Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ashvinpandey
ashvinpandey
Communicator
Member since:
08-22-2019
3 weeks ago
Community Statistics
| Posts | 64 |
| Solutions | 12 |
| Karma Given | 2 |
| Karma Received | 23 |
| Member Since | 08-22-2019 |
Activity Feed
- Posted Re: HOW TO GET FULL NAME USING REGEX FROM RAW DATA on Splunk Search. 3 weeks ago
- Posted Re: Used reports/dashboards on Monitoring Splunk. 10-25-2021 07:16 AM
- Posted Re: help on round in timechart on Splunk Enterprise. 10-18-2021 07:38 AM
- Posted Re: How do I create a list of Indexes Data & License utilization. And project License usage over time please? Thx a on Splunk Enterprise. 10-18-2021 07:31 AM
- Got Karma for Re: How would I stop and restart my UF and HF. 10-09-2021 02:26 PM
- Posted Re: How would I stop and restart my UF and HF on Splunk Search. 10-08-2021 11:07 PM
- Got Karma for Re: Check a field. 10-08-2021 07:52 AM
- Posted Re: Showing mean() and avg() side by side on Splunk Search. 10-08-2021 07:33 AM
- Posted Re: Check a field on Splunk Search. 10-08-2021 07:22 AM
- Posted Re: Showing mean() and avg() side by side on Splunk Search. 10-08-2021 07:15 AM
- Posted Re: Need to extract aws-region from host name on Splunk Search. 10-06-2021 02:12 PM
- Got Karma for Re: Does Splunk support chatbot? Is it possible to have a chatbot answering using Splunk search?. 10-01-2021 07:39 PM
- Posted Re: help to display 0 in single panel if no results on Splunk Enterprise. 10-01-2021 01:47 PM
- Got Karma for Re: Extracting a field in quotes with regex. 10-01-2021 08:57 AM
- Got Karma for Re: how to expand multiple ip addresses on more fields?. 10-01-2021 08:26 AM
- Posted Re: Extracting a field in quotes with regex on Splunk Search. 10-01-2021 08:18 AM
- Posted Re: Extract fields from CSV log file without header on Getting Data In. 09-30-2021 08:48 AM
- Posted Re: Need a regex improvement on Splunk Search. 09-29-2021 11:46 AM
- Posted Re: Need a regex improvement on Splunk Search. 09-29-2021 11:27 AM
- Got Karma for Re: Pull list of user accounts with last logon. 09-28-2021 01:28 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
10-25-2021
07:16 AM
@PickleRick Please try the below query: index="_internal" source=*access.log user!="-" */app/*
| rex "\/en\-US\/app\/(?<app>\w+)\/(?<dashboard>\w+)"
| search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="alert" dashboard!="dashboards" dashboard!="reports" dashboard!="report" dashboard!="overview"
| search dashboard="*"
| bucket span=1m _time
| stats count sparkline max(_time) as lastaccess earliest(_time) as StartTime by user
| eval avg=count/5
| convert ctime(lastaccess) ctime(StartTime)
| sort -lastaccess
| rename user as "User" lastaccess as "Last accessed on" count as "No. of times accessed" avg as "Weekly Avg." StartTime as "First accessed on" Also if this reply helped you an up vote will be appreciated
... View more
10-18-2021
07:38 AM
@jip31 Please try using the below code: index=tutu
| timechart avg(web_duration_ms) as ResponseTime by Url
| eval ResponseTime=round(ResponseTime, 3) Also, if this reply helped you a thumbs up would be appreciated.
... View more
10-18-2021
07:31 AM
@SamHTexas Below dashboard code can be useful for you: <form>
<label>License Usage Monitor</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<single>
<title>Today's License Usage In Bytes</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) | rename poolsz as "Daily License Quota" sum(b) as "Daily License Quota Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>alhost/<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x604E8F","0x604E8F"]</option>
<option name="rangeValues">[0]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">BYTES</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
<row>
<panel>
<input type="radio" searchWhenChanged="true" token="NumberOfDays">
<label>SELECT TIMESPAN:</label>
<choice value="0">Today</choice>
<choice value="6">Last 7 Days</choice>
<choice value="13">Last 14 Days</choice>
<choice value="29">Last 30 Days</choice>
<choice value="89">Last 90 Days</choice>
<default>6</default>
<initialValue>6</initialValue>
</input>
<chart>
<title>Daily License Quota Usage in TB's</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | rename _time as Date | eval Date=strftime(Date, "%m-%d-%y") | stats sum(b) as ub by Date | eval ub=round(ub/1024/1024/1024/1024,3) | rename ub as "Daily License Quota Used"</query>
<earliest>-$NumberOfDays$d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">TB's Used</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.overlayFields">"Daily License Quota Used"</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>Index Usage - Today - Top 20</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by idx | eval MB's=round(b/1024/1024,2) | rename idx as Index MB's as "MB's Used" | fields Index "MB's Used" | sort 20 - "MB's Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
<panel>
<table>
<title>Index Usage - Today</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by pool idx | eval MBs=round(b/1024/1024,2) | addcoltotals MBs labelfield=idx label="TOTAL MB's USED:" | rename idx as Index pool as "License Pool" MBs as "MB's Used" | fields "License Pool" Index "MB's Used" | sort - "MB's Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Index">
<colorPalette type="map">{"TOTAL MB's USED:":#604E8F}</colorPalette>
</format>
</table>
</panel>
</row>
<row>
<panel>
<chart>
<title>SourceType Usage - Today - Top 20</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by st | eval MB's=round(b/1024/1024,2) | rename st as SourceType MB's as "MB's Used" | fields SourceType "MB's Used" | sort 20 - "MB's Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
<panel>
<table>
<title>SourceType Usage - Today</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by pool st idx | eval MBs=round(b/1024/1024,2) | addcoltotals MBs labelfield=st label="TOTAL MB's USED:" | rename pool as "License Pool" st as SourceType idx as Index MBs as "MB's Used" | fields "License Pool" SourceType Index "MB's Used" | sort - "MB's Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="SourceType">
<colorPalette type="map">{"TOTAL MB's USED:":#604E8F}</colorPalette>
</format>
</table>
</panel>
</row>
<row>
<panel>
<chart>
<title>SourceType Usage - Last 7 Days</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | eval MBs=round(b/1024/1024,2) | timechart sum(MBs) by st</query>/run/media/draesner/USB30FD<earliest>-6d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">MB's</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</form> Also, if this reply helped you a thumbs-up would be appreciated!
