About deepak02

deepak02 · ‎10-06-2017

Thankyou. I would like to display the time and value on the graph. For instance, if the maximum duration for Oct 5 is 2214 at 09:30:51.225, I would like the data point to read (Oct 5 09:30:51 - 2214). The idea is I want to study what is the trend of responseTime everyday. I am supposed to reduce it below 1000 ms, and I need to know how much of the transactions are taking more than 1000 ms.

deepak02 · ‎10-06-2017

Hi, I have a requirement to timechart data over the same time everyday for the past one month. E.g.: Maximum responseTime between 9 and 10 everyday for the past month. Query to construct timechart is: host=host1-vm1-dev.abp.com OR host=host2-vm1-dev.abp.com date_hour=9 | timechart max(responseTime) How do I modify this search such that the timechart displays values only between 9 and 10 (and not the whole day) everyday? Sample chart given below. Thanks, Deepak

deepak02 · ‎07-24-2017

Thankyou @sbbadri, this is a special case. I do not think mean(), perc95() will give us the answer. For each responseTime, there are many No_of_Events (e.g.: 10 events for responseTime = 5, 8 events for responseTime=10). The average responseTime is [(10 * 5) + (10*8)] / (10+8) = 7.2 mean(responseTime) is 7.5 How do I calculate perc95(responseTime) ?

deepak02 · ‎07-24-2017

Hi, WHAT I NEED : Formula to calculate perc95 of responseTime WHAT I HAVE: I have a summary index which gives the below results, To calculate the Average Response Time, I use the below formula, The Splunk query is: index=prod-pottery-store sourcetype=app:Potter:Performance login_type=* | eval responseTime_per_event=No_of_Events*responseTime | stats sum(responseTime_per_event) as "Total_Response_Time",sum(No_of_Events) as "Total_Events"| eval Average_Duration=Total_Response_Time/Total_Events What formula should I use to calculate perc95 responseTime? Thanks, Deepak.

deepak02 · ‎07-18-2017

Hi, I am using Splunk for a web application that sells pots. WHAT I HAVE: Query for maximum no of calls for each pot type, (index="sales_data") app="Pottery" sourcetype=app_Pottery_Perf pot_type="wood" | fields count,_time | timechart per_second(count) as Calls_Per_Second | eval Calls_Per_Second=max(Calls_Per_Second) | fields Calls_Per_Second | stats max(Calls_Per_Second) (index="sales_data") app="Pottery" sourcetype=app_Pottery_Perf pot_type="clay" | fields count,_time | timechart per_second(count) as Calls_Per_Second | eval Calls_Per_Second=max(Calls_Per_Second) | fields Calls_Per_Second | stats max(Calls_Per_Second) WHAT I NEED: Use a summary index for the above queries. I have created the below query for summary index, THIS QUERY WORKS: (index="sales_data") app="Pottery" sourcetype=app_Pottery_Perf | eval count=1 | timechart per_second(count) as Calls_Per_Second by pot_type | table * | fields - _time THIS QUERY DOESN'T: (index="sales_data") app="Pottery" sourcetype=app_Pottery_Perf | eval count=1 | timechart per_second(count) as Calls_Per_Second by pot_type | table * | fields - _time | search pot_type=wood | eval Calls_Per_Second=max(Calls_Per_Second) | fields Calls_Per_Second | stats max(Calls_Per_Second) Please help. Thanks, Deepak

deepak02 · ‎07-14-2017

Thankyou. But when I open this dashboard on a different laptop, it shows 'HIGH RESPONSE TIME FOR: NONE'. It must show 'HIGH RESPONSE TIME FOR: DB'.

deepak02 · ‎07-14-2017

Hi, I have a dashboard which displays a static panel called "High Response Time". Anyone in my team will manually fill in this panel with a name (say DB) to bring attention to any component that is very slow. The dashboard is will be viewed from many individual systems. So, if I change the text fields to DB on my system, it comes up as blank or "NONE" on the other systems. Is there any way to persist the token across systems, so that if I change the value of text field, anyone opening the dashboard on their system will see "DB" as well? Please find the run-anywhere example below, <form hideFilters="true"> <label>Test_Token_Persist</label> <init> <eval token="latest">(floor(now()/300))*300</eval> <eval token="earliest">relative_time($latest$, "-15m")</eval> <set token="highResponseTime">NONE</set> </init> <fieldset submitButton="false"> <input type="text" token="highResponseTime"> <label>High Response Time</label> </input> </fieldset> <row> <panel> <html> <h1>HIGH REPONSE TIME FOR: $highResponseTime$</h1> </html> </panel> </row> <row> <panel> <table> <search> <query>search * | eval count=1 | dedup count | table count</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> I have created a text field, assigned a token to it, and displayed the token value in the dashboard. Someone in my team will fill in the text field manually. Thanks, Deepak

deepak02 · ‎07-10-2017

Thankyou woodcock. I do not want the '1hour' to be hardcoded. What I need is this: The dashboard query should use the data from a time when the indexer received data from all the forwarders. This could be an hour back, 2 hours back or a day back. Currently, 1 or 2 of my forwarders are sending logs a little late. Therefore the numbers that come up on the dashboard are incomplete. I want the dashboard to display only accurate numbers (i.e. calculated from complete data), even if this means the data is an hour or 2 or a day old.

