Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ravinallaparedd
ravinallaparedd
New Member
Member since:
11-30-2016
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-30-2016 |
Activity Feed
- Posted Re: How to find value from lookup table dynamically by matching substring in field value? on Splunk Search. 12-12-2016 02:21 AM
- Posted Re: How to find value from lookup table dynamically by matching substring in field value? on Splunk Search. 12-08-2016 03:28 AM
- Posted How to find value from lookup table dynamically by matching substring in field value? on Splunk Search. 12-07-2016 02:23 AM
- Tagged How to find value from lookup table dynamically by matching substring in field value? on Splunk Search. 12-07-2016 02:23 AM
- Tagged How to find value from lookup table dynamically by matching substring in field value? on Splunk Search. 12-07-2016 02:23 AM
- Tagged How to find value from lookup table dynamically by matching substring in field value? on Splunk Search. 12-07-2016 02:23 AM
- Tagged How to find value from lookup table dynamically by matching substring in field value? on Splunk Search. 12-07-2016 02:23 AM
- Tagged How to find value from lookup table dynamically by matching substring in field value? on Splunk Search. 12-07-2016 02:23 AM
- Posted Re: How to write a search to merge and display data from two events in a single line? on Splunk Search. 12-02-2016 03:34 AM
- Posted Re: How to calculate the sum of selected values by excluding other values in a multivalue field? on Splunk Search. 12-02-2016 03:32 AM
- Posted Re: How to calculate the sum of selected values by excluding other values in a multivalue field? on Splunk Search. 12-01-2016 05:32 AM
- Posted How to write a search to merge and display data from two events in a single line? on Splunk Search. 12-01-2016 04:41 AM
- Tagged How to write a search to merge and display data from two events in a single line? on Splunk Search. 12-01-2016 04:41 AM
- Tagged How to write a search to merge and display data from two events in a single line? on Splunk Search. 12-01-2016 04:41 AM
- Tagged How to write a search to merge and display data from two events in a single line? on Splunk Search. 12-01-2016 04:41 AM
- Posted How to calculate the sum of selected values by excluding other values in a multivalue field? on Splunk Search. 11-30-2016 11:58 PM
- Tagged How to calculate the sum of selected values by excluding other values in a multivalue field? on Splunk Search. 11-30-2016 11:58 PM
- Tagged How to calculate the sum of selected values by excluding other values in a multivalue field? on Splunk Search. 11-30-2016 11:58 PM
- Tagged How to calculate the sum of selected values by excluding other values in a multivalue field? on Splunk Search. 11-30-2016 11:58 PM
- Tagged How to calculate the sum of selected values by excluding other values in a multivalue field? on Splunk Search. 11-30-2016 11:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
12-12-2016
02:21 AM
Hi Sundareshr,
| inputlookup lookupfilename.csv | map search="search index=foo sourcetype=bar ErrorMessage=\"$key$\" | eval Value=\"$value$\" " | eval MatchString="$key$" | table SNo ErrorMessage MatchString Value"
The above syntax gives results only where there are mapping key -value pair, for example index=foo contains 100 records, the above syntax gives only mapping results assuming if 75 records are mapped with key with ErrorMessage then 75 records will get populate, the remain records will be ignored.
inputlookup command to be used in the first place of search string and it can't support to use in the middle for search string. In the below example, it gives 100 records of which 75 records contains mapping key-value and the remaining records are still to be populate with blank in the corresponding Value field.
For example :
index="sample_data_index"|reverse |streamstats current=f last(LogDate) as LogDate last(ErrorMessage ) as ErrorMessage last(AppID) as AppID by incident_number|table incident_number LogDate AppID ErrorMessage Value ( Value - this has to get populate from lookup table with mapping string for ErrorMessage)
The above search string contains 100 records, while using inputlookup after mapping ErrorMessage with corresponding Key-Value from lookup file, search string has to return 100 records, with additional column as Value where it fetches data from lookup field wherever finds match string.
Thanks in advance for helping.
Regards,
Ravi
... View more
12-08-2016
03:28 AM
Hello Sundareshr,
thanks for your solution, it is working fine.
Regards,
Ravi
... View more
12-07-2016
02:23 AM
Hi,
I would like to know how to find value from lookup table dynamically by matching string in field value.
For example :
SNo - ErrorMessage
1.Unable to access One Corp
2.FileSystem_HighUtilization Server: ALL128, Issue:(B)ase, Severity:P2, per E&N
3.TEN -Safari-STA SAT(Audio)
1. MBT GOLD CLOUD MAXSOFT ALERT io's are identical) 12345
Lookup table:
Key-----value
FileSystem ---- Application Problem
Safari ---- Browser Problem
CLOUD ---- Server Issue
access----Login Issue
The query to read tokes from field value and then find match string which are defined in the lookup table and then get corresponding value from lookup table.
