Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About chanmi2
chanmi2
Path Finder
Member since:
07-07-2014
06-05-2020
Community Statistics
| Posts | 31 |
| Solutions | 5 |
| Karma Given | 53 |
| Karma Received | 10 |
| Member Since | 07-07-2014 |
Activity Feed
- Karma Re: Is it possible to use PostProcessManager to append lookup CSV file? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: How to change charting.fieldColors through JS for kbarker302. 06-05-2020 12:48 AM
- Karma Re: Why is my search with an eval case condition resulting in error "The expression is malformed. Expected )."? for saradachelluboy. 06-05-2020 12:48 AM
- Karma Re: How to index logs of different source types in a single index? for ddrillic. 06-05-2020 12:48 AM
- Karma Splunk ended support for Windows 7 in latest 6.5 release for amit_saxena. 06-05-2020 12:48 AM
- Got Karma for Re: How to change charting.fieldColors through JS. 06-05-2020 12:48 AM
- Karma Re: How to return a single value from a subsearch into eval for Sloefke. 06-05-2020 12:47 AM
- Karma Re: What are the differences between the various features named "summary" in Splunk? for yannK. 06-05-2020 12:47 AM
- Karma What are the differences between the various features named "summary" in Splunk? for mataharry. 06-05-2020 12:47 AM
- Karma Re: Best practices when using subsearch (eval, etc) for woodcock. 06-05-2020 12:47 AM
- Karma Why are collected events in a summary index losing milliseconds from _time in Splunk 6.2.1? for arkadyz1. 06-05-2020 12:47 AM
- Karma How to drilldown all selected choices from one multiselect input form to another multiselect input form? for koprai. 06-05-2020 12:47 AM
- Karma Different median results: fast-mode vs verbose-mode for HeinzWaescher. 06-05-2020 12:47 AM
- Karma Re: how to group events per weeknumber ? for yannK. 06-05-2020 12:47 AM
- Karma Re: Splunk Dashboard Report Timezone Issue for frobinson_splun. 06-05-2020 12:47 AM
- Karma Re: Is it possible to run subsearch per each event? for wpreston. 06-05-2020 12:47 AM
- Karma Re: iplocation: How to replace null or empty string City field with "Unknown"? for martin_mueller. 06-05-2020 12:47 AM
- Karma How to to show milliseconds with table _time in Splunk 6.x? for sushil_borah. 06-05-2020 12:47 AM
- Karma Re: stats return multiple columns where only one occurance exists for yannK. 06-05-2020 12:47 AM
- Karma Re: Search using field value yields no results for splunkIT. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-10-2018
06:59 PM
I am trying to do similar things in sending email alert, with inline table included. Point 1 and 3 did not work
... View more
07-06-2016
11:00 PM
could you remove |timechart span=5m count, and check if the _time is parsed correctly?
... View more
07-06-2016
10:56 PM
_raw contains the whole string, need to have *(any character) in the beginning and the end
... View more
07-06-2016
07:41 PM
Could you please try to specify AND in the statement in CASE?
| eval response_cd=case(_raw="*applicationCode: 123*" AND _raw="*providerCode: AAA*" AND _raw!="*responseCode: 00*" AND _raw!="*responseCode: SM--*" ,"AAA", 1==1, "BBB")
... View more
07-06-2016
07:24 PM
Hope this can help:
|inputlookup xxx.csv | eval _time=strptime(your_time_field,"%Y-%m-%d %H:%M %p %Z") | timechart span=5m count
the display time zone will be the user time zone, same as server time zone by default
the time format could be found in
http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Commontimeformatvariables
... View more
06-02-2016
11:07 PM
Thanks. Could you please post your answer so that I could click the accept button?
... View more
06-02-2016
07:04 PM
Hi all,
Can we use |append [|inputlookup tmp.csv] in a post process search?
Here is the code:
<table>
<search id="test">
<query>|stats count</query>
</search>
</table>
<table>
<search base="test">
<query>|append [|inputlookup tmp.csv|eval count="tmp"]</query>
</search>
</table>
Two tables will show the same result. Click the "open in search" button and jump to search page, the result can contain the csv file.
If inside append is [|stats count|eval count="tmp"] , the table can show both count=0 and count=tmp.
Is it a bug, the design of post process search, or did I type something wrong? Thanks.
... View more
05-26-2016
11:29 PM
1 Karma
thanks @kbarker302! this is worked when the chartview.visualization is still null. Do you have any idea of applying this after visualization is built? (Again, adding network.render() does not work.)
Thanks a lot!
... View more
05-26-2016
02:46 AM
I'm afraid that both X and Y axes need to be numeric value.
