Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gballanti
gballanti
Explorer
Member since:
03-12-2013
06-18-2020
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-12-2013 |
Activity Feed
- Posted Re: Episode review not Displaying Impacted Entities details on Splunk IT Service Intelligence. 06-18-2020 01:53 AM
- Posted SAI missing mountpoint from collectd on Getting Data In. 06-12-2020 03:45 AM
- Got Karma for SA-Eventgen how to decrease log verbosity. 06-05-2020 12:50 AM
- Posted Re: ITSI service modeling and KPI on Splunk IT Service Intelligence. 05-29-2020 03:56 AM
- Posted ITSI service modeling and KPI on Splunk IT Service Intelligence. 05-26-2020 02:31 AM
- Tagged ITSI service modeling and KPI on Splunk IT Service Intelligence. 05-26-2020 02:31 AM
- Posted ITSI Cloud on Splunk IT Service Intelligence. 05-08-2020 05:37 AM
- Tagged ITSI Cloud on Splunk IT Service Intelligence. 05-08-2020 05:37 AM
- Posted Re: SA-Eventgen how to decrease log verbosity on Archive. 12-18-2019 11:00 PM
- Posted SA-Eventgen how to decrease log verbosity on Archive. 12-18-2019 12:29 AM
- Tagged SA-Eventgen how to decrease log verbosity on Archive. 12-18-2019 12:29 AM
- Tagged SA-Eventgen how to decrease log verbosity on Archive. 12-18-2019 12:29 AM
- Posted Re: How to combine two searches with common value into one table on Splunk Search. 12-06-2019 06:00 AM
- Posted Re: How to combine two searches with common value into one table on Splunk Search. 12-06-2019 04:54 AM
- Posted Re: How to combine two searches with common value into one table on Splunk Search. 12-06-2019 02:33 AM
- Posted Re: How to combine two searches with common value into one table on Splunk Search. 12-06-2019 01:43 AM
- Posted How to combine two searches with common value into one table on Splunk Search. 12-05-2019 07:35 AM
- Tagged How to combine two searches with common value into one table on Splunk Search. 12-05-2019 07:35 AM
- Tagged How to combine two searches with common value into one table on Splunk Search. 12-05-2019 07:35 AM
- Tagged How to combine two searches with common value into one table on Splunk Search. 12-05-2019 07:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-18-2020
01:53 AM
Hello, I have the same issue ... anyone solved ?
... View more
06-12-2020
03:45 AM
Hello, I'm using SAI to get filesystem usage, unfortunately the mountpoint is not populated, or better it is partial. The following query (KPI in ITSI) | mstats min(df.free) as "df_free" max(df.used) as "df_used" WHERE `sai_metrics_indexes` by host,mount span=30s | eval host_dev = host . ":" . mount doesn't work because the dimension "mount" is missing. Changing "mount" with "device" I get result without mountpoint. Trying to change the collectd.conf (red part) <Plugin df> FSType "ext2" FSType "ext3" FSType "ext4" FSType "XFS" FSType "rootfs" FSType "overlay" FSType "hfs" FSType "apfs" FSType "zfs" FSType "ufs" MountPoint "/^/.+/" ReportByDevice false ValuesAbsolute false ValuesPercentage true IgnoreSelected false </Plugin> I get data only from one mountpoint (/boot) the other ones are still missing. I don't understand because the mount dimension is missing and only partial mountpoints are taken. Is it my fault ? I use the latest version of SAI, ITSI 4.4.3 and Splunk 8.0.3 Thanks
... View more
Labels
- Labels:
-
HTTP Event Collector
05-29-2020
03:56 AM
Anyone has a service with entities that get data from different sources ?
... View more
05-26-2020
02:31 AM
Hello, trying to model a simple service I have found a little issue. The entities that compose the service are feeded from two source (windows add-on and SAI). The first one create events the second one metrics, so I cannot use the same search for CPU, memory and so on. I suppose a single service that contains this entities should have double kpi's (one for event, one for metrics), or I can create a service that correspond at a single server with its proper kpi.
Could be the second options a valid solution or there is another way ? Thanks & regards
... View more
Labels
- Labels:
-
configuration
-
using ITSI
05-08-2020
05:37 AM
Hello,
I'm starting a learning path on ITSI. Getting a fast look on documentation I see that latest version (4.5.0) is cloud only. Should I start my learn/study from the latest version because since now will be cloud based only or the previous version still exist with a parallel rollout?
thanks
... View more
Labels
- Labels:
-
other
-
using ITSI
12-18-2019
12:29 AM
1 Karma
I've installed SA-Eventgen and SPL Examples that work as expected. Unfortunately in few days the logs filled up my filesystem. In particulary the "/opt/splunk/etc/apps/SA-Eventgen/lib/splunk_eventgen/logs/eventgen-main.log" file is becomed 22G big in a week.
The log reports rows as follow
2019-12-18 09:15:09 eventgen DEBUG MainProcess {'event': "hourOfDayRate for sample 'noise.cpu' in app 'spl_examples' is 0.4"}
2019-12-18 09:15:09 eventgen DEBUG MainProcess {'event': "dayOfWeekRate for sample 'noise.cpu' in app 'spl_examples' is 0.5"}
2019-12-18 09:15:09 eventgen DEBUG MainProcess {'event': 'Original count: 7.5 Rated count: 2 Rate factor: 0.2038'}
So I was thinking that application could be in debug mode, checking the eventgen.conf seems it ain't
debug = false
verbosity = false
Is there any way to reduce the log verbosity ?
