Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ssaenger
ssaenger
Path Finder
Member since:
03-24-2015
Thursday
Community Statistics
| Posts | 54 |
| Solutions | 1 |
| Karma Given | 4 |
| Karma Received | 6 |
| Member Since | 03-24-2015 |
Activity Feed
- Got Karma for Re: How to convert Modified Julian Date (MJD) to human readable. Wednesday
- Posted Re: How to convert Modified Julian Date (MJD) to human readable on Splunk Search. Tuesday
- Karma Re: How to convert Modified Julian Date (MJD) to human readable for richgalloway. Tuesday
- Posted Re: How to convert Modified Julian Date (MJD) to human readable on Splunk Search. Tuesday
- Karma Re: How to convert Modified Julian Date (MJD) to human readable for richgalloway. Tuesday
- Posted How to convert Modified Julian Date (MJD) to human readable on Splunk Search. Tuesday
- Got Karma for Compare text strings over 2 days. 01-05-2022 07:23 PM
- Posted Compare text strings over 2 days on Alerting. 01-05-2022 07:13 AM
- Tagged Compare text strings over 2 days on Alerting. 01-05-2022 07:13 AM
- Tagged Compare text strings over 2 days on Alerting. 01-05-2022 07:13 AM
- Karma Re: Matching only part of a string to return a result when different for gcusello. 10-06-2021 03:59 AM
- Posted Re: Matching only part of a string to return a result when different on Splunk Search. 10-06-2021 03:31 AM
- Posted Matching only part of a string to return a result when different on Splunk Search. 10-04-2021 08:21 AM
- Tagged Matching only part of a string to return a result when different on Splunk Search. 10-04-2021 08:21 AM
- Posted Re: Pass field into a subsearch from stats command on Splunk Search. 02-04-2021 12:56 AM
- Posted Re: Pass field into a subsearch from stats command on Splunk Search. 02-03-2021 03:17 AM
- Posted Re: Pass field into a subsearch from stats command on Splunk Search. 02-03-2021 03:01 AM
- Posted Re: Pass field into a subsearch from stats command on Splunk Search. 02-03-2021 02:45 AM
- Posted Re: Pass field into a subsearch from stats command on Splunk Search. 02-03-2021 02:22 AM
- Posted Re: Pass field into a subsearch from stats command on Splunk Search. 02-03-2021 01:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Tuesday
Hi Rich, Thank you for your reply. I have run the command and added some extra as I was also after the time, however i think you chop the seconds off. | makeresults
| eval StartDateTime="59025.5249306"
``` Extract the day number (prior to .) ```
| rex field=StartDateTime "(?<JD>\d+)"
``` Shift the day number to base epoch day and convert to seconds ```
| eval time=(JD-40587) * 86400
``` Convert to text ```
| eval humanTime=strftime(time, "%c")
| eval humanTime1=strftime(time, "%Y-%m-%d %H:%M:%S.%1N")
| table _time StartDateTime JD time humanTime humanTime1 this gives, 2020-06-25 00:00:00.0 do we have to extract the seconds and add them back to epoch?
... View more
Tuesday
Hi All, i have read similar posts but none that will get me to an answer. My log entry is this; 2023-09-19 16:17:01,306 <OnAirSchedule Service="9008" Status="ON" StartDateTime="59025.5249306"/> The StartDateTime is in MJD and i would like to get into human readable format. Below is my search, some regex to start with then the conversion. | rex "<OnAirSchedule\sService=\"(?<SERVICE>[0-9]+)\"\sStatus\=\"(?<STATUS>.+)\"\sStartDateTime\=\"(?<START_DATE>.+)\"\/\>"
| eval jdate=START_DATE,epoch_date=strptime(jdate,"%y%j"),date=strftime(epoch_date,"%Y-%m-%d %H:%M:%S.%1N")
| table _time SI_SERVICE_KEY STATUS START_DATE epoch_date date which was a solution in another question, however i get the date time 2059-01-25 00:00:00.0 I have tried variances of the %y%j to %y.%j and %Y.%j, however these just seem to deal with the date as Julian Date, rather than using the values after the decimal point. This page seems to point to something i am after but it doesnt deal with the full MJD. https://community.splunk.com/t5/Getting-Data-In/Splunk-recognizing-Julian-Date-and-Elapsed-Seconds/m-p/72709 any advice greatly welcomed.
... View more
Labels
- Labels:
-
eval
01-05-2022
07:13 AM
1 Karma
Hello, i have a log file which is capturing processed files. The file text always has the same string, its just the date prefix which changes. So i would like to read in the files processed today and compare to yesterday and how the difference. I have used the answers to other questions to get the file date read in by day, however the diff command does not work, is this only for integers rather than string. Successfully processed file 20211105-zone-Foo Bar1.txt Successfully processed file 20211105-zone-Bar 1.txt Successfully processed file 20211106_zone-Foo Bar1.txt Successfully processed file 20211106-zone-Bar Foo1.txt index=foo source=bar earliest=-1d@d latest=now "Successfully processed file" | rex "\-zone\-(?<File>.+)" | eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today") | chart values(File) by Day | eval Diff=Yesterday-Today | where Yesterday!=Today i would like to report that Bar 1.txt and Bar Foo1.txt are the differences.
