Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About twh1
twh1
Communicator
Member since:
12-14-2016
06-05-2020
Community Statistics
| Posts | 80 |
| Solutions | 6 |
| Karma Given | 12 |
| Karma Received | 2 |
| Member Since | 12-14-2016 |
Activity Feed
- Karma [BUG] Why SPLUNK Dashboard export PDF resolves Tokens but Scheduled PDF does not for arayapati83. 06-05-2020 12:49 AM
- Karma Re: User a token with where and like for tiagofbmm. 06-05-2020 12:49 AM
- Karma Re: How do you change the cell color based on partial value? for mayurr98. 06-05-2020 12:49 AM
- Karma Add yesterday's date to scheduled report email subject for cnicholls. 06-05-2020 12:48 AM
- Karma Re: Display Date on Dashboard panel for niketn. 06-05-2020 12:48 AM
- Got Karma for What is the difference between a Pivot and a report?. 06-05-2020 12:48 AM
- Got Karma for How to track the editing history of a dashboard?. 06-05-2020 12:48 AM
- Karma Re: Field Extraction from space-aligned fields in multi-line events for landen99. 06-05-2020 12:47 AM
- Karma Re: single search multiple table in splunk? for MoorthyRajendra. 06-05-2020 12:47 AM
- Karma How to collect Apache logs in Splunk without a forwarder? for sloshburch. 06-05-2020 12:47 AM
- Karma Re: Compare a date field with current date for reed_kelly. 06-05-2020 12:46 AM
- Karma Re: Merge two fields into one field for lguinn2. 06-05-2020 12:46 AM
- Karma Re: limit timechart average values to two places for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: Show result of multiple queries as rows of single Table (one query=one row) for somesoni2. 06-05-2020 12:46 AM
- Posted Re: Matching value from two multi-value field on Splunk Enterprise Security. 04-02-2020 01:04 AM
- Posted Matching value from two multi-value field on Splunk Enterprise Security. 04-01-2020 11:21 PM
- Posted How to control Report time range on Splunk Enterprise Security. 02-18-2020 10:53 PM
- Tagged How to control Report time range on Splunk Enterprise Security. 02-18-2020 10:53 PM
- Posted Accessing Saved Report output in json from Splunk Rest API on Getting Data In. 11-10-2019 09:29 PM
- Posted Re: Not able to generate timechart from a multivalue field on Splunk Search. 07-15-2019 08:32 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-25-2018
03:19 AM
I have some events on my server. I want to get events which are occurring repeatedly for same host and same instance for 1 or 2 weeks.
DB_HOST_NAME DB_INSTANCE_NAME EVENT TIME_WAITED WAIT_CLASS Timestamp
-------------- ----------------- ------- --------- ------------- ----------
ABC xyz on CPU 8527.248862 Application 24/SEP/2018 16:00:26 UTC
ACD yxz lock contention 1572.800453 Application 24/SEP/2018 16:00:35 UTC
ABC xyz on CPU 880.093816 Application 24/SEP/2018 16:00:29 UTC
ASZ xzy on CPU Concurrency 24/SEP/2018 16:00:33 UTC
My requirement is like: if we take set of host, instance & event(n3pvdo1001, cogcsprd, enq: TX - row lock contention ) and this combination is occurring every day for last 2 weeks or more, then status should be Red. If this combination is occurring every day for last 1 weeks, then status should be Amber, if this combination is occurring less than 7 days, then status as Green.
... View more
09-12-2018
10:19 AM
@Sukisen1981
As I mentioned, event is output of single command. I am not using regex. I need to extract the field run time.
... View more
09-11-2018
08:30 AM
HI @mayurr98 ,
I tried above option and got the result in tablular format. But all data is displayed as single event. Not as multiple row.
... View more
09-11-2018
05:53 AM
I have below event in my log which is output of a single command.