Thanks & regards
... View more
12-06-2019
06:00 AM
thanks to everyone , the solution proposed works as expected.
... View more
12-06-2019
04:54 AM
probably my previous comment is gone ... I wanted to thank you for the answers
... View more
12-06-2019
02:33 AM
just an update ...
the following query
(sourcetype="snow:task_sla" dv_has_breached=false dv_stage=Completed dv_sla="FW-Guasto non bloccante fuori sede no A-SLA21") OR sourcetype="snow:incident" | eval joiner=if(sourcetype="snow:task_sla", dv_task, dv_number) | stats values(dv_task) as dv_task values(dv_number) as dv_number values(dv_sla) as dv_sla by joiner
return an unexpected behavior
I have to get only the highlighted rows, where dv_task and dv_number matches.
... View more
12-06-2019
01:43 AM
Thanks to both of you for the prompt reply.
I used the Dustin's suggestion because is more clear for my little knowledge, later will try the "selfjoin" also.
To filter the columns I used table command as last row
(sourcetype="Sourcetype_A" s1_field4="Completed") OR sourcetype="Sourcetype_B"
| eval joiner=if(sourcetype="Sourcetype_A", s1_field2, s2_field1)
| stats values(*) as * by joiner
| table s1_field2, s1_field1,s2_field2,s2_field3
is it a good way to shows the fields ?
... View more
12-05-2019
07:35 AM
I need help regarding a join from events based on different sourcetype (same index) that are related by the same value in different fields.
The logical flow starts from a bar char that group/count similar fields. With drill down I pass the 'description' by a token to the search that has to combine the search into a table.
Below a simple example:
sourcetype_A
s1_field1 = Purchase OK
s1_field2 = 9
s1_field3 = tax value
s1_field4 = Completed
sourcetype_B
s2_field1 = 9
s2_field2 = Rome
s2_field3 = Fontana di Trevi
I need to obtain a table with fields "s1_field2, s1_field1,s2_field2,s2_field3"
I'm working around this kind of search without obtaining my outcome.
sourcetype="Sourcetype_A" s1_field4="Completed" | search s1_field1=$from_token$
| join s1_field2
[ search sourcetype="Sourcetype_B"
| rename s2_field1 as s1_field2 ]
| table s1_field2, s1_field1,s2_field2,s2_field3
Thank in advance for your help.
... View more
12-03-2019
06:02 AM
Thanks David, it is just what I wanted like to hear. I haven't indexed the new logs yet.
Cheers,
Giuseppe
... View more
12-03-2019
04:46 AM
Hi David,
thank you for the detailed answer.
I have just a trouble about the indexed data (old and new) because the chart built on this data is grouped by quarter. In this last quarter will have the indexed date (_time) with month and day inverted.
Is it able to understand the right date ? For example 11/10 with old log means 11 october while with new log means 10 november, those situation a recognized and managed ?
Thanks
... View more
12-02-2019
11:57 PM
hello to everyone,
the monthly logs received from the ivr has changed the time format. Until now it was %d/%m%/Y right now it is %m/%d/%Y .
Is it possible to modify the TIME_FORMAT so the new data will be recognized leaving the old ones unchanged or a global re-index for all logs is needed ?
Thanks in advanced
... View more
11-21-2019
10:47 PM
hello Erik,
thanks again for the support ... unfortunately I get the same behaviour. I will try with a simple test chart using static values probably the statement used in my search has to be set in different order.
... View more
11-21-2019
08:17 AM
thanks Eric,
setting as you suggest seems to be valid for splunk but didn't get the outcome, not sure if do additional settings
Kind Regards
... View more
11-21-2019
06:12 AM
thank you Eric,
probably it's my fault (i'm new on splunk) but I'm unable to set the first(..) statement. Maybe baecause its is not used to calculate the average but just has a sum.
May you suggest me how to set ?
kind regards
... View more
11-19-2019
06:11 AM
Hello,
I have tried to resolve using all previous posts without lucy. Probably my search/query even if it works is malformed or some chart options are invalid. Using Splunk 8.0.0 here.
I have two questions about the chart settings.
How to color a column of the chart if the threshold is hit (red when it is > of 6, otherwise is green)?
How to mark the threshold limit on Y-Axis, for example, a bold line?
Below the piece of xml code for the chart:
<title>Tempi medi di risposta chiamate HD</title>
<search>
<query>index=rl_ivr avg_speed_answer=* | eval nn=tonumber(replace(replace(avg_speed_answer,"\.",""),",",".")) | eval media_giorno = call_offered * nn | timechart span=3mon sum(call_offered) as total_call sum(media_giorno) as total_avg_speed_answer | eval row_average=(total_call * total_avg_speed_answer) | eval sla10 = total_avg_speed_answer / total_call | eval sla10=round(sla10,2) | rangemap field=sla10 red=6-100 default=green | fields _time,sla10</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisLabelsY.majorUnit">0.5</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY.maximumNumber">20</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">auto</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.maximumNumber">25</option>
<option name="charting.axisY2.minimumNumber">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.rangeValues">[0,30,70,100]</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"red":0xFF0000,"green":0xdc4e41}</option>
<option name="charting.gaugeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
<option name="charting.lineWidth">2</option>
<option name="charting.seriesColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trellis.splitBy">_aggregation</option>
</chart>
... View more
11-17-2019
11:30 PM
thanks for the answer, I will try
... View more