... View more
10-08-2021
11:07 PM
1 Karma
@malekmo First of all for both UF & HF the process is same. First login to your linux instance via CLI. Now change ownership to splunk user. Go to bin directory of your splunk, in most common cases the path will be /opt/splunk/bin. If you don't remember the path of where your splunk is installed you can use the below command to check it: echo $SPLUNK_HOME Now to to splunk/bin directory and check the splunk status using below commands. ./splunk status If splunk is already running you can directly restart it using below command. ./splunk restart If splunk is not running you need to start your service by using below command. ./splunk start Now again check the splunk status by using the above status command and check if the splunk is running. That's all you need to do for a restart. Also if this reply helped you a thumbs-up would be appreciated.
... View more
10-08-2021
07:33 AM
@Gunnar Try this once: | eventstats avg(Capacity) as Avg_Capacity
| stats mean(Capacity) as Mean_Capacity
| table Avg_Capacity Mean_Capacity
... View more
10-08-2021
07:22 AM
1 Karma
@graziaedu Try using the below command: | rex field=field_name "\/\w+\/\w+\/(?P<field_name>.*?)\/" NOTE: Change the field_name in the above command with your field name. Also, If this reply helps you a thumbs-up would be appreciated.
... View more
10-08-2021
07:15 AM
@Gunnar Try using the below one: | stats avg(Capacity) as Avg_Capacity mean(Capacity) as Mean_Capacity OR | chart avg(Capacity) as Avg_Capacity mean(Capacity) as Mean_Capacity Also, If this reply helps you, a thumbs-up would be appreciated.
... View more
10-06-2021
02:12 PM
@smaran06 Try using the below command: | rex field=host "\.\w+.\d+.\d+.\d+.\d+.(?P<aws_region>.*)" Also, If this reply helps you, an upvote would be appreciated.
... View more
10-01-2021
01:47 PM
@PickleRick i think there is a correction in your eval: | eval ar=if(cr=1,0,ar) Also, If this reply helps you, an upvote would be appreciated.
... View more
10-01-2021
08:18 AM
1 Karma
@mkulicke Try using the below rex: | rex field=_raw "x-client-id\"\:\[\"(?P<client_id>\d+)" Also, If this reply helps you, an upvote would be appreciated.
... View more
09-30-2021
08:48 AM
@kvnpichon This post can help you please take a look: https://blog.avotrix.com/different-ways-to-remove-headers-in-splunk/ Also, If this reply helps you, an upvote would be appreciated.
... View more
09-29-2021
11:46 AM
@tinylund Please try using the below rex: | rex field=_raw "RPC-tx-(?P<dscvIP>.*?)\s" Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
01:22 PM
1 Karma
@ctaylor3819 Try using the below query for the date and time: eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681)
| stats latest(_time) as Latest_Time by Logon_Account
| convert ctime(Latest_Time) In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users. Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
08:35 AM
@saad Check if this works ? Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
08:23 AM
@saad Try using this: [monitor:////hboprod/itdept/jira/domain/logs/access_log*.*]
... View more
09-28-2021
08:16 AM
@saad You can use the below stanza: [monitor:////hboprod/itdept/jira/domain/logs/*.<file_extension>] You need to add the file extension and rest all remains the same. Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
07:44 AM
2 Karma
@PickleRick Yes tstats wont work in all the environments, yet if you need this can help: | tstats latest(_indextime) WHERE index=* BY index Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
07:41 AM
@PickleRick Here is the official link from splunk where the list of all the special characters are mentioned, Also the "equal to" sign is present: https://docs.splunk.com/Documentation/StyleGuide/current/StyleGuide/Specialcharacters Also, If this reply helps you, an upvote would be appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