TIMESTAMP=2018-09-11T06:47:56|HOSTNAME=a9tvdb152|Cluster_Resources=CRS_Cluster_resources
NAME=ora.ASMNET1LSNR_ASM.lsnr
TYPE=ora.asm_listener.type
TARGET=ONLINE , ONLINE , ONLINE
STATE=ONLINE on a9tvdb151, ONLINE on a9tvdb152, ONLINE on a9tvdb153
NAME=ora.ASMNET2LSNR_ASM.lsnr
TYPE=ora.asm_listener.type
TARGET=ONLINE , ONLINE , ONLINE
STATE=ONLINE on a9tvdb151, ONLINE on a9tvdb152, ONLINE on a9tvdb153
NAME=ora.DATA1_DG.dg
TYPE=ora.diskgroup.type
TARGET=ONLINE , ONLINE , ONLINE
STATE=ONLINE on a9tvdb151, ONLINE on a9tvdb152, ONLINE on a9tvdb153
I am getting below fields in this event but with only first values not rest.
TIMESTAMP
NAME
TYPE
TARGET
STATE
I need all value occurrence in respective field.
... View more
09-10-2018
10:24 AM
Hi @mayurr98
I tried the above option but not getting desired output.
... View more
09-10-2018
06:29 AM
I have a few fields which contain string values. I want to change the color of a cell if particular work is present in the string.
Sample Field value
--------------------------------------
CRS-4638: Oracle High Availability Services is online
CRS-4537: Cluster Ready Services is online
CRS-4529: Cluster Synchronization Services is online
CRS-4533: Event Manager is online
If string contains the keyword "online" , I want to change the cell color. If it contains "offline" , I want to change the cell to another color.
... View more
09-10-2018
02:57 AM
I got the desired output by using below command.
base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
... View more
09-10-2018
02:22 AM
@somesoni2 :
I need 3 fileds(INCIDENT_ID, PROBLEM_KEY, CREATE_TIME) should get created at run time. When I use table command to print these fields respective column value should come in that field.
... View more
09-10-2018
02:20 AM
Hi @renjith.nair
I tried above query but didn't get the desired output.
... View more
09-07-2018
07:59 AM
I have an event in the below format.
INCIDENT_ID PROBLEM_KEY CREATE_TIME
-------------------- ----------------------------------------------------------- ----------------------------------------
102753 ORA 15064 2018-05-24 15:38:50.242000 -04:00
107689 ORA 29740 2018-05-24 17:04:00.414000 -04:00
112801 ORA 32701 2018-05-24 20:59:14.420000 -04:00
I need this data as INCIDENT_ID field with values (102753, 107689, 112801), and PROBLEM_KEY, CREATE_TIME fields in same way. I used multikv command, but I am not getting the desired result.
base search | multikv fields INCIDENT_ID PROBLEM_KEY CREATE_TIME | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
... View more
09-07-2018
01:34 AM
Hi @kmaron above answer help me getting the days difference. Could you help me to count hour difference if daysdiff is less than 1.
... View more
09-06-2018
10:28 AM
Thanks @harsmarvania57 . I moved props.conf on indexer but after that also I was getting same error. There was an issue with folder permission. Splunk user had read permission for file but not for the folder. So I was getting permission denied error.
... View more
09-06-2018
10:27 AM
I have two dates as part of a string. I have to get these dates in separate fields by using the substr function. Now, I want to calculate the number of days difference between those two dates.
| base search
| eval date1=substr(HIGH_VALUE, 10, 19)
| eval date2=substr(PREV_HIGH_VALUE, 10, 19)
| eval it = strptime(date1, "%Y-%m-%d %H:%M:%S")
| eval ot = strptime(date2, "%Y-%m-%d %H:%M:%S")
| eval diff = (it - ot) | eval date_diff=strftime(diff,"%Y-%m-%d %H:%M:%S")
I am unable to get the desired result by the above query.
I have to calculate a new field data based on number of difference between two dates.
... View more
09-05-2018
03:36 AM
I am trying to read log files from a server. I have made all the configuration in Splunk but data is not coming in Splunk search. When I checked Splunk's internal log, I got a permission denied error for that server. I logged to the specific server and verified that all users have read permission to path I am trying to Monitor.
Can anyone suggest what could be the real cause for this issue.
Below is the inputs.conf configuration
[monitor:///usr2/oracle/saltlog/*logs.log]
sourcetype = oracle_os:healthcheck
index = os_na
interval = 600
crcSalt = <SOURCE>
Below is the props.conf configuration
[sourcetype:oracle_os:healthcheck]
SHOULD_LINEMERGE= true
NO_BINARY_CHECK = true
BREAK_ONLY_AFTER = TIMESTAMP=
TRUNCATE =9999
TZ = US/Eastern
... View more
11-14-2017
10:01 PM
I tried to convert format for End_Time but getting blank value for that field. I used below query now.