... View more
Labels
- Labels:
-
alert condition
10-06-2021
03:31 AM
Hi Giuseppe, yes thanks for that. i created a new field; | rex field=kubernetes.pod_name "^(?P<pod>.{14})" then added pod to the stats by clause, this was the bit I could not see. Thanks for the pointer.
... View more
10-04-2021
08:21 AM
Hi, I am streaming results from a Kubernetes cluster and i am monitoring for pod restarts by looking at the name of each pod and reporting when it changes. I am able to return the pod name, however i am unable to make my match statement work to only return the different pod names. the pods are named; prod-K8-1-b5c85b547-26wqn prod-K8-2-7c56dc8559-kzpwm prod-K8-3-7c7bccf947-4skx2 prod-K8-4-769bb9d4f5-tmwbz ... i have code that returns the pod names over a time frame; index=K8 "kubernetes.container_name"=tfs kubernetes.pod_name=prod* earliest=-5m@m latest=@m| stats first(kubernetes.pod_name) as old_pod last(kubernetes.pod_name) as new_pod by kubernetes.pod_name | where old_pod=new_pod kubernetes.pod_name old_pod new_pod prod-K8-1-b5c85b547-26wqn prod-K8-1-b5c85b547-26wqn prod-K8-1-b5c85b547-26wqn prod-K8-1-b5c85b547-tdgwg prod-K8-1-b5c85b547-tdgwg prod-K8-1-b5c85b547-tdgwg I think i need to use some regex in my where statement, but i end up getting no results, the above where clause was to show an output. I would like to get my output table to list the current pod name then have the two different pod names. any help would be much appreciated.
... View more
02-04-2021
12:56 AM
Hi, thanks. In the end i used a nested search to extract the name using the binary NOT NULL, then passed this through to the main search. Thanks,
... View more
02-03-2021
03:17 AM
Hi, i am using the following to check on an individual name - this differs when i remove name="Steve" also differs if i add binary NOT NULL index=summary sourcetype=prod source=service name="Steve" | eval red=substr(binary, -4, 1) | eval blue=substr(binary, -e, 1) | stats sum(red) AS Red sum(blue) as Blue count(keynumber) as Events count as total by name | eval Percentage_Red=(Red/Events)*100 | eval Percentage_Red=round(Red) | eval Percentage_Blue=(Blue/Events)*100 | eval Percentage_Blue=round(Percentage_Blue) | table name Events Red Blue Percentage_Red Percentage_Blue | sort name adding your entry of | search binary !=0 | fillnull value=0 red blue makes no difference when a name field is declared
... View more
02-03-2021
03:01 AM
i have edited the line you gave me to include | stats sum(red) AS red sum(blue) as blue count(keynumber) as events by name
... View more
02-03-2021
02:45 AM
I dont seem to get any results for the name charles - or entries which dont have a populated binary field - which is great. However, it doesnt seem to count all the events correctly.
... View more
02-03-2021
02:22 AM
hmm, i seem to lose results by using this method, tried search as well as the where clause. I lost two 'names' compared to when i used 'binary NOT NULL'
... View more
02-03-2021
01:39 AM
i was using the criteria binary not null so this will give me the entries for steve. However from this i then want the total number of entries for Steve. This is why i initially thought i would need to use a join, as i would pass the name field in order to get the total number of fields.
... View more
02-02-2021
01:54 AM
Hi ITWhisperer, thanks, based on this i have added | stats sum(red) AS red sum(blue) as blue count(keynumber) as events by name However i also get the name charles returned. How would i only get the name Steve returned as per the results table above? i did try binary not null however, i loose the line with key number 12347 -
... View more
02-01-2021
05:07 AM
Hi, i have data name binary keynumber Steve 1100 12345 Steve 100 13246 Steve 12347 Charles 23456 I am trying to count the whether the position in the binary from right to left has a 1 in position 3 and 4 and as a percentage of the number of events. eg result name events 4thbinary 3rdbinary %4th %3rd Steve 3 1 2 33 66 i was trying to get the 4 position first as this will give me the Names with a binary entry, i then thought i could join and run a subsearch to get the all the events, i then wold do an appendcols to get entries with a 1 in the 3rd binary position in the string. index=summary sourcetype=prod source=service binary NOT NULL |eval red=substr(binary, -4, 1) |stats count(red) AS red by name | join type=left name [search index=summary sourcetype=prod source=service | dedup name keynumber |stats count(keynumber) AS Events by name] |appendcols [search index=summary sourcetype=prod source=service binary NOT NULL |eval blue=substr(binary, -3, 1) |stats count(blue) AS blue by name] |table name events red blue however i cannot get my events to equal the correct value, it only returns a value if the binary field is populated. i have looked at map and field but could also not get these to work.