deepak02 · ‎07-08-2017

Thankyou. How do I modify the below query? application="UserLogin" (index="Production-UserLogin") env="Production" type=* sourcetype=userLogin:Performance (splunk_server=splunk02) | eval count=1 | timechart per_minute(count) as trans_per_min | stats max(trans_per_min) as "Transactions-per-minute"

deepak02 · ‎07-08-2017

Thankyou woodcock. As stated above, I want the daily report to still be sent using time interval=today. If I schedule the report to run every night with time interval=last 7 days, it will have data for the last 7 days, not 'today'. The situation is this: daily report: sent at 10.00 am everyday, time interval=today dashboard: time interval=last 7 days, search runs everytime dashboard is viewed. Both the above items use the same base data/log files. Only the time intervals vary. I do not want to schedule a report for one, and a separate summary index for another. Can I use a common summary index (or any other option in Splunk) so that the report/dashboard are faster?

deepak02 · ‎07-08-2017

Thankyou Giuseppe. Won't this method affect the time interval of daily report sent? I want the daily report to still be sent using time interval=today. If I schedule the report to run every night with time interval=last 7 days, it will have data for the last 7 days, not 'today'. The situation is this: daily report: sent at 10.00 am everyday, time interval=today dashboard: time interval=last 7 days, search runs everytime dashboard is viewed. Both the above items use the same base data/log files. Only the time intervals vary. I do not want to schedule a report for one, and a separate summary index for another. Can I use a common summary index (or any other option in Splunk) so that the report/dashboard are faster?

deepak02 · ‎07-07-2017

Hi, I have a report that runs at 10:00 am everyday and uses time interval:today. This report is mailed out to a couple of people daily. I have a dashboard which displays stats about data from the report for the last 7 days. This dashboard is very slow due to huge amount of data being read each time. I would like to store the daily report into a summary index and use data from this summary index for my dashboard. How do I store the report into a summary index so that the daily mail action is not affected? Thanks, Deepak

deepak02 · ‎07-07-2017

Hi, We have a Splunk Enterprise setup in which we have 12 forwarders. Some of these forwarders are slow in sending data to the indexers (i.e. some of the logs are getting sent around 30 mins later). Therefore when we calculate stats for dashboards every 20 mins, the numbers are not correct. We do not have any options of upgrading the forwarders. Is there anyway we can change the dashboard so that we display the stats at the latest time when all the forwarders logs were available? Example scenario: forwarders 1-12 send data at 9.20 forwarders 1-8 send data at: 9.30 dashboard query runs at: 09:45 (time interval is 'last 20 mins' i.e. 9.25 to 9.45) forwarders 9-12 send data at 09:55 When the dashboard runs at 09:45, I want it to use time interval 09:00 to 09:20 since this is the latest time when all the forwarder logs were available. Thanks, Deepak

deepak02 · ‎06-19-2017

Hi, My logs have the start and end time of an event. I am using the below query to calculate duration, <filter terms> | eval epochStartDateTime=strptime(startDate." ".startTime,"%d/%b/%Y %I:%M:%S.%3Q") | eval epochEndDateTime=strptime(endDate." ".endTime,"%d/%b/%Y %I:%M:%S.%3Q") | eval duration=epochEndDateTime-epochStartDateTime This works for all cases except the below, startDate: 14/Jun/2017 startTime: 11:57:27.164 endDate: 15/Jun/2017 endTime: 12:00:48.401 Duration is returned in negative (duration=-42998.763000). How do I handle this case? Thanks, Deepak

deepak02 · ‎06-19-2017

Hi, I replaced the code of a dashboard in Splunk Search Head on Friday. Today (Monday), I found the dashboard reverted to its older code. My Search Head structure is like this: Common URL -> Load Balancer -> Three Search Heads The user is given a URL, and the request is routed to one of the three search heads via the load balancer. I made changes to the dashboard via the common URL. Is there any setting in Splunk that will cause my dashboard to relapse to an older version? Thanks, Deepak Note: My Splunk version is 6.5

