About aohls

aohls · ‎10-23-2019

We have jobs running everyday and I want to do a timechart to show the start time of the job for each day. I have data populated if I put it in a stats table but trying to get a timechart is not working. Do I need to adjust the format of the time data in order to use this properly? What I want is to show the start time over each day to identify delays. Here is the stats data that works. rest of search....| stats values(Tier1StartTime) as T1Start, values(Tier2StartTime), values(Tier3StartTime) by Tier1, Tier2, Tier3

aohls · ‎10-14-2019

Much of our instance is handled by another team. I want a way to test some add on before a full install. If I download something from Splunkbase, will it be specific to my user or does it have to be installed to our Splunk instance itself?

aohls · ‎10-10-2019

I am not sure what you are looking for but assuming you are looking for the value 5. You could do a regex on that field first maybe. | rex field=_raw "count: (?<timerCount>\d+)" With that you can then check: timerCount > 5

aohls · ‎10-10-2019

Do you have an example of the logs?

aohls · ‎10-07-2019

I am not sure the best way to ask this but we have a job with subtasks, and the subtasks have subtasks. I wanted to get the total runtime. These are not jobs related to Splunk, they are internal jobs we log times and steps. Currently I get Job1|Sub1|Task1|1 minute Job1|Sub1|Task2|5 minutes Job1|Sub1|Task3|2 minutes Job1|Sub2|Task1|10 minutes I do not want to have Job1 show multiple times and I want it to have a total run time, then it would break down for each Sub task. I want this to almost be a collapsible list where Job1 can have multiple Subs and each sub with tasks but I do not want Job1 to get printed multiple times. Ideally I want Job1's only result to also show the total runtime of the job. Then each Subtask would break down the runtime of that specific subtask.

aohls · ‎10-07-2019

I am not sure what extracts you have setup but you could use a transaction: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Transaction | transaction src_ip maxspan=5m Need some more information to get things exact but it seems using transaction should work. If you can provide some more information that would help.

aohls · ‎10-01-2019

You could use a case statement here. |eval risk = case(score <= 10, "A", score > 10 AND score <= 20, "B", score > 20 AND score <= 30......)

aohls · ‎09-26-2019

This is what I was hoping for, thanks. I have been debugging my searches but I wanted to check to make sure there was not some fundamental issue in the setup.

aohls · ‎09-25-2019

We are just starting to really dive into some more in depth reports. In some cases we are seeing some slow run times; I expect this with the millions of events to go through. We have on main index with over 100 hosts, though the sourcetype breaks it down further. Is this 'normal'? My primary question is that if we were to break up the hosts and have a few different indexes, would that speed up any search? Does that get negated as soon as you add specification to a host or sourcetype? Any documentation would be helpful; most of this is handled by a separate team so I have not interfaced with this.

aohls · ‎09-18-2019

@gcusello I added my full search. I also noticed I had a typo in why the search did not generate. I now have it working but, I am not getting data back for my 7 day average in the subsearch. I am also unsure of if there is a better way to do this.

aohls · ‎09-18-2019

I want to get a 7 day and 30 day average in a single search. sourcetype="businessService" OR sourcetype="bpmservice-2" JobName | eval host = lower(host) | lookup client-mapping.csv hostname as host OUTPUT clientename as clientName | transaction unifyends=true GUID maxspan=12h | eval duration=round(duration/60, 2) | lookup JobStatsData.csv codeName as codeName,JobName as JobName OUTPUT avgRunTimeMinutes as avgRunTimeMinutes, stdDevDuration as stdDevDuration, jobHasFTPDownload as FTPDownload | join JobName [search sourcetype="businessService" JobName earliest=-7d@d | eval host = lower(host) | lookup client-mapping.csv hostname as host OUTPUT clientname as clientName | transaction unifyends=true GUID maxspan=12h | eval duration=round(duration/60, 2) | stats avg(duration) as AverageRunTime7Days by JobName | fields + AverageRunTime7Days] | stats avg(duration) as AverageRunTime30Days, avg(avgRunTimeMinutes) as historicalRunTime, avg(stdDevDuration) as historicalStdDev,values(FTPDownload) as FTPDownload by JobName | eval OneStdDevOfAvg = historicalRunTime + (historicalStdDev) | eval Action = if(AverageRunTime30Days > OneStdDevOfAvg, if(FTPDownload=="Yes","Potential Review Needed","Review Needed"), "No Issues") | rename JobName as BPMJob | table BPMJob,FTPDownload, AverageRunTime30Days, AverageRunTime7Days, OneStdDevOfAvg, Action I have a lookup with historical statistics data and I want to compare that to a 30 day and 7 day run time. I am not getting any results right now; but if I remove the above code I get the 30 day average. I want to pass the 7 day average and JobName into my main search, so I can include it in my table output.

