Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About biec1
biec1
Explorer
Member since:
12-14-2016
06-05-2020
Community Statistics
| Posts | 32 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 12-14-2016 |
Activity Feed
- Got Karma for Slack Webhook Alert. 06-05-2020 12:49 AM
- Posted Re: Slack Webhook Alert on All Apps and Add-ons. 06-08-2018 02:37 AM
- Posted Re: Slack Webhook Alert on All Apps and Add-ons. 06-07-2018 05:30 AM
- Posted Slack Webhook Alert on All Apps and Add-ons. 06-04-2018 11:44 PM
- Posted Slack Webhook Alert on All Apps and Add-ons. 05-30-2018 03:44 AM
- Tagged Slack Webhook Alert on All Apps and Add-ons. 05-30-2018 03:44 AM
- Posted Access JSON data on Getting Data In. 10-04-2017 06:45 AM
- Tagged Access JSON data on Getting Data In. 10-04-2017 06:45 AM
- Tagged Access JSON data on Getting Data In. 10-04-2017 06:45 AM
- Posted Splunk query. on Splunk Search. 05-03-2017 08:03 AM
- Tagged Splunk query. on Splunk Search. 05-03-2017 08:03 AM
- Posted Re: Format table columns for the values starting with minus(-). on Dashboards & Visualizations. 04-24-2017 07:07 AM
- Posted Re: Format table columns for the values starting with minus(-). on Dashboards & Visualizations. 04-24-2017 06:22 AM
- Posted Re: Unbale to view D3 Bubble Chart when i copy the files to different app. on All Apps and Add-ons. 04-24-2017 06:02 AM
- Posted Format table columns for the values starting with minus(-). on Dashboards & Visualizations. 04-24-2017 05:56 AM
- Tagged Format table columns for the values starting with minus(-). on Dashboards & Visualizations. 04-24-2017 05:56 AM
- Posted Re: Evaluate multiple events with same data. on Splunk Search. 04-21-2017 10:02 AM
- Posted Re: Evaluate multiple events with same data. on Splunk Search. 04-21-2017 07:11 AM
- Posted Evaluate multiple events with same data. on Splunk Search. 04-21-2017 05:47 AM
- Tagged Evaluate multiple events with same data. on Splunk Search. 04-21-2017 05:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-08-2018
02:37 AM
I am editing through the GUI.
My Splunk query generates the following output. All the hosts in one line. The output is dynamic, the values and the count will vary.
Header
/host1 /host2 /host3 /host4 /host5
My requirement is to show each host in a new line. So that the output looks as below:-
Header
/host1
/host2
/host3
/host4
/host5
... View more
06-07-2018
05:30 AM
With \n i could not get the line brake.
I have used "Line1.\nLine2" and also Line1.\nLine2 in Slack Message of Slack Webhook Alert.
Thank you for the help.
Could you please help.
... View more
06-04-2018
11:44 PM
1 Karma
Hello Experts,
Version : Splunk Enterprise 7.0.2
We have configured alerts from scheduled search which successfully sends alerts to slack.
Using "Slack Webhook Alert" with $result.fieldname$ .
Currently we have a problem of formatting the appearance of message in slack.
Please provide some documents or resources where the formatting in splunk can be done,so that the message looks good in slack.
Thank you.
... View more
- Tags:
- Slack Webhook Alert
05-30-2018
03:44 AM
Hello Experts,
Version : Splunk Enterprise 7.0.2
We have configured alerts from scheduled search which successfully sends alerts to slack.
Using "Slack Webhook Alert" with $result.fieldname$ .
Currently we have a problem of formatting the appearance of message in slack.
Please provide some documents or resources where the formatting in splunk can be done,so that the message looks good in slack.
Thank you.
... View more
10-04-2017
06:45 AM
This is in follow-up to https://answers.splunk.com/answers/578105/help-with-search-to-access-json-data.html#comment-577285
Please find the attached image for sample event.
The query provided by is returning :- ABC.machine_cat:_attributes.ID.ABC.machine_cat
<<FIELD>>
_attributes.ID.ABC.machine_cat
<<MATCHSTR>>
ABC.machine_cat
I want ABC.machine_cat : <<VALURE of the machine_cat>>
Example: ABC.machine_cat : 01
... View more
05-03-2017
08:03 AM
I would like to count the number of times a Server went down, based on up/down state field.
State field receives up or down for each server every five minutes.
index=live_index source="rest:" state=*
| stats latest(state) as state by hostname
| eval host_status = if(state=="up",0,1)
| join hostname[search index=temp_index | stats latest(host_status) as server_down latest(down_count) as down_count by hostname]
| where host_status!=server_down
| eval down_count=down_count+1
| fields hostname host_status down_count
I am reading the live events from live_index and comparing the host_status with the previous host_status that are stored in temp_index .
When ever the state changes, i am incrementing down_count and storing latest hostname host_status down_count to temp_index .
I am running this query as a scheduled search, so that the results are stored in summary index temp_index .
