Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About biec1
biec1
Explorer
Member since:
12-14-2016
06-05-2020
Community Statistics
| Posts | 32 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 12-14-2016 |
Activity Feed
- Got Karma for Slack Webhook Alert. 06-05-2020 12:49 AM
- Posted Re: Slack Webhook Alert on All Apps and Add-ons. 06-08-2018 02:37 AM
- Posted Re: Slack Webhook Alert on All Apps and Add-ons. 06-07-2018 05:30 AM
- Posted Slack Webhook Alert on All Apps and Add-ons. 06-04-2018 11:44 PM
- Posted Slack Webhook Alert on All Apps and Add-ons. 05-30-2018 03:44 AM
- Tagged Slack Webhook Alert on All Apps and Add-ons. 05-30-2018 03:44 AM
- Posted Access JSON data on Getting Data In. 10-04-2017 06:45 AM
- Tagged Access JSON data on Getting Data In. 10-04-2017 06:45 AM
- Tagged Access JSON data on Getting Data In. 10-04-2017 06:45 AM
- Posted Splunk query. on Splunk Search. 05-03-2017 08:03 AM
- Tagged Splunk query. on Splunk Search. 05-03-2017 08:03 AM
- Posted Re: Format table columns for the values starting with minus(-). on Dashboards & Visualizations. 04-24-2017 07:07 AM
- Posted Re: Format table columns for the values starting with minus(-). on Dashboards & Visualizations. 04-24-2017 06:22 AM
- Posted Re: Unbale to view D3 Bubble Chart when i copy the files to different app. on All Apps and Add-ons. 04-24-2017 06:02 AM
- Posted Format table columns for the values starting with minus(-). on Dashboards & Visualizations. 04-24-2017 05:56 AM
- Tagged Format table columns for the values starting with minus(-). on Dashboards & Visualizations. 04-24-2017 05:56 AM
- Posted Re: Evaluate multiple events with same data. on Splunk Search. 04-21-2017 10:02 AM
- Posted Re: Evaluate multiple events with same data. on Splunk Search. 04-21-2017 07:11 AM
- Posted Evaluate multiple events with same data. on Splunk Search. 04-21-2017 05:47 AM
- Tagged Evaluate multiple events with same data. on Splunk Search. 04-21-2017 05:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-08-2018
02:37 AM
I am editing through the GUI.
My Splunk query generates the following output. All the hosts in one line. The output is dynamic, the values and the count will vary.
Header
/host1 /host2 /host3 /host4 /host5
My requirement is to show each host in a new line. So that the output looks as below:-
Header
/host1
/host2
/host3
/host4
/host5
... View more
06-07-2018
05:30 AM
With \n i could not get the line brake.
I have used "Line1.\nLine2" and also Line1.\nLine2 in Slack Message of Slack Webhook Alert.
Thank you for the help.
Could you please help.
... View more
06-04-2018
11:44 PM
1 Karma
Hello Experts,
Version : Splunk Enterprise 7.0.2
We have configured alerts from scheduled search which successfully sends alerts to slack.
Using "Slack Webhook Alert" with $result.fieldname$ .
Currently we have a problem of formatting the appearance of message in slack.
Please provide some documents or resources where the formatting in splunk can be done,so that the message looks good in slack.
Thank you.
... View more
- Tags:
- Slack Webhook Alert
05-30-2018
03:44 AM
Hello Experts,
Version : Splunk Enterprise 7.0.2
We have configured alerts from scheduled search which successfully sends alerts to slack.
Using "Slack Webhook Alert" with $result.fieldname$ .
Currently we have a problem of formatting the appearance of message in slack.
Please provide some documents or resources where the formatting in splunk can be done,so that the message looks good in slack.
Thank you.
... View more
10-04-2017
06:45 AM
This is in follow-up to https://answers.splunk.com/answers/578105/help-with-search-to-access-json-data.html#comment-577285
Please find the attached image for sample event.
The query provided by is returning :- ABC.machine_cat:_attributes.ID.ABC.machine_cat
<<FIELD>>
_attributes.ID.ABC.machine_cat
<<MATCHSTR>>
ABC.machine_cat
I want ABC.machine_cat : <<VALURE of the machine_cat>>
Example: ABC.machine_cat : 01
... View more
05-03-2017
08:03 AM
I would like to count the number of times a Server went down, based on up/down state field.
State field receives up or down for each server every five minutes.
index=live_index source="rest:" state=*
| stats latest(state) as state by hostname
| eval host_status = if(state=="up",0,1)
| join hostname[search index=temp_index | stats latest(host_status) as server_down latest(down_count) as down_count by hostname]
| where host_status!=server_down
| eval down_count=down_count+1
| fields hostname host_status down_count
I am reading the live events from live_index and comparing the host_status with the previous host_status that are stored in temp_index .
When ever the state changes, i am incrementing down_count and storing latest hostname host_status down_count to temp_index .