Below is expected out put :
SNo----ErrorMessage ----MatchingString (key from lookup table)----Value (corresponding value of key from lookup table)
1 ---- Unable to access One Corp ----access----Login Issue
2 ----- FileSystem_HighUtilization Server: ALL128, Issue:(B)ase, Severity:P2, per E&N -----FileSystem----Application Problem
3 ---- TEN -Safari-STA SAT(Audio)-----Safari----Browser Problem
4 -----MBT GOLD CLOUD MAXSOFT ALERT io's are identical) 12345 ----CLOUD---Server Issue
Can you please help how to frame the query for the above scenario.
Thanks in Advance,
Regards,
Ravi
... View more
12-02-2016
03:34 AM
Thank you.
I got the solution, it can be done through either stats or streams tats.
Regards,
Ravi
... View more
12-02-2016
03:32 AM
Hello Rich, Sundareshr,
I got the solution from inputs which you provided.
Thank you very much.
Regards,
Ravi
... View more
12-01-2016
05:32 AM
Hi Rich,
Thanks for quick response.
By excluding the pending time, do you mean to exclude the time between two consecutive events if the earliest event of the pair is a "Pending?" Like this group which is worth about 4.5 hours
Yes, excluding the pending times which occurs multiple times for an incident.If the earliest event of the pair is "Pending" then calculate the time difference with next immediate status and then exclude the time in consolidate time( i.e Ticket Closed Time - Ticket Open Time ).
Example:
Ticket Opened - 12-01-2016 :01:0:0
Ticket In Progress-12-01-2016:03:0:0
Ticket Pending - 12-01-2016:08:0:0
Ticket In Progress - 12-01-2016:12:0:0
Ticket Assigned - 12-01-2016:14:0:0
Ticket Pending-12-01-2016 16:0:0
Ticket In Progress -12-01-2016 18:0:0
Ticket Pending 12-01-2016 20:0:0
Ticket In Progress -12-01-2016 :22:0:0
Ticket Closed - 12-01-2016 24.:0:0
Total Time - ( 12-01-2016 24.:0:0 ,12-01-2016 :01:0:0) ->23 hrs
Pending time - (12-01-2016:12:0:0 ,12-01-2016:08:0:0)->4hrs
Pending time - (12-01-2016 18:0:0 ,12-01-2016 16:0:0)->2hrs
Pending time - (12-01-2016:22:0:0 ,12-01-2016 20:0:0)->2hrs
Total Pending time - 4+2+2 ->8
Actual Time = Total Time - Pending Time
Actual Time = 23 -8 ->15 hrs
Regards,
Ravi
... View more
12-01-2016
04:41 AM
Hello,
I would like to merge two events with a search to display both events' data in single line. Refer the below example ticket data:
Datamodel -> RowNumber,TicketNo,Ticket_Status,Owner,Date
Event#1 -> 1,INC10001,Assigned,GroupA,12-01-2016
Event#2 -> 2,INC10002,Resolved,GroupB,12-02-2016
Output -> RowNumber_1,TicketNo_1, Ticket_Status_1 Owner_1,Date_1,RowNumber_2,TicketNo_2, Ticket_Status_2 Owner_2,Date_2
Single Event->1,INC10001,Assigned,GroupA,12-01-2016, 2,INC10002,Resolved,GroupB,12-02-2016
... View more
11-30-2016
11:58 PM
Hello,
I would like to know how to calculate sum of selected values by excluding other values in a multivalue field.
Refer to the below ticket data sample. A ticket contains different status such as Created, Assigned, In Progress, Pending, Resolved, Closed, and some of the statuses are repeated and each row is associated with a timestamp when the ticket got updated with a different status.
I would like to calculate the actual Ticket time by excluding pending hours in the below sample data. If the total time taken for ticket closed is 100 hrs and out 100 hrs there are 25hrs pending status then the actual time taken for ticket closed is 75hrs.
TicketNum Description Group Owner Status Date
INC200039404 No Access Group A XYZ, Created, Sep 9, 2016 3:42:53 AM
INC200039404 No Access Group B Sep 9, 2016 4:31:07 AM
INC200039404 No Access In Progress Sep 9, 2016 3:11:15 PM
INC200039404 No Access Resolved Sep 9, 2016 3:12:47 PM
INC200039404 No Access Closed Sep 15, 2016 6:05:16 AM
INC200039404 No Access Group C Assigned Sep 9, 2016 2:48:45 AM
INC200039404 No Access Pending Sep 9, 2016 2:52:21 AM
INC200039404 No Access Assigned Sep 9, 2016 7:18:07 PM
INC200039404 No Access In Progress Sep 9, 2016 7:19:05 PM
INC200039404 No Access Pending Sep 9, 2016 8:30:21 PM
INC200039404 No Access In Progress Sep 9, 2016 8:43:40 PM
INC200039404 No Access Pending Sep 9, 2016 8:44:33 PM
INC200039404 No Access In Progress Sep 9, 2016 9:00:45 PM
INC200039404 No Access Pending Sep 9, 2016 9:01:34 PM
INC200039404 No Access In Progress Sep 9, 2016 9:43:03 PM
INC200039404 No Access Group A Assigned Sep 9, 2016 9:46:17 PM
INC200039404 No Access Sep 9, 2016 9:48:49 PM
INC200039404 No Access Closed Sep 9, 2016 10:04:45 PM
Thanks in Advance,
Regards,
Ravi
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
