... View more
09-05-2019
01:04 AM
Hello Everyone,
I am trying to identify the system failure based on the below sample data :-
ABCD AB1234 USERID SYSTEM
ABCD AB1234 XXXXX
ABCD AB1234 YYYYY
ABCD AB1234 ZZZZZZ
ABCD AB1234 FAILD
ABCD AB1231 USERID USER1
ABCD AB1231 XXXXX
ABCD AB1231 YYYYY
ABCD AB1231 ZZZZZZ
ABCD AB1231 FAILD
ABEF AB1235 USERID SYSTEM
ABEF AB1235 XXXXX
ABEF AB1235 YYYYY
ABEF AB1235 ZZZZZZ
ABEF AB1235 FAILD
DEFG AB1231 USERID SYSTEM
DEFG AB1231 XXXXX
DEFG AB1231 YYYYY
DEFG AB1231 ZZZZZZ
DEFG AB1231 FAILD
DEFG AB1231 USERID USER2
DEFG AB1231 XXXXX
DEFG AB1231 YYYYY
DEFG AB1231 ZZZZZZ
DEFG AB1231 FAILD
First column represent JOBNAME, second JOBID and third MSGTXT
The JOBNAME and JOBID combination is unique for a process. I am trying to get the count on FAILD for only USERID SYSTEM appearing in MSGTXT field by first two chars of JOBNAME
I tried using TRANSACTION command as below but it didn't gave me expected results.
index=system_data JOBID=* JOBNAME=*
| transaction JOBNAME JOBID keepevicted=1 startswith="*USERID SYSTEM*" endswith="*FAILD*"
| eval JOB = substr(JOBNAME,1,2)
| stats values(eventcount) as failures by JOB
| where eventcount>0
I am expecting the output to be as
AB 2
DE 1
Please assist.
Thank you
... View more
- Tags:
- splunk-enterprise
08-22-2019
06:30 AM
Hello Everyone,
I have got the list of 80+ applications this I want to include in my SPL. Is there a way I can use CSV lookup to do that? The applications list look like:-
APP-ID,DESCRIPTION
A1*,test app 1
B2*,test app 2
C3*,test app 3
D4*,test app 4
...
Sample SPL I would like to create to include these applications:-
index=app-data APP-ID=A1* OR APP-ID=B2* OR APP-ID=C3* OR APP-ID=D4*.... |
I am not using the DESCRIPTION as mentioned in the sample CSV above at this stage. I am just trying to figure out if there is a way to look up these applications from a CSV file rather then having to type these in the SPL or if there is any other alternative please suggest.
Thank you,
Rajat
... View more
08-13-2019
07:36 AM
Thank you Giuseppe , you are a genius 🙂 without even asking for the sample data you were able to provide these queries .. amazing!!. I will use join to combine the first two queries as suggested by you and achieve the required output. Just for your reference, I have provided the sample data in response to the comment from woodcock below. Regards Rajat
... View more
08-13-2019
07:29 AM
Thanks for the advice woodcock, Please refer to the sample data below
13-08-2019 23:46:30 JOBNAME:JOB1 JOBID:JOB1234 MSGNUM:START-PROCESS
13-08-2019 23:16:00 JOBNAME:JOB1 JOBID:JOB1234 MSGNUM:END-PROCESS
13-08-2019 22:45:30 JOBNAME:JOB1 JOBID:JOB4567 MSGNUM:START-PROCESS
13-08-2019 21:55:00 JOBNAME:JOB1 JOBID:JOB4567 MSGNUM:END-PROCESS
13-08-2019 21:24:30 JOBNAME:JOB1 JOBID:JOB5678 MSGNUM:START-PROCESS
13-08-2019 20:44:00 JOBNAME:JOB1 JOBID:JOB5678 MSGNUM:END-PROCESS
13-08-2019 20:13:30 JOBNAME:JOB1 JOBID:JOB6789 MSGNUM:START-PROCESS
13-08-2019 19:43:00 JOBNAME:JOB2 JOBID:JOB7891 MSGNUM:START-PROCESS
13-08-2019 19:02:20 JOBNAME:JOB2 JOBID:JOB7891 MSGNUM:END-PROCESS
13-08-2019 18:22:00 JOBNAME:JOB3 JOBID:JOB8912 MSGNUM:START-PROCESS
13-08-2019 17:51:30 JOBNAME:JOB3 JOBID:JOB8912 MSGNUM:END-PROCESS
13-08-2019 17:18:10 JOBNAME:JOB3 JOBID:JOB8913 MSGNUM:START-PROCESS
13-08-2019 16:07:40 JOBNAME:JOB3 JOBID:JOB8913 MSGNUM:END-PROCESS
13-08-2019 15:43:20 JOBNAME:JOB3 JOBID:JOB8914 MSGNUM:START-PROCESS
13-08-2019 15:09:00 JOBNAME:JOB3 JOBID:JOB8914 MSGNUM:END-PROCESS
13-08-2019 14:38:30 JOBNAME:JOB3 JOBID:JOB8915 MSGNUM:START-PROCESS
12-08-2019 22:21:10 JOBNAME:JOB3 JOBID:JOB8916 MSGNUM:START-PROCESS
12-08-2019 21:57:30 JOBNAME:JOB3 JOBID:JOB8916 MSGNUM:END-PROCESS
11-08-2019 20:49:00 JOBNAME:JOB3 JOBID:JOB8917 MSGNUM:START-PROCESS
