Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ganinurceski
ganinurceski
Engager
Member since:
11-27-2019
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 11-27-2019 |
Activity Feed
- Karma Re: How can I add the date, from which the events happend, in a chart with a "chart count by field1, field2" command? for somesoni2. 06-05-2020 12:51 AM
- Posted Re: How to declare the timerange in a splunk report, which will be generate once a week? on Dashboards & Visualizations. 02-13-2020 06:22 AM
- Posted Re: How to declare the timerange in a splunk report, which will be generate once a week? on Dashboards & Visualizations. 02-13-2020 06:06 AM
- Posted Re: How to declare the timerange in a splunk report, which will be generate once a week? on Dashboards & Visualizations. 02-13-2020 06:04 AM
- Posted How to declare the timerange in a splunk report, which will be generate once a week? on Dashboards & Visualizations. 02-13-2020 05:03 AM
- Tagged How to declare the timerange in a splunk report, which will be generate once a week? on Dashboards & Visualizations. 02-13-2020 05:03 AM
- Tagged How to declare the timerange in a splunk report, which will be generate once a week? on Dashboards & Visualizations. 02-13-2020 05:03 AM
- Posted Re: Add a percentage row into a chart? on Splunk Search. 02-12-2020 11:35 PM
- Posted Re: Add a percentage row into a chart? on Splunk Search. 02-12-2020 12:29 PM
- Posted Add a percentage row into a chart? on Splunk Search. 02-12-2020 02:28 AM
- Tagged Add a percentage row into a chart? on Splunk Search. 02-12-2020 02:28 AM
- Tagged Add a percentage row into a chart? on Splunk Search. 02-12-2020 02:28 AM
- Tagged Add a percentage row into a chart? on Splunk Search. 02-12-2020 02:28 AM
- Posted Re: How can I add the date, from which the events happend, in a chart with a "chart count by field1, field2" command? on Getting Data In. 02-06-2020 12:55 AM
- Posted Re: How can I add the date, from which the events happend, in a chart with a "chart count by field1, field2" command? on Getting Data In. 02-06-2020 12:53 AM
- Posted How can I add the date, from which the events happend, in a chart with a "chart count by field1, field2" command? on Getting Data In. 02-05-2020 12:19 AM
- Tagged How can I add the date, from which the events happend, in a chart with a "chart count by field1, field2" command? on Getting Data In. 02-05-2020 12:19 AM
- Tagged How can I add the date, from which the events happend, in a chart with a "chart count by field1, field2" command? on Getting Data In. 02-05-2020 12:19 AM
- Posted Re: How to remove specified values of a field from a table? on Splunk Search. 12-13-2019 05:17 AM
- Posted How to remove specified values of a field from a table? on Splunk Search. 12-13-2019 01:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-13-2020
06:22 AM
Send an email
... View more
02-13-2020
06:06 AM
I've picked the right timerange with the picker. I just want to remark it in the report, so that we can see, when this events happend.
... View more
02-13-2020
06:04 AM
And where this information about the timerange appear? maybe in the filename?
... View more
02-13-2020
05:03 AM
Hello there
There is a report, which shows some useful informations about some Application. Whatever.
Now I want to declare in the the report the timerange (last week, example 03.02.2020 00;00 until 10.02.2020 00:00). Or maybe there is possibility to declare the timerange in the description of the report, like a variable or something like that.
Here is my string, maybe i can build in something:
index=smsc tag=MPRO_PRODUCTION DATA="8000000400000000" OR "8000000400000058"
| dedup DATA
| chart count by SHORT_ID, command_status_code
| search NOT ESME_RTHROTTLED=0
| eval "THROTTLING %"=(ESME_RTHROTTLED/(ESME_RTHROTTLED + ESME_ROK)*100)
| sort - ESME_RTHROTTLED
| head 15
Thanks for your help!
... View more
02-12-2020
02:28 AM
Hello there!
I want to add a percentage row into a chart table.
string:
index=smsc tag=MPRO_PRODUCTION DATA="8000000400000000" OR "8000000400000058" | dedup DATA | chart count by SHORT_ID, command_status_code | search NOT ESME_RTHROTTLED=0 | sort - ESME_RTHROTTLED | head 15
And the chart table:
The red result, is what i need to add. the Value in it should be calculated like the blue marked.
ESME_RTHROTTLED value get divided by ESME_RTHROTTLED and ESME_ROK together.
Can someone help me?
... View more
02-06-2020
12:55 AM
2020-02-05 23:59:59.973348 SESSION_ID=... TRANS_ID=... MSG_ID=... SHORT_ID=... ORIGINATOR="IP":"Port" PROXY="IP":"Port" DESTINATION="IP":"Port" RESULT=0 LENGTH=25 DATA=000000198000000400000000000000A3364636354337434500 EXTRA=
i've removed the field values
... View more
02-06-2020
12:53 AM
This looks not bad, but now one Field Value (command_status_code), don't show up any count/Numbre.
The timestamp is now available. The second field value (command_status_code) is right (right count).
... View more
02-05-2020
12:19 AM
Or maybe it is easier, to mention the date in the description, when an e-mail is sent.
This is my search at the moment:
index=smsc tag=MPRO_PRODUCTION DATA ="*" command_id_description="*" NOT (...) command_status_code="*" NOT (...) | dedup DATA | chart count by SHORT_ID, command_status_code | search NOT ESME_RTHROTTLED=0 | sort - ESME_RTHROTTLED | head 15
Thanks for your help!
... View more
12-13-2019
05:17 AM
Thx for response!
I've added | search NOT ERROR="0" and it worked!
... View more
12-13-2019
01:48 AM
Hello there!
I need some help. I have a table, and in that table, there are are a "SHORT_ID", "DATA1 -> ERROR" & "DATA2 -> NO_ERROR" Row. Now I want to remove all results, where the DATA1 Field has a value of 0, zero.
The String look like this...
index= tag= DATA="000000108000000400000058" OR "000000198000000400000000000*" | rex field=DATA "(?P"000000108000000400000058")" | rex field=DATA "(?P"000000198000000400000000")" | chart count by SHORT_ID, ERROR | rename 000000108000000400000058 as ERROR | sort - ERROR | rename NULL as NO_ERROR*
I want to remove every Value of NO_ERROR which has zero in it.
I hope the question is clear 🙂
Thx for response
... View more
- Tags:
- splunk-enterprise
11-28-2019
06:23 AM
index="Value of index" tag="Value of Tag" DATA="code for data1" | chart count by parameter1 | rename count as "Count of DATA" | sort - "Count of DATA"
As a result, i want to see a table, which display every parameter1 Value, the count of data1 and count of data2 (which isnt in the string within) but both data values seperate. What can I do?
... View more
