Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About karthikTIL
karthikTIL
Path Finder
Member since:
06-29-2014
06-05-2020
Community Statistics
| Posts | 30 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 9 |
| Member Since | 06-29-2014 |
Activity Feed
- Karma Re: How to write regex to extract three digit numbers from a CSV file and assign the values to a new field? for MuS. 06-05-2020 12:47 AM
- Karma Re: How to find the difference between 2 times in date time format? for tom_frotscher. 06-05-2020 12:47 AM
- Got Karma for How to find the difference between dates only counting business hours?. 06-05-2020 12:47 AM
- Got Karma for How to write regex to extract three digit numbers from a CSV file and assign the values to a new field?. 06-05-2020 12:47 AM
- Got Karma for comparing two csv files having similar fields. 06-05-2020 12:47 AM
- Got Karma for Re: comparing two csv files having similar fields. 06-05-2020 12:47 AM
- Got Karma for How to sort data in chronological order by month, not alphabetically?. 06-05-2020 12:47 AM
- Got Karma for How to sort data in chronological order by month, not alphabetically?. 06-05-2020 12:47 AM
- Got Karma for How to sort data in chronological order by month, not alphabetically?. 06-05-2020 12:47 AM
- Got Karma for How to search for a source file with a timestamp in the name?. 06-05-2020 12:47 AM
- Got Karma for How to find the difference between 2 times in date time format?. 06-05-2020 12:47 AM
- Posted If two CSV files both have FieldA, how do I map FieldB from one of the CSV files to FieldA in the search results? on Splunk Search. 04-14-2015 05:54 PM
- Tagged If two CSV files both have FieldA, how do I map FieldB from one of the CSV files to FieldA in the search results? on Splunk Search. 04-14-2015 05:54 PM
- Posted How to edit my search to get the total count by week and by month? on Splunk Search. 03-23-2015 11:01 PM
- Tagged How to edit my search to get the total count by week and by month? on Splunk Search. 03-23-2015 11:01 PM
- Tagged How to edit my search to get the total count by week and by month? on Splunk Search. 03-23-2015 11:01 PM
- Posted Re: sorting date on Splunk Search. 03-23-2015 07:10 PM
- Posted Re: sorting date on Splunk Search. 02-11-2015 02:38 PM
- Posted Re: sorting date on Splunk Search. 02-11-2015 02:38 PM
- Posted How can I sort data into a graph? on Splunk Search. 02-10-2015 11:19 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 3 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
04-14-2015
05:54 PM
HI,
I have a two CSV files like below
report.csv:
subject,cat
abcd,A-2
efgh,A-4
ijkl,A-4
eng.csv:
cat,Name
A-2,victor
A-4,alpha
My search is: source=report.csv | stats count by cat
The result is:
cat Count
A-2 1
A-4 2
My question is, how do I map the "cat" to "name" as per eng.csv and display count like
cat count
A-2 Victor 1
A-4 alpha 2
Please let me know how to do this
... View more
03-23-2015
11:01 PM
HI,
Below query gives me output as shown below in sorted order
source=abcd.csv| fields Date,count | stats by Date,count | eval Date=strptime(Date, "%d/%m/%Y") | sort Date | eval Date=strftime(Date, "%d/%m/%Y")
Output:
16/03/2015,10
18/03/2015,20
23/03/2015,5
24/03/2015,15
Could you help me in getting total count by week and month?
i.e., I want the count for week ending 22/mar as 30 and week ending 29/mar as 20. Like wise, need for monthly for february/march,etc
... View more
03-23-2015
07:10 PM
HI MuS,
with the above query, is it possible to get total count by week and month?
say,
16/03/2015,10
18/03/2015,20
23/03/2015,5
24/03/2015,15
I want the count for week ending 22/mar as 30 and week ending 29/mar as 20. Like wise, need to monthly for february/march,etc
... View more
02-10-2015
11:19 PM
I have a table like below. Date, count 22/12/2014,9 23/12/2014,19 24/12/2014,16 6/01/2015,4 7/01/2015,7 4/02/2015,42 5/02/2015,17
when i use below query, i don't see date in sorted order in my graph. Could you please help how to get graph in sorted order by date. source=abcd.csv|fields Date,count|stats by Date,count
the output is like below, which is not what i want 22/12/2014,9 23/12/2014,19 24/12/2014,16 4/02/2015,42 5/02/2015,17 6/01/2015,4 7/01/2015,7
... View more
Labels
- Labels:
-
table
11-02-2014
07:21 PM
1 Karma
HI, I have files everyday with timestamp automatically like
report_3nov2014.csv
report_4nov2014.csv
report_5nov2014.csv, etc
Please let me know how do i search file generated today(report_3nov2014.csv) based on timestamp while i search using source="..." command
... View more
09-26-2014
12:35 AM
Thank you, it works
... View more
09-26-2014
12:07 AM
3 Karma
HI,
For my below query, i get months in alphabetical order like april-2014, august-2014, february-2014, January-2014.
But i want this to be sorted like January-2014, February-2014. Please let me know.
source="test.csv"| eval Month=date_month."-".date_year|stats count(Incidents) by Month
... View more
09-17-2014
11:57 PM
HI MuS, is there any update you want to provide please
... View more
09-17-2014
11:51 PM
Thanks MuS, it worked now.
actually i specified field in my query earlier, but it was not displayed in my query above:)
... View more
09-17-2014
10:58 PM
HI MuS,
sorry, i forgot to add.