deepak02 · ‎06-08-2017

Hi, Please help me troubleshoot. WHAT I NEED: I have to assign sourcetypes based on the log file being read into Splunk. The mapping I am supposed to use is given below, (Please click on file at end of question to view clearly) WHAT IS MY ISSUE: The logs are not getting uploaded into Splunk (maybe because regex is not allowed in monitor://). WHAT I HAVE USED: The inputs.conf I am using is as given below, [monitor://cib\logs\httpd\(inf_)?(un)?mana[\w\d-.]*_access_log] disabled = false index = cibr recursive = true sourcetype = app:WRWFP:infaccess [monitor://cib\logs\httpd\(inf_)?(un)?mana[\w\d-.]*_error_log] disabled = false index = cibr recursive = true sourcetype = app:WRWFP:inferror [monitor://cib\logs\httpd\(inf_)?(un)?mana[\w\d-.]*_direct_access_log] disabled = false index = cibr recursive = true sourcetype = app:WRWFP:infdirectaccess [monitor://cib\logs\httpd\(inf_)?(un)?mana[\w\d-.]*_perf_log] disabled = false index = cibr recursive = true sourcetype = app:WRWFP:infperf [monitor://cib\logs\WebLogs\retailCustomerProfile-Audit-(un)?mana[\w\d-.]*log] disabled = false index = cibr recursive = true sourcetype = app:WRWFP:jvmaudit [monitor://cib\logs\WebLogs\retailCustomerProfile-(un)?mana[\w\d-.]*log] disabled = false index = cibr recursive = true sourcetype = app:WRWFP:jvm [monitor://cib\logs\WebLogs\retailCustomerProfile-Performance-(un)?mana[\w\d-.]*log] disabled = false index = cibr recursive = true sourcetype = app:WRWFP:jvmperf Thanks, Deepak

deepak02 · ‎06-07-2017

Thankyou! This is what I am looking for. I am unable to accept as answer though.

deepak02 · ‎06-06-2017

Hi, (I have attached the code I have used as a 'Run anywhere' example.) WHAT I HAVE I have a dashboard which initally displays a list of batch jobs, Batch Job 1 Batch Job 2 Batch Job 3 Batch Job 4 When I click on any of the job names, I want 2 tables to be displayed below it, Latest Job information, Job statistics I have managed to make this work by using the logic, <row> <panel> <html> <a href="?showBatchJob1=true"> <h1>Batch Job 1</h1> </a> </html> </panel> </row> <row depends="$showBatchJob1$">  </row> WHAT I NEED: The problem is, when each of the links are clicked, the entire page is reloaded and the data is taking a long time to load. Is there a quicker way of doing this? Thanks, Deepak FULL CODE: <dashboard> <label>Mockup</label> <row> <panel> <html> <a href="?showBatchJob1=true"> <h1>Batch Job 1</h1> </a> </html> </panel> </row> <row depends="$showBatchJob1$"> <panel> <title></title> <table> <title>Latest Job Information</title> <search> <query>index=* | eval "Last Job ended" ="00:00:00" | eval "Job Status"="NOT DEFINED" | eval "Duration per Event" =0 | eval "No. of Events" =0 | stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" | transpose | rename column as "Statistic" | rename "row 1" as "Value"</query> <earliest>rt-10s</earliest> <latest>rtnow</latest> </search> </table> </panel> <panel> <table> <title>Job Statistics</title> <search> <query>index=* | eval "Start Date"=strftime(now(),"%Y-%m-%d") | eval "Start Time"=strftime(now(),"%T") | eval "End Date"=strftime(now(),"%Y-%m-%d") | eval "End Time"=strftime(now(),"%T") | eval "Duration in minutes"=0 | eval Status="INCOMPLETE" | eval "No. of Records"=0 | table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query> <earliest>-1s@s</earliest> <latest>now</latest> </search> </table> </panel> </row> <row> <panel> <html> <a href="?showBatchJob2=true"> <h1>Batch Job 2</h1> </a> </html> </panel> </row> <row depends="$showBatchJob2$"> <panel> <title></title> <table> <title>Latest Job Information</title> <search> <query>index=main | eval "Last Job ended" ="00:00:00" | eval "Job Status"="NOT DEFINED" | eval "Duration per Event" =0 | eval "No. of Events" =0 | stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" | transpose | rename column as "Statistic" | rename "row 1" as "Value"</query> <earliest>rt-10s</earliest> <latest>rtnow</latest> </search> </table> </panel> <panel> <table> <title>Job Statistics</title> <search> <query>index=* | eval "Start Date"=strftime(now(),"%Y-%m-%d") | eval "Start Time"=strftime(now(),"%T") | eval "End Date"=strftime(now(),"%Y-%m-%d") | eval "End Time"=strftime(now(),"%T") | eval "Duration in minutes"=0 | eval Status="INCOMPLETE" | eval "No. of Records"=0 | table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query> <earliest>-1s@s</earliest> <latest>now</latest> </search> </table> </panel> </row> <row> <panel> <html> <a href="?showBatchJob3=true"> <h1>Batch Job 3</h1> </a> </html> </panel> </row> <row depends="$showBatchJob3$"> <panel> <title></title> <table> <title>Latest Job Information</title> <search> <query>index=main | eval "Last Job ended" ="00:00:00" | eval "Job Status"="NOT DEFINED" | eval "Duration per Event" =0 | eval "No. of Events" =0 | stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" | transpose | rename column as "Statistic" | rename "row 1" as "Value"</query> <earliest>rt-10s</earliest> <latest>rtnow</latest> </search> </table> </panel> <panel> <table> <title>Job Statistics</title> <search> <query>index=* | eval "Start Date"=strftime(now(),"%Y-%m-%d") | eval "Start Time"=strftime(now(),"%T") | eval "End Date"=strftime(now(),"%Y-%m-%d") | eval "End Time"=strftime(now(),"%T") | eval "Duration in minutes"=0 | eval Status="INCOMPLETE" | eval "No. of Records"=0 | table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query> <earliest>-1s@s</earliest> <latest>now</latest> </search> </table> </panel> </row> <row> <panel> <html> <a href="?showBatchJob4=true"> <h1>Batch Job 4</h1> </a> </html> </panel> </row> <row depends="$showBatchJob4$"> <panel> <title></title> <table> <title>Latest Job Information</title> <search> <query>index=main | eval "Last Job ended" ="00:00:00" | eval "Job Status"="NOT DEFINED" | eval "Duration per Event" =0 | eval "No. of Events" =0 | stats values("Last Job ended") as "Last Job ended", values("Job Status") as "Job Status", values("Duration per Event") as "Duration per Event",values("No. of Events") as "No. of Events" | transpose | rename column as "Statistic" | rename "row 1" as "Value"</query> <earliest>rt-10s</earliest> <latest>rtnow</latest> </search> </table> </panel> <panel> <table> <title>Job Statistics</title> <search> <query>index=* | eval "Start Date"=strftime(now(),"%Y-%m-%d") | eval "Start Time"=strftime(now(),"%T") | eval "End Date"=strftime(now(),"%Y-%m-%d") | eval "End Time"=strftime(now(),"%T") | eval "Duration in minutes"=0 | eval Status="INCOMPLETE" | eval "No. of Records"=0 | table "Start Date", "Start Time", "End Date", "End Time", "Duration in minutes", Status, "No. of Records"</query> <earliest>-1s@s</earliest> <latest>now</latest> </search> </table> </panel> </row> </dashboard>

