Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jamesofthedead8
jamesofthedead8
Explorer
Member since:
10-28-2019
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-28-2019 |
Activity Feed
- Got Karma for How to show the exceptions and not the matches to a search. 06-05-2020 12:51 AM
- Posted Re: How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-27-2020 12:56 AM
- Posted Re: How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-26-2020 02:15 AM
- Posted Re: How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-23-2020 11:30 PM
- Posted Re: How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-23-2020 11:29 PM
- Posted How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-21-2020 08:12 AM
- Tagged How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-21-2020 08:12 AM
- Tagged How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-21-2020 08:12 AM
- Tagged How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-21-2020 08:12 AM
- Tagged How to show the exceptions and not the matches to a search on Dashboards & Visualizations. 02-21-2020 08:12 AM
- Posted Re: How to calculate the difference between two fields on two paired events matched via the contents of a third field? on Splunk Search. 10-28-2019 07:21 AM
- Posted Re: How to calculate the difference between two fields on two paired events matched via the contents of a third field? on Splunk Search. 10-28-2019 05:01 AM
- Posted How to calculate the difference between two fields on two paired events matched via the contents of a third field? on Splunk Search. 10-28-2019 03:37 AM
- Tagged How to calculate the difference between two fields on two paired events matched via the contents of a third field? on Splunk Search. 10-28-2019 03:37 AM
- Tagged How to calculate the difference between two fields on two paired events matched via the contents of a third field? on Splunk Search. 10-28-2019 03:37 AM
- Tagged How to calculate the difference between two fields on two paired events matched via the contents of a third field? on Splunk Search. 10-28-2019 03:37 AM
- Tagged How to calculate the difference between two fields on two paired events matched via the contents of a third field? on Splunk Search. 10-28-2019 03:37 AM
- Tagged How to calculate the difference between two fields on two paired events matched via the contents of a third field? on Splunk Search. 10-28-2019 03:37 AM
Topics I've Started
02-27-2020
12:56 AM
| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append
[| inputlookup AvailHosts.csv
| eval host=lower(host), count=0
| fields host count ]
| stats sum(count) AS total BY host
| rangemap field=total NonReporting=0-0 Reporting=1-10000000 default=Reporting
| rename host AS HostName range AS Status
| stats sum(count) AS total BY host
| where total=0
I've renamed the rangemap fields and I've created the lookup
It's saying it can't access the lookup table but I've put the table into Splunk and created the definitions. I get the error below?
Error in 'lookup' command: Lookups: The lookup table 'AvailHosts.csv' does not exist or is not available.
Thanks
James
... View more
02-26-2020
02:15 AM
Hey Giuseppe,
I've followed your original suggestion. But it's showing all hosts across our entire environment. I've tried putting in a WHERE to filter out the stuff that is reporting as I'm not bothered about stuff that is working. Just the nonreporting ones. Any ideas?
Many thanks
James
... View more
02-23-2020
11:30 PM
Is there any way to do it without the lookup? Trying to reduce the faff.
... View more
02-23-2020
11:29 PM
Legacy of a different search I'm doing. Left it in by mistake 🙂
... View more
02-21-2020
08:12 AM
1 Karma
I'm trying to create a dashboard that will identify when a server stops sending data through to Splunk.
host="hostname1" OR host="hostname2" OR host="hostname3" | dedup host | stats count by host
So it shows no results until one of those servers stops sending data and then it'll show hostname1 for example.
Or if anyone case suggests a better way of doing this overall I'd appreciate it.
... View more
10-28-2019
07:21 AM
Thanks that seems to be working.
... View more
10-28-2019
05:01 AM
First event;
ECID=005_UiHXPHeX0001WE0009jP,0:1
LoggingTime=22:04:34.0968
WritingTime=22:04:34.966
Second event;
ECID=005_UiHXPHeX0001WE0009jP,0:1
LoggingTime=22:04:34.0873
WritingTime=22:04:34.870
Transaction time would be the difference between LoggingTime on event 2 (request) and WritingTime on event 1 (response).
... View more
10-28-2019
03:37 AM
Trying to calculate out a "TransactionTime" time by pairing two events by one matching field (ECID) and then working the difference between two fields across the two fields (LoggingTime on the request then WritingTime on the response. Response/Request is the MessageType field).
Example events:
2019-10-27 22:04:34.0968 : response, 005_UiHXPHeX0001WE0009jP,0:1, 1572213874966, 2019-10-27 22:04:34.966, , osb/TestBindingQSService
2019-10-27 22:04:34.0873 : request, 005_UiHXPHe0001WE0009jP,0:1, 1572213874870, 2019-10-27 22:04:34.870, , osb/TestBindingQSService
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