PROBLEM THAT I HAVE AT PRESENT:-
Whenever the new servers are added OR for the initial run , the fields hostname host_status down_count should be created and populated in temp_index .
Currebtly i am doing this by using the follwing. But when a new server is added or for thr initial run down_count filed and hostname host_status fields needs to be created. Pls provide me a way to create these fields, so that i can use them in the first query.
index=live_index source="rest:" state=*
| stats latest(state) as state by hostname
| eval host_status = if(state=="up",0,1)
| eval down_count=host_status
| fields hostname host_status down_count
SAMPLE DATA:-
Time| hostname|State
3:00 AM Host1 up
3:00 PM Host2 down
3:05 PM Host1 up
3:10 PM Host1 up
3:15 PM Host1 down
3:15 PM Host2 up
3:20 PM Host1 up
3:25 PM Host1 down
3:30 PM Host1 up
3:35 PM Host1 up
3:40 PM Host1 down
3:45 PM Host1 down
3:50 PM Host1 down
3:55 PM Host1 up
4:00 PM Host1 up
... View more
- Tags:
- splunkenterprise
04-24-2017
07:07 AM
Splunk does not show any affect when i assign negative values with wild card(-*).
Color changes only if i enter the complete negative value(-18.25). I want it to be working for all the negative values.
The following is the requirement for second query:-
For the earliest , i am able to provide time by first time picker.
For enddaysago , i couldn't use the second time picker. Its give some error.
I don't have the option of creating an addiotnal index.
index=index_name host=host_name earliest=-10m
| eval fs=fs_name
| stats first(eval(round(d_free/1024/1024,2))) as free first(eval(round(d_total/1024/1024,2))) as total by fs
| eval used=total-free
| join fs[index=index_name host=host_name enddaysago=30
| eval fs=fs_name
| stats first(eval(round(d_free/1024/1024,2))) as free first(eval(round(d_total/1024/1024,2))) as total by fs
| eval used_old=total-free]
| eval growth=used-used_old
... View more
04-24-2017
06:22 AM
Hi Giuseppe,
Thank you.
how do you want to format columns with minus? are you speaking about negative numbers?
I want to assign some color to negative values.
'what is enddaysago: a value in eval or in a search? are you speaking of a search of a dashboard?'
In the dashboard i have a time range picker with token name oldest_tkn . I want to use it in dashboard search query as enddaysago=$oldest_tkn.earliest$ or enddaysago=$oldest_tkn.latest$
... View more
04-24-2017
06:02 AM
Thank you.
Punchcard Custom Visualization is not suitable for the requirement.
Calendar Heat Map custom visualization view is suitable. But the problem is that each block in the Heat map represents a time frame. Instead of time frame, each block should represent one server and it should change color based on the values we supply.
... View more
04-24-2017
05:56 AM
Q1. I would like to format table columns for the values starting with minus(-).
Q2. Use Time range picker token for enddaysago in query.
enddaysago=$token.earliest$ or enddaysago=$token.latest$ is not working.
... View more
- Tags:
- splunk-enterprise
04-21-2017
07:11 AM
How can this help me to get the number of the times the server went down in a week?
index=index_names source="rest://" (server="host1" OR server="host2")
| stats latest(_time) as Time values(server_state) as status by server _time
| dedup server status
... View more
04-21-2017
05:47 AM
I would like to count the number of times a Server went down based on up/down status field.
How can i evaluate multiple(continuous) down into one down status, when i am receiving events every five minutes?
Multiple(continuous) down for one host should be treated as one down .
Time| Server |Status
3:00 AM Host1 up
3:00 PM Host2 down
3:05 PM Host1 up
3:10 PM Host1 up
3:15 PM Host1 down
3:15 PM Host2 up
3:20 PM Host1 up
3:25 PM Host1 down
3:30 PM Host1 up
3:35 PM Host1 up
3:40 PM Host1 down
3:45 PM Host1 down
... View more
- Tags:
- splunk-enterprise
04-21-2017
05:10 AM
I am not using bubble chart anymore. Its not suitable for my requirement.
I want to show heat map of the host field, based on the result of var1 .
If var1 returns 1 for particular host , the heat map should show red block with host name.
If var1 returns 0 for particular host , the heat map should show green block with host name.
I could not find the examples in this app suitable for this.
index=index_name earliest=-15m@s
| stats latest(_time) as Time avg(cpu_total) as cpu_usage by host _time
| eval var1=if(cpu_usage > 10,1,0)
| where var1 == 1
| sort 0 -_time
| dedup host
| table Time host cpu_usage
... View more
04-20-2017
10:00 AM
After making the mentioned changes, the bubble chart is showing the values in the format processor:hits in plain text.
This plain text is colored based on the values of name .
But the bubbles(Circles) are not getting showed.
Splunk has been restarted.
Query:-
| stats latest(usage) as hits by name,processor
... View more
04-20-2017
05:22 AM
Unbale to view D3 Bubble Chart when i copy the files to different app.
I have copied the following files to respective locations to a different splunk instance and to a different app.
