Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About sai_john
sai_john
New Member
Member since:
11-04-2016
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-04-2016 |
Activity Feed
- Posted Re: How to find difference between (Today's logins) and (Average logins of that particular week day for last 30days) by hour? on Splunk Search. 04-17-2018 01:46 PM
- Posted How to find difference between (Today's logins) and (Average logins of that particular week day for last 30days) by hour? on Splunk Search. 04-15-2018 09:48 PM
- Tagged How to find difference between (Today's logins) and (Average logins of that particular week day for last 30days) by hour? on Splunk Search. 04-15-2018 09:48 PM
- Posted Re: How do we use wildcard such as * in eval case match to see multiple types of files? on Splunk Search. 09-22-2017 05:40 AM
- Posted Re: How do we use wildcard such as * in eval case match to see multiple types of files? on Splunk Search. 09-20-2017 05:10 PM
- Posted Re: How do we use wildcard such as * in eval case match to see multiple types of files? on Splunk Search. 09-19-2017 10:04 PM
- Posted How do we use wildcard such as * in eval case match to see multiple types of files? on Splunk Search. 09-19-2017 10:00 PM
- Tagged How do we use wildcard such as * in eval case match to see multiple types of files? on Splunk Search. 09-19-2017 10:00 PM
- Tagged How do we use wildcard such as * in eval case match to see multiple types of files? on Splunk Search. 09-19-2017 10:00 PM
- Tagged How do we use wildcard such as * in eval case match to see multiple types of files? on Splunk Search. 09-19-2017 10:00 PM
- Posted Re: Is there a way to check for a file from n number of hosts and alert if there is no file from each host in last 30min? on Splunk Search. 02-01-2017 06:24 PM
- Posted Re: Is there a way to check for a file from n number of hosts and alert if there is no file from each host in last 30min? on Splunk Search. 02-01-2017 10:00 AM
- Posted Re: Is there a way to check for a file from n number of hosts and alert if there is no file from each host in last 30min? on Splunk Search. 01-31-2017 08:59 AM
- Posted Is there a way to check for a file from n number of hosts and alert if there is no file from each host in last 30min? on Splunk Search. 01-30-2017 12:56 PM
- Tagged Is there a way to check for a file from n number of hosts and alert if there is no file from each host in last 30min? on Splunk Search. 01-30-2017 12:56 PM
- Tagged Is there a way to check for a file from n number of hosts and alert if there is no file from each host in last 30min? on Splunk Search. 01-30-2017 12:56 PM
- Tagged Is there a way to check for a file from n number of hosts and alert if there is no file from each host in last 30min? on Splunk Search. 01-30-2017 12:56 PM
- Tagged Is there a way to check for a file from n number of hosts and alert if there is no file from each host in last 30min? on Splunk Search. 01-30-2017 12:56 PM
- Posted Re: Is there a feature in Splunk (similar to Dropbox) where can i drop multiple log files from multiple locations? on Getting Data In. 01-24-2017 07:57 PM
- Posted Re: Is there a feature in Splunk (similar to Dropbox) where can i drop multiple log files from multiple locations? on Getting Data In. 01-24-2017 07:10 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-17-2018
01:46 PM
I have noticed that average logins are not pulled up with correct results. i am looking to to get average of that particular day for last 30 days. for suppose, if you run the search on Monday, you need to get average of all mondays within last 30 days.
Is there a way to get correct average for only weekdays and then get difference with above search?
... View more
04-15-2018
09:48 PM
I need to calculate difference between (TodayLogins-AverageLogins of that particular weekday). For that I have calculated Today's logins and (Average logins of all weekdays for last 30days) by hour separately by below searches and joined results of both using join.Can someone help with correctness of below search?