All my words occur after "Title #:"
e.g. Title #: df 654
so i used,
your base search here | rex "Title #:(?\d{3})" | ...
but it did not give any result
... View more
09-17-2014
09:57 PM
1 Karma
HI,
I have source file test.csv which has words like "abc-234 " , "456", "df 654", "er567 -ly".
In all the above words, i want to take only three digit numbers and assign to a field called "eng".
Please let me know how would be the regular expression would be?
... View more
09-17-2014
01:00 AM
test1.csv has fields ->name,start time,end time,total_time,date_month
test2.csv has fields->name,No_of_Person,lost_time
What i require is, if date_month=september from test1.csv and 'name' from test1.csv ='name' from test2.csv,then A=total_time*No_of_Person*lost_time, where 'A' is a new field i want to create.
... View more
09-16-2014
06:10 PM
HI,
I have two files, test1.csv and test2.csv.
I want to do some arithmetic calculation involving fields from both files test1.csv and test2.csv.
Also, i want to use only september month data from test1.csv.Please let me know how to involve both files in a single query to cter to my requirement.
test1.csv has fields ->name,start time,end time,total_time,date_month
test2.csv has fields->name,No_of_Person,lost_time
What i require is, if date_month=september from test1.csv and 'name' from test1.csv ='name' from test2.csv,then A=total_time*No_of_Person*lost_time, where 'A' is a new field i want to create.
... View more
- Tags:
- csv
- inputlookup
- lookup
09-10-2014
09:43 PM
HI, I have a file called file1.csv whose fields are start_time,close_time
start_time close_time
22/08/2014 3:00:08 PM 26/08/2014 4:50:32 PM
25/08/2014 5:54:53 PM 26/08/2014 1:28:55 PM
25/08/2014 3:30:03 PM 27/08/2014 5:04:57 PM
i want to create third field which would be total_time, whose value will be (close_time) - (start_time).But while finding the total_time, i want splunk to give me total business time only
i.e., from 9AM to 5PM and monday to Friday
SO total_time for above three examples would be 17.50,4:28 and 9:30 respectively.
Kindly let me knwo what would be the Query in splunk to get the above result.Thank you.
... View more
09-10-2014
06:58 PM
Sorry, it did not work.
If start_time = 26/08/2014 3:23:29 PM and close_time=27/08/2014 12:15:18 PM , your query gives me total_time=20.86 hours, whereas i expect close_time = 4.52hours.
Not sure if converting epoch time is culprit here.Or am i doing something wrong here?
... View more
09-09-2014
09:43 PM
HI MuS, Thank you. i got your point but don't know how exactly to include your statement in my query,Could you please le tme know.
My current query is,
source="file.csv" date_month=august|eval epoch_A=strptime('start_TIME',"%d/%m/%Y %I:%M:%S %p") | eval epoch_B=strptime('close_TIME',"%d/%m/%Y %I:%M:%S %p") | eval total_TIME=(('epoch_B'-'epoch_A') / 3600)|table start_TIME,close_TIME,total_TIME
It converts close_time and start_time into epoch time and find the difference(24 hours day).Please let me know how to include your statement above to get total working hours.
... View more
09-09-2014
12:42 AM
HI MuS, I guess the above will give events which started between 8 and 18 hrs. what i am after is,when i calculate difference between close time and start time, i need to consider only from 9 AM to 5 PM
e.g., start time=8/09/2014 9AM; end time= 9/09/2014 10AM
when i do end time- start time, it should be 9 hrs
... View more
09-08-2014
09:11 PM
1 Karma
HI,I have two fields A and B with time format as 1/07/2014 3:41:12 PM.
e.g., if A is 1/07/2014 3:41:12 PM and B is 15/07/2014 2:41:12 PM.
To find difference i know we need to use,
"eval epoch_A=strptime('Field A',"%d/%m/%Y %I:%M:%S %p") | eval epoch_B=strptime('Field B',"%d/%m/%Y %I:%M:%S %p") | eval diff=round(('epoch_B'-'epoch_A') / 3600)|table diff"
Please let me know how to find difference in hours, taking into account only business hours i.e., from 9AM to 5PM and excluding Saturday,Sunday,Public Holiday.
... View more
09-08-2014
08:59 PM
HI, is there a way in splunk to get the difference only on the business hours i.e., from 9AM to 5PM and excluding saturday,sunday,public holidays?
... View more
08-28-2014
06:15 PM
Excellent,Thanks Tom
... View more
08-28-2014
12:57 AM
I dont find output when i mention this
"eval epoch_A=strptime("Assigned_TIME","%d/%m/%Y %I:%M:%S %p") | eval epoch_B=strptime("In Progress_TIME","%d/%m/%Y %I:%M:%S %p") | eval diff=round(('epoch_B'-'epoch_A') / 3600)|table diff"
fyi., A is Assigned_Time and B is In Progress_Time
... View more
08-28-2014
12:12 AM
1 Karma
HI, I have two fields A and B with time format as 1/07/2014 3:41:12 PM.
Please let me know how to find difference between A and B in hours with this format?
e.g., if A is 1/07/2014 3:41:12 PM and B is 2/07/2014 2:41:12 PM, B-A should be 23 hours
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