I have restarted splunk.
/opt/splunk/etc/apps/simple_xml_examples/appserver/static/components/bubblechart/bubblechart.js
/opt/splunk/etc/apps/simple_xml_examples/appserver/static/components/bubblechart/bubblechart.css
/opt/splunk/etc/apps/simple_xml_examples/appserver/static/components/bubblechart/bower.json
/opt/splunk/etc/apps/simple_xml_examples/appserver/static/autodiscover.js
What should be the path for this?
data-require="splunkjs/mvc/searchmanager"
This path does not exists even in the original example app.
data-require="app/simple_xml_examples/components/bubblechart/bubblechart"
... View more
04-14-2017
03:24 AM
index=index_name earliest=-30m@m latest=now
| stats latest(_time) as _time avg(cpu_usage) as cpu_usage by host
| eval var1=if(cpu_usage > 30,0,1)
| table host var1 cpu_usage _time
This query gets the average cpu utilization for the past 30 minutes.
I would like to create the list of high cpu utilization hosts for the past 12 hours, based on the var1 result of above 30 minutes average.
... View more
- Tags:
- splunk-enterprise
02-28-2017
11:46 PM
The following is the current configuration in our environment. We are getting max_concurrent limit reached on one of the three Search Heads for specific Saved Search. It does not happen on rest of the two Search Heads.
Search Head:- 3x16+10=58
Search Peer :- 1x20+6=26
Is it necessary to maintain identical parameters on both Search peers and Search heads?
Shall i increase max_searches_per_cpu on Search Peers from 1 to 2 ?
... View more
02-28-2017
11:45 PM
The following is the current configuration in our environment. We are getting max_concurrent limit reached on one of the three Search Heads for specific Saved Search. It does not happen on rest of the two Search Heads.
Search Head:- 3x16+10=58
Search Peer :- 1x20+6=26
Is it necessary to maintain identical parameters on both Search peers and Search heads?
Shall i increase max_searches_per_cpu on Search Peers from 1 to 2 ?
... View more
01-27-2017
07:10 AM
Thank you.
But even after three hours of changing the TZ in source type, i don't see any difference in the events time stamp.
... View more
01-27-2017
04:45 AM
Our Splunk server is in UTC time zone,but the Events time zone is in CET.
Current Splunk Server Time:-
Fri Jan 27 12:20:25 UTC 2017
Latest Event Time:-
Fri Jan 27 13:19:35 CET 2017
When i make a search for last 15 minutes,i get the events from 12:05 to 12:20.
But i am expecting the results as per the time stamp of events.
I have changed the Time Zone in source type to UTC. Still i do not see any change.
... View more
- Tags:
- splunk-enterprise
01-25-2017
01:41 AM
Thank you for the appendpipe . I made the following changes as per my requirement. It is working fine now.
Now Success returns 0 , Failure returns 1 , No results found returns 9 .
| eval final = if(status_="exist", 0, 1)
| table final
| appendpipe [stats count| eval final=9 | where count==0 |table final]
| outputlookup output.csv
... View more
01-24-2017
03:16 AM
I am trying to include logic ,so that it can handle No results found .
When No events found ,the following returns 9.
When Events Exist the final field loses its scope after stats .
| eval final = if(count=0,9,final) :- Here the final field becomes inaccessible.
| eval final = if(status_="exist", 0, 1)
| stats count
| eval final = if(count=0,9,final)
| table final
To make final field accessible after stats , i used | stats count by final .
This created additional problem, when the events are present, | stats count by final fails.
| eval final = if(status_="exist", 0, 1)
| stats count by final
| eval final = if(count=0,9,final)
| table final
... View more
01-09-2017
04:40 AM
Events come with the following hard-coded date format.
Wed Aug 23 16:44:28 CEST 2016
Wed Aug 23 16:46:20 CET 2016
In Props.conf settings:-
Timestamp format = %b %d %H:%M:%S CET %Y
Timestamp prefix = \s+\w+\s+
If i use CET or CEST in Timestamp format , the date and time are extracted properly into _time field.
I want to make this generic,so that it works with CET or CEST.
But if i use %Z in the place of CET or CEST, the hours field is not extrached properly into _time field for both CEST and CET.
Timestamp format = %b %d %H:%M:%S %Z %Y
... View more
01-09-2017
03:48 AM
The _time field is not getting proper values when i change the time zone from where i am running my search.
The events comes with the following date format. It has CET or CEST hard-coded in the event.
Wed Aug 23 16:44:28 CEST 2016
Wed Aug 23 16:46:20 CET 2016
In Props.conf settings:-
Timestamp format = %b %d %H:%M:%S CET %Y
Timestamp prefix = \s+\w+\s+
If i use CET or CEST in Timestamp format , the date and time are extracted properly into _time field.
I want to make this generic ,so that it can handle both CET and CEST.
But if i use %Z in the place of CET or CEST, the Hours field in _time is showing wrong hours for both CEST and CET.
Timestamp format = %b %d %H:%M:%S %Z %Y
... View more