Here is the search i am trying to get difference:
index="_internal" "login" earliest=-30d |search id=""| eval time_hour = strftime(_time, "%H") |eval DayOfWeek = strftime(now(),"%w") | stats dc(id) AS "Total_Login" by time_hour, DayOfWeek| chart avg(Total_Login) AS AverageLogins over time_hour by DayOfWeek limit=0 | table time_hour AverageLogins
|join time_hour [search index="_internal" "*login" earliest=-24h |search id="*" | eval time_hour = strftime(_time, "%H") |eval DayOfWeek = strftime(_time,"%w") |stats dc(id) AS "TodayLogins" by time_hour, DayOfWeek |chart values(TodayLogins) AS TodayLogins by time_hour limit=0 |table time_hour TodayLogins] |eval Diff=(TodayLogins-AverageLogins) | table time_hour TodayLogins AverageLogins Diff
... View more
- Tags:
- splunk-enterprise
09-22-2017
05:40 AM
This worked. Thanks soni
... View more
09-20-2017
05:10 PM
I tried giving .. in between fileNames as you said but that is not working
... View more
09-19-2017
10:04 PM
My result values under FileType should be
FileType
"ABC01.GIF*"
"ABC02.DCL*.GIF*"
"ABC03.IFG_DCL*.GIF*"
"ABC04.FGH_HCL*.DAT*"
"ABC05.FGH_OUT*.DAT*"
"ABC06.GHI_OUT_DAILY*.DAT*"
... View more
09-19-2017
10:00 PM
I was trying to give all the 6 types of files which are under fileName field and trying to get all the filetypes including * under FileType field. but with the below search i am not able to pull all 6types of files under FileType field.
Trying this search:
index=* | eval FileType=case(match(fileName,"ABC01.GIF*"),"ABC01.GIF*" , match(fileName,"ABC02.DCL*.GIF*"),"ABC02.DCL*.GIF*", match(fileName,"ABC03.IFG_DCL*.GIF*"),"ABC03.IFG_DCL*.GIF*", match(fileName,"ABC04.FGH_HCL*.DAT*"),"ABC04.FGH_HCL*.DAT*", match(fileName,"ABC05.FGH_OUT*.DAT*"), "ABC05.FGH_OUT*.DAT*", match(fileName,"ABC06.GHI_OUT_DAILY*.DAT*"), "ABC06.GHI_OUT_DAILY*.DAT*") | stats count by FileType
Please advise to get all types of files under FileType field.
Thanks!
... View more
02-01-2017
06:24 PM
@mpreddy
This is working for me. Thankyou
... View more
02-01-2017
10:00 AM
Sorry i am too early to accept this, I haven't recognized that this search which I am getting count for field "File" is not getting correct values.
Here is my search for alerting if there is no ".txt" File in last 1hr either from host1 or host2
| tstats count WHERE index=xxx earliest=-1h by _time host
| fields _time host
| join type=left host [
search index=xxx (host=host1 OR host=host2) sourcetype=abc File="*.txt"
| stats count by _time host File
]
| fillnull count value=0 | where count=0
... View more
01-31-2017
08:59 AM
@jplumsdaine22 your tstats worked for me after little modifications.Thanks
Your Search:
| tstats earliest=-30d count WHERE index=xxx by host
| fields host
| join type=left host [
search index=xxx earliest=-60m
| bucket _time span=3m
| stats count by _time host IP
]
| fillnull count value=0
Modified search:
| tstats count WHERE index=xxx earliest=-1h by _time host
| fields host
| join type=left host [
search index=xxx earliest=-60m
| bucket _time span=3m
| stats count by _time host IP
]
| fillnull count value=0
... View more
01-30-2017
12:56 PM
index=test File="*.txt" | stats count by host | where count<1 -->with this I am getting NoResults found" but I need count 0 if there is no file from host1 or host2 or host3 or so on and need to show for which host there is no file
HostName count
host1 0
host2 0
host3 0
:
:
hostn 0
... View more
01-24-2017
07:57 PM
yeah i understood that. you are talking about adding new data from different servers/data formats. you are correct in that perspective. But i am talking about sample files which are in my local desktop.
For example I have exported 10 sample log files(lets talk about only csv files) from splunk from 10 sourcetypes into my local desktop.
Now i want to place/drop these 10 .csv sample files into __(kind of dropbox /some app)__ to search from that sample data which is present in those 10 csv files.
i want to know if there is an app/feature in splunk similar to dropbox to place these 10 csv files and then tweek.
... View more
01-24-2017
07:10 PM
yeah this is the regular process to add data from different data formats.
But i am not looking to get data from different servers/data format since i just want to place my sample log files(.csv / .txt) to play with that sample data. Does Splunk provides an appor some other feature to place/drop sample multiple log files and then play around that by extracting fields?
... View more
01-24-2017
05:58 PM
yes i know that. we need this kind of dropbox feature to store sample log files in lower environment which is used to play with the data to create some dashboards and others.
... View more
01-24-2017
03:14 PM
Is there a feature in Splunk (like Dropbox) to drop all types of logs from different applications ?
Where can i drop in multiple log files with multiple log types (.csv/.txt/.log) from multiple locations?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