11-08-2019 20:14:50 JOBNAME:JOB3 JOBID:JOB8917 MSGNUM:END-PROCESS
11-08-2019 17:42:20 JOBNAME:JOB1 JOBID:JOB1435 MSGNUM:START-PROCESS
11-08-2019 17:11:50 JOBNAME:JOB1 JOBID:JOB1435 MSGNUM:END-PROCESS
10-08-2019 21:22:20 JOBNAME:JOB3 JOBID:JOB8918 MSGNUM:START-PROCESS
10-08-2019 20:52:10 JOBNAME:JOB3 JOBID:JOB8918 MSGNUM:END-PROCESS
09-08-2019 14:52:40 JOBNAME:JOB1 JOBID:JOB8919 MSGNUM:START-PROCESS
09-08-2019 14:12:30 JOBNAME:JOB1 JOBID:JOB8919 MSGNUM:END-PROCESS
08-08-2019 14:19:00 JOBNAME:JOB3 JOBID:JOB8999 MSGNUM:START-PROCESS
08-08-2019 13:28:50 JOBNAME:JOB3 JOBID:JOB8999 MSGNUM:END-PROCESS
08-08-2019 15:19:00 JOBNAME:JOB2 JOBID:JOB1999 MSGNUM:START-PROCESS
08-08-2019 15:28:50 JOBNAME:JOB2 JOBID:JOB1999 MSGNUM:END-PROCESS
Expected output for the current day 13-08-2019
Active-Job Runtime Average-runtime-over-last-week
JOB1 now() - 13-08-2019 20:13:30 00:38:26
JOB3 now() - 13-08-2019 14:38:30 00:39:04
Note JOB2 should not appear in the output as it is presently not active.
Regards Rajat
... View more
08-11-2019
08:25 PM
Thanks Woodcock, I am not sure from where are you getting the value for Runtime in the above query. Runtime is the spanned time of a currently running process(active).
... View more
08-11-2019
08:21 PM
Thank you gcusello,
First query -- All Good , Second query -- All Good , However in the Third query which is the combination of First and Second query I wanted to view all the active processes, the current runtime of this active process from now, average runtime of the same process(inactive) by looking back for one week . I am not getting it from your full search. In order to calculate the duration of a inactive process (process which is already completed) i was looking at MSGNUM="END-PROCESS" which you haven't used in your full search also i am not sure if you are actually looking for a last weeks (-1w) data to calculate the average of an already completed process. I guess that's where we need to have a Join..?
The first two queries are working as expected with the stats logic you showed. Thank you for sharing that.
... View more
08-10-2019
08:02 AM
Hello Everyone,
I have two search queries which are working as expected but when I trying to join both these queries it not giving the expected results.
First Query :- Getting the current runtime of all the active processes
index=process_log (MSGNUM="START-PROCESS") AND JOBID="JOB*"
| transaction JOBID JOBNAME keepevicted=1 keeporphans=1
| where eventcount==1
| where searchmatch("START-PROCESS")
| eval Runtime = now() - _time
| eval Runtime = round(Runtime,2)
| table _time JOBNAME Runtime
Second Query :- Getting the average runtime of all the active processes from now to past one week
index=process_log (MSGNUM="START-PROCESS" OR MSGNUM="END-PROCESS") AND JOBID="JOB*" earliest=-1w latest=now()
| transaction JOBID JOBNAME keepevicted=1 startswith=START-PROCESS endswith=END-PROCESS
| stats avg(duration) as AverageRuntime by JOBNAME
| eval AverageRuntime = round(AverageRuntime,2)
Join Query based on JOBNAME
index=process_log (MSGNUM="START-PROCESS" OR MSGNUM="END-PROCESS") AND JOBID="JOB*"
| transaction JOBID JOBNAME keepevicted=1 keeporphans=1
| where eventcount==1
| where searchmatch("START-PROCESS")
| eval Runtime = now() - _time
| eval Runtime = round(Runtime,2)
| join type=left max=0 JOBNAME [ search index=process_log START-PROCESS OR END-PROCESS earliest=-1w latest=now()
| transaction JOBID JOBNAME keepevicted=1 startswith=START-PROCESS endswith=END-PROCESS
| stats avg(duration) as AverageRuntime by JOBNAME]
| table JOBNAME Runtime AverageRuntime
No values are coming for AverageRuntime, Runtime is getting displayed as per JOBNAME. I not sure why no values are coming for AverageRuntime
Please assist me , Thank you
... View more