I am running this query as a scheduled search, so that the results are stored in summary index temp_index .
PROBLEM THAT I HAVE AT PRESENT:-
Whenever the new servers are added OR for the initial run , the fields hostname host_status down_count should be created and populated in temp_index .
Currebtly i am doing this by using the follwing. But when a new server is added or for thr initial run down_count filed and hostname host_status fields needs to be created. Pls provide me a way to create these fields, so that i can use them in the first query.
index=live_index source="rest:" state=*
| stats latest(state) as state by hostname
| eval host_status = if(state=="up",0,1)
| eval down_count=host_status
| fields hostname host_status down_count
SAMPLE DATA:-
Time| hostname|State
3:00 AM Host1 up
3:00 PM Host2 down
3:05 PM Host1 up
3:10 PM Host1 up
3:15 PM Host1 down
3:15 PM Host2 up
3:20 PM Host1 up
3:25 PM Host1 down
3:30 PM Host1 up
3:35 PM Host1 up
3:40 PM Host1 down
3:45 PM Host1 down
3:50 PM Host1 down
3:55 PM Host1 up
4:00 PM Host1 up
... View more
- Tags:
- splunkenterprise
04-24-2017
07:07 AM
Splunk does not show any affect when i assign negative values with wild card(-*).
Color changes only if i enter the complete negative value(-18.25). I want it to be working for all the negative values.
The following is the requirement for second query:-
For the earliest , i am able to provide time by first time picker.
For enddaysago , i couldn't use the second time picker. Its give some error.
I don't have the option of creating an addiotnal index.
index=index_name host=host_name earliest=-10m
| eval fs=fs_name
| stats first(eval(round(d_free/1024/1024,2))) as free first(eval(round(d_total/1024/1024,2))) as total by fs
| eval used=total-free
| join fs[index=index_name host=host_name enddaysago=30
| eval fs=fs_name
| stats first(eval(round(d_free/1024/1024,2))) as free first(eval(round(d_total/1024/1024,2))) as total by fs
| eval used_old=total-free]
| eval growth=used-used_old
... View more
04-24-2017
06:22 AM
Hi Giuseppe,
Thank you.
how do you want to format columns with minus? are you speaking about negative numbers?
I want to assign some color to negative values.
'what is enddaysago: a value in eval or in a search? are you speaking of a search of a dashboard?'
In the dashboard i have a time range picker with token name oldest_tkn . I want to use it in dashboard search query as enddaysago=$oldest_tkn.earliest$ or enddaysago=$oldest_tkn.latest$
... View more
04-24-2017
06:02 AM
Thank you.
Punchcard Custom Visualization is not suitable for the requirement.
Calendar Heat Map custom visualization view is suitable. But the problem is that each block in the Heat map represents a time frame. Instead of time frame, each block should represent one server and it should change color based on the values we supply.
... View more
04-24-2017
05:56 AM
Q1. I would like to format table columns for the values starting with minus(-).
Q2. Use Time range picker token for enddaysago in query.
enddaysago=$token.earliest$ or enddaysago=$token.latest$ is not working.
... View more
- Tags:
- splunk-enterprise
04-21-2017
07:11 AM
How can this help me to get the number of the times the server went down in a week?
index=index_names source="rest://" (server="host1" OR server="host2")
| stats latest(_time) as Time values(server_state) as status by server _time
| dedup server status
... View more
04-21-2017
05:47 AM
I would like to count the number of times a Server went down based on up/down status field.
How can i evaluate multiple(continuous) down into one down status, when i am receiving events every five minutes?
Multiple(continuous) down for one host should be treated as one down .
Time| Server |Status
3:00 AM Host1 up
3:00 PM Host2 down
3:05 PM Host1 up
3:10 PM Host1 up
3:15 PM Host1 down
3:15 PM Host2 up
3:20 PM Host1 up
3:25 PM Host1 down
3:30 PM Host1 up
3:35 PM Host1 up
3:40 PM Host1 down
3:45 PM Host1 down
... View more
- Tags:
- splunk-enterprise
04-21-2017
05:10 AM
I am not using bubble chart anymore. Its not suitable for my requirement.
I want to show heat map of the host field, based on the result of var1 .
If var1 returns 1 for particular host , the heat map should show red block with host name.
If var1 returns 0 for particular host , the heat map should show green block with host name.
I could not find the examples in this app suitable for this.
index=index_name earliest=-15m@s
| stats latest(_time) as Time avg(cpu_total) as cpu_usage by host _time
| eval var1=if(cpu_usage > 10,1,0)
| where var1 == 1
| sort 0 -_time
| dedup host
| table Time host cpu_usage
... View more
04-20-2017
10:00 AM
After making the mentioned changes, the bubble chart is showing the values in the format processor:hits in plain text.
This plain text is colored based on the values of name .
But the bubbles(Circles) are not getting showed.
Splunk has been restarted.
Query:-
| stats latest(usage) as hits by name,processor
... View more