Bubble Chart accept three/four columns, either xAxis,yAxis,bubbleSize or bubbleName,xAxis,yAxis,bubbleSize
... View more
05-26-2016
02:24 AM
Hi all,
Setting "charting.fieldColors" in XML always works, but it failed when I try to change this value through js.
My code is like this:
var chartview = mvc.Components.get("chartid");
chartview.settings.set("charting.fieldColors",'{"sth":0x65a637}');
// tried call network.render(); already
Is there any way to change fieldColors through JS? Thanks.
... View more
01-10-2016
07:53 PM
is it okay if do this dump search?
index="_audit" earliest=-30s [search index="unique"|stats count|eval count="*"|table count] | table user
enter unique string for different user, after doing that dump search, there would have record in _audit
... View more
10-29-2015
07:08 PM
include the js or css file in dashboard tag
add html in panel
<panel>
<html>
<div id="sth"/>
</html>
</panel>
then inside the js, you can use that piece of js code
installing this app might help you get familiar with dashboard with js: "Splunk 6.x Dashboard Examples"
... View more
10-27-2015
05:44 PM
you can do something like this:
inside the js, you can call some library first like the fourth section in the tutorial link
require.config({ the code in the third section });
require([
'jquery', 'jquery-ui', 'splunkjs/mvc/simplexml/ready!'
], function($) {
}
Hope it is what you want and it works for you
... View more
09-09-2015
07:34 PM
It might because you use values(). timechart cannot show a field with multiple values. You may change
| timechart span=5s values(readValues) AS Disk_Reads_sec, values(writeValues) AS Disk_Write_sec by host
to
| timechart span=5s latest(readValues) AS Disk_Reads_sec, latest(writeValues) AS Disk_Write_sec by host
use any stats function that return one value only
... View more
09-08-2015
07:40 PM
Try this:
your search | eval combine_session = session_id.",".sessionID | makemv delim = "," combine_session | stats dc(combine_session), values(combine_session)
... View more
09-03-2015
06:12 PM
You may try this:
index=* NOT index=D | timechart span=1h count| join _time [index=D | timechart span=1h count]
or
index=* | eval isD=if(index=="D", "T", "F") | timechart span=1h count(eval(isD="T")) as "D" count(eval(isD="F")) as "Others"
... View more
09-01-2015
08:16 PM
Hi,
In http://docs.splunk.com/Documentation/Splunk/6.2.1/AdvancedDev/CustomChartingConfig-JSChart, it mentions that "JSChart can only plot the first 50 series that are returned". Because of this limit, results is not truncated only when the search is ...| timechart limit=48 useother=true ...
Is it a hard limit or I can change it somewhere? Thank you
... View more
09-01-2015
02:07 AM
you may try this:
... | eventstats count by src_ip ,dest_ip | where count = 2
... View more
08-28-2015
12:57 AM
I think you can split by host and Data if I did not misunderstand your question.
index="something" sourcetype="something else" Level="high" | dedup Err_Code, Host | stats count as Count, values(Err_Code) as Err_Code by Host, Data | eval Err_Code_List=mvjoin(Err_Code, ",") | stats sum(Count) as Count, list(Data) as Data, list(Err_Code_List) as Err_Code by Host
or
index="something" sourcetype="something else" Level="high" | dedup Err_Code, Host | stats count as Count by Host, Data, Err_Code | streamstats count as MAKE_EMPTY_COUNT by Host, Data | eval Data=if(MAKE_EMPTY_COUNT==1, Data, "_") | stats sum(Count) as Count, list(Data) as Data, list(Err_Code) as Err_Code by Host
Hope this helps
... View more
08-28-2015
12:51 AM
Is the last line of your sample data wrong? I think you mean this:
"host3" "high" "EC2000" "Not enough RAM" more data
... View more
08-27-2015
01:08 AM
1 Karma
I can't figure out how Splunk calculating median/perc50 either. The result is just a estimated result when there are hundreds of events from your search.
To get the exact median that wont change, I recommend using exactperc50()
... View more
08-27-2015
12:30 AM
1 Karma
Hi, you may want to take a look at this answer
http://answers.splunk.com/answers/55715/joining-results-from-saved-searches.html
and try
join REF [| savedsearch "Chris EI-GG" ]
Hope this help
... View more
08-27-2015
12:14 AM
3 Karma
sort 0 means no limit and returns all result
Please read the docs
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort
If you want the oldest result, you may try
sort 1 _time
without the minus sign, it will sort in ascending order
... View more
08-24-2015
10:37 PM
It does not work
... View more
08-24-2015
06:07 PM
2 Karma
You may try this:
index=sth source="abc" | table TS1 | appendcols [search index=sth source="abc1" | table TS2 | rename TS2 as abc1_TS2] | eval Diff = abc1_TS2 - TS1
If these two files are unrelated, you can just use appendcols. Otherwise you should use join [common field]
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