aohls · ‎09-16-2019

I had created a field extraction not realizing that happened automatically; this caused duplicate results.

aohls · ‎09-12-2019

@somesoni2 The first one worked great. I attempted to use match very quickly but must have mistyped something along the way.

aohls · ‎09-11-2019

I am using a transaction to group some jobs and get the timings. In doing so I want to check for certain steps, file download steps. I have the following. | transaction unifyends=true JobID maxspan=12h | eval duration=round(duration/60, 2) | eval FTPDownload=if(like(_raw, "%FTPDownload%"), "Yes", "No") In this case I want to check if the transaction itself contains FTPDownload, and set FTPDownload to Yes or No. I am at times getting both Yes and No, for the same job which does not change. Also for jobs I know and see there is an FTPDownload step, I am getting No back. Is _raw in this case only evaluating the first event in the transaction? Is there any issue with this approach I am overlooking? It seems like this should work but the results are not correct.

aohls · ‎09-05-2019

I have a search I created that runs for the last 5 minutes. I scheduled this to run every 5 minutes to update a summary index I have. I am finding duplicates on my data. Is there a better way to manage the run times to make sure there are no duplicates? I am only putting a table into the summary, there are no stat commands. Is there some way to handle this better?

aohls · ‎08-27-2019

This works perfect, I had attempted something similar but I had: operation="?(?<operation>[^\,]+)"?, . I was missing a quote in the expression so I was getting the closing quote in my result. Thanks.

aohls · ‎08-27-2019

I am hoping to accomplish this within the extraction and avoid any search time requirements.

aohls · ‎08-27-2019

I am working to extract a field that at times is surrounded by quotes. This means I have either; operation or "operation". I have attempted the following: Log Example: operation="status" operation=status operation="?(?P<operation>"?[^\,]+), Doing this does is close but on the fields with quotes, the closing quote is included which I did not want. My thought is to just do two extractions with the same name which is not ideal for me. I am extracting until a comma, which is either after the end of the string or after the closing quote. Edit: I do not want to do anything at search time, I want the values to be correct for other users with limited knowledge.

aohls · ‎08-26-2019

@woodcock Thanks for the insight.

aohls · ‎08-26-2019

I have a summary index I am looking to put data in. | table Name,host,_time, component, operation, userName, responseTimeSeconds | fields - _raw This is the basis of what I have. When putting it into the summary index I was hoping to have only the fields specified in my table. Instead I am getting things like the following included: 08/26/2019 12:29:59 -0400, search_name=savedReport, search_now=1566837000.000, info_min_time=1566836700.000, info_max_time=1566837000.000, info_search_time=1566837197.992, Is there any way strip out this information in my index? Will it automatically add it. I used collect with testmode=true and thought that should indicate what my output looks like. Is there a step I am missing or is that what I should expect to have in my data? For awareness what I am trying to do is gather some data we want that will stay around longer than our current setup by stripping out a lot of items in the logging we do not need.

Posts	92
Solutions	5
Karma Given	8
Karma Received	8
Member Since	‎03-10-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Create a timechart with Hours, Minutes, seconds on...

Can SplunkBase downloads be end user specific?

Re: How do I operate on (and search from) sub-prop...

Re: How to identify external IP addresses

Display job time with total run and runtime of sub...

Re: Search that Alerts for two events with a match...

Re: Is it possible to replace a number with letter...

Re: Number of Index's to Host or Events

Number of Index's to Host or Events

Re: Calculate average on two different times

Calculate average on two different times

Re: Summary Index has Duplicates

Re: Eval a transaction with conditional statement

Eval a transaction with conditional statement

Summary Index has Duplicates

Re: Extract field that might be surrounded by quot...

Re: Extract field that might be surrounded by quot...

Extract field that might be surrounded by quotes

Re: Summary Index does not seem correct

Summary Index does not seem correct