... View more
Labels
- Labels:
-
field extraction
-
join
-
stats
-
table
01-18-2021
02:09 AM
Hi scelikok, Yes that worked. can you explain how the addition of the AND sTime<=relative_time(now(), "@d") works please, what does "@D" mean? thanks.
... View more
01-18-2021
12:33 AM
Hi scelikok, Sorry i should have posted that i tried the -2d@d but did not post the result. It just changes the start time but the end time still goes to the end of the time in the database. sTime siTime start_time name 1610765940.000000 2021-01-16 02:59:00 2021-01-16 02:59:00 Crime Patrol 1614576600.000000 2021-03-01 05:30:00 2021-03-01 05:30:00 Crime Patrol The above results is run on 18/01//2021.
... View more
01-16-2021
01:22 PM
HI scelikok, thanks for your answer, however the range is giving me problems. It seems that your solution on provides the start time of the search and returns all results from that time, rather than within the time range. index=summary sourcetype=foo source=bar earliest=-60m@m latest=@m | eval sTime=strptime(START_TIME,"%Y-%m-%d %H:%M:%S") | sort -sTime | addinfo | where sTime>=relative_time(now(), "+2d@d") | eval sTime=strftime(info_min_time,"%Y-%m-%d %H:%M:%S") | fields sTime START_TME NAME | table sTime START_TIME NAME This is the results. sTime START_Time NAME 2021-01-16 20:05:00 2021-01-18 05:30:00 Fire Patrol 2021-01-16 20:05:00 2021-03-01 04:30:00 Crime Patrol how would i get only the results of START_TIME with a 2 day window? Thanks,
... View more
01-15-2021
07:09 AM
Hi, i have extracted data from a database into a summary index which is updated every hour. The database has information that is in the past and the future. DESCR="TV HD", START_Time="2021-01-10 09:00:00", NAME="Crime Patrol" DESCR="TV HD", START_Time="2021-01-11 10:00:00", NAME="Fire Patrol" DESCR="TV HD", START_Time="2021-01-12 09:00:00", NAME="Ambulance Patrol" DESCR="TV HD", START_Time="2021-01-13 09:00:00", NAME="Crime Patrol" DESCR="TV HD", START_Time="2021-01-14 09:00:00", NAME="Fire Patrol" DESCR="TV HD", START_Time="2021-01-15 09:00:00", NAME="Ambulance Patrol" DESCR="TV HD", START_Time="2021-01-16 09:00:00", NAME="Crime Patrol" I would like to extract data for the last two days based on START_time. eg todays date is 2021-01-15 returned data DESCR="TV HD", START_Time="2021-01-14 09:00:00", NAME="Fire Patrol" DESCR="TV HD", START_Time="2021-01-15 09:00:00", NAME="Ambulance Patrol" I have tried to use relative time/strptime but i am unable to get the time frame correct. My problem is that most solutions require my to eval START_Time to _time using strftime. However as my data is in a summary index the above data has multiple time entries in front of it and to get the latest time i use earliest=-60m@m latest=@m. This causes me issues when modifying _time in a search. I have tried to use this solution as a guide. https://www.splunk.com/en_us/blog/tips-and-tricks/get-time-on-your-side-how-to-sort-by-more-than-one-time-field.html The time picker is ignored as i am using earliest/latest. i only get details for the last hour, if i change it to earliest=-120m@m latest=@m i get a double line. 2021-01-15 14:25:13.206 DESCR="TV HD", START_Time="2021-01-14 09:00:00", NAME="Fire Patrol" 2021-01-15 13:25:13.206 DESCR="TV HD", START_Time="2021-01-14 09:00:00", NAME="Fire Patrol" Does any one have any ideas? Thanks.
... View more
05-24-2020
01:43 AM
Thank you richgalloway this worked.
For those seeking solution, here is the code for filldown, nice and easy -
index =systems sourcetype = stream_stack PID=0x0055
| eval Packets=packets*208
| stats latest(Packets) AS Packets by host
| appendcols
[ search index=systems sourcetype=soms_file_size process=soms | stats latest(file_size) AS file_size latest(file_name) AS file_name by process ]
| filldown process, file_size, file_name
| eval match=if(Packets=file_size,"OK","Error")
| table process match Packets file_size file_name host
... View more
05-21-2020
04:19 AM
Hi,
i have a query that returns two lines of results based on two hosts.
i then get a result from another query that only returns one line.
When i do the eval command i get a correct 'Match' for the first line but no entry for the second.
How do i apply the 'appendcol' result to both lines?
index =systems sourcetype = stream_stack PID=0x0055
| eval Packets=packets*208
| stats latest(Packets) AS Packets by host
| appendcols
[ search index=systems sourcetype=soms_file_size process=soms | stats latest(file_size) AS file_size latest(file_name) AS file_name by process ]
| eval match=if(Packets=file_size,"OK","Error")
| table process match Packets file_size file_name host
RESULT
process match file_size file_name host
soms OK 27666832 DR_270919_P_5068_719_750_750.out chietrp01
Error chietrp02
thanks,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