... "Start time for " |eval Start_Time=strftime(_time, "%H:%M:%S") |sort -Start_Time | table Start_Time | appendcols [ search ..... "End time for " |eval End_Time=substr(End_Time, 11, 9) | eval End_Time=strftime(End_Time, "%H:%M:%S") | eval Duration= End_Time
-Start_Time |sort -End_Time | table End_Time ] | table Start_Time End_Time Duration
... View more
11-14-2017
08:46 PM
I have a event, where starttime and endtime are coming as string. I am using below query.
.... | transaction startswith="Start time for " endswith="End time for "|eval Start_Time=strftime(_time, "%H:%M;%S") | eval End_Time=substr(End_Time,11,9) | eval Duration=strftime(duration,"%M:%S") | table Start_Time End_Time Duration
With help of this query, I am able to get the right value for Start and End time, but duration is coming 00:00 as both time are in different format. I Tried to convert both time in same format using convert function but getting blank value.
.... | transaction startswith="Start time for " endswith="End time for "|eval Start_Time=strftime(_time, "%H:%M;%S") | eval End_Time=substr(End_Time,11,9) | convert ctime(Start_Time) | convert ctime(End_Time) | eval Duration=strftime(duration,"%M:%S") | table Start_Time End_Time Duration
Can anyone help me to get the difference of Start and End time.
Thanks in advance.
... View more
08-08-2017
02:36 AM
I had same issue. You can use the Delimiter as OR Brand= . After passing this delimiter, your query will look like below.
| search Brand=brand1 OR Brand=brand3 OR Brand=brand3
... View more
04-03-2017
01:47 AM
@niketnilay: I tried that link and able to download the universal forwarder. After installation, I am getting data as well from that System.
Thanks for your help.
... View more
04-01-2017
12:28 PM
I was trying to download the universal forwarder for windows 7 32 bit OS, but i can see only windows 8, 8.1, 10 OS.
Is Splunk supporting windows 7? If I will download universal forwarder for windows 8. Will it take the data from window 7 system?
... View more
03-29-2017
10:47 PM
I tried the below option and got the expected result.
.....| table _time CareCredit SYPI WKS Orange Samsung
... View more
03-29-2017
03:15 AM
I have 5 query merged in single output. In statistics tab I am getting expected values. But in visualization tab when i am selecting bar chart for this table, first column value is displaying on x-axis as field name as x-axis label which should display as bar chart.
I have attached the screenshot. In this bottom table we can see 5 fields but in legend we can see only 4. Carecredit is showing as x-axis label.
Expected Result: All 5 field count in bar chart.
Note: I am getting correct result if I am using timechart rather than stats command.
... View more
03-29-2017
12:07 AM
I have used the multiple queries and merged them in single output. When I using timechart, getting the expected result but when using bar chart we are not getting first query result as bar. Instead of bar it's showing the x-axis value.
Below is sample type of my query.
index=index1 | stats count as Field1 | appendcols [ search index=index2 | stats count as Field2] | appendcols [ search index=index3 | stats count as Field3] | appendcols [ search index=index4 | stats count as Field4] | appendcols [ search index=index5 | stats count as Field5]
We are getting write value in statistics tab, but in visualization tab after selecting bar chart, I am not getting field1.
... View more
03-25-2017
08:03 PM
Hi,
In URL argument you pass the twitterId of the user as below. You can get twitterId from http://gettwitterid.com/ by passing Twitter user name. This way it worked for me.
follow=359714389^stall_warnings=true
... View more
03-25-2017
07:22 PM
I have completed the Power User certification but have not received the Certificate yet. How much time it will take to get the certificate. Will I get it via email or I can access from my splunk.com account.
For Admin courses, Can I join the classes online? (As I am in IST timezone).
... View more
03-19-2017
07:30 AM
I have installed Splunk Enterprise free version on my personal PC. I want to track the URLs are visited from the browser in my Splunk dashboard. I tried to monitor the local App data directory (C:\Users\hp\AppData\Local\Google\Chrome\User Data\Default).
Still I am unable to get the URL details in my Splunk.
Thanks in advance
Ritesh
... View more
- « Previous
- Next »