deepak02 · ‎06-05-2017

Hi, I have a query like this: (splunk_server="serverA" OR splunk_server="serverB") (app="Cargo" OR app="Customer") index="dev-cargo-app" env="DEV" site=* (sourcetype=app:Cargo:Performance) ms | stats avg(duration) as avgdur, perc95(duration) as 95perc I am trying to make it more efficient using summary indexing: Summary index: (splunk_server="serverA" OR splunk_server="serverB") (app="Cargo" OR app="Customer") index="dev-cargo-app" env="DEV" site=* (sourcetype=app:Cargo:Performance OR sourcetype=app:Customer:Performance) ms | stats count(_raw) as "No. of Events",values(duration) as "Duration" by app, site, sourcetype, category, _time My 'efficient' query is: index= summary report="summary_index_name" | search sourcetype=app:Cargo:Performance | stats avg(Duration) as avgdur, perc95(Duration) as 95perc Average duration is calculated correctly, but perc95(Duration) does not match. My 'efficient query' gives me 100 > normal query for perc95(Duration). Is it not possible to calculate perc95(Duration) using summary index? Thanks, Deepak

deepak02 · ‎06-03-2017

Hi, I have a search query that looks like this, <filter conditions> | eval count=1 | timechart per_second(count) as TPS | eval TransactionPerSecond=max(TPS) | stats max(TransactionPerSecond) by source, sourcetype, fieldA, fieldB What I am trying to do is split the 'Transactions per Second' value by source, sourcetype, fieldA and fieldB. The stats part of it is not giving me any results. Are there any other ways to implement the above logic? Thanks, Deepak

Posts	71
Solutions	2
Karma Given	1
Karma Received	3
Member Since	‎01-27-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Timechart - map data over same interval everyday

How to calculate perc95 Response Time

Summary index queries

Persist token values across systems

Store daily report into summary index

Forwarder slow - dashboard fix

Duration calculated incorrectly

Splunk setting that caused dashboard to relapse to...

Unable to use regex in monitor stanza in inputs

Making dashboard efficient

Re: Timechart - map data over same interval everyd...

Timechart - map data over same interval everyday

Re: How to calculate perc95 Response Time

How to calculate perc95 Response Time

Summary index queries

Re: Persist token values across systems

Persist token values across systems

Re: Forwarder slow - dashboard fix

Re: Forwarder slow - dashboard fix

Re: Store daily report into summary index