About Learner

Learner · ‎05-26-2021

Query which I specified, is my actual query.

Learner · ‎05-26-2021

Hi everyone, below is my sample query index=xyz source=ABC | stats count If I schedule this search then result have to saved on path "C:\\demo" automatically. I don't have access to \var repository so cannot make changes over there. I'm using windows OS. How i can get the data on path automatically?

Learner · ‎05-21-2021

thank you very much @ITWhisperer . it solved some part of my problem. i checked the values for "AvgResponseTime" and "P95ResponseTime" and they are not matching. Suppose i ran my code without filtering _time, i get values as 0.4 and 1.7 to "AvgResponseTime" and "P95ResponseTime" respectively. but if i use your code i get average values of "AvgResponseTime" and "P95ResponseTime" as 0.4 and 1.9 respectively. why is that so? and how to solve this? thanks, in advance!

Learner · ‎05-19-2021

Hi everyone, index=xyz source="something" |stats earliest(_time) as minTime latest(_time) as maxTime values(activityName) as activityName values(accessSeekerId) as accessSeekerId values(businessChannel) as businessChannel values(status) as status values(ttStatus) as ttStatus values(feature) as feature by requestId | eval duration = maxTime - minTime | stats avg(duration) AS "AvgResponseTime" perc95(duration) AS "P95ResponseTime" If I run this script for a day then I get some non-zero value for AvgResponseTime and P95ResponseTime also get different values for minTime and maxTime. But if i run following script for same time, I get same values for minTime and maxTime. index=xyz source="something" |bin _time span=1d |stats earliest(_time) as minTime latest(_time) as maxTime values(activityName) as activityName values(accessSeekerId) as accessSeekerId values(businessChannel) as businessChannel values(status) as status values(ttStatus) as ttStatus values(feature) as feature by requestId _time | eval duration = maxTime - minTime || eval Time=strftime(_time , "%d/%m/%Y %H:%M") | stats avg(duration) AS "AvgResponseTime" perc95(duration) AS "P95ResponseTime" by Time At the end I get 0 for AvgResponseTime and P95ResponseTime which is not matching with above query as value of duration gets as 0. I want output of based on each day AvgResponseTime and P95ResponseTime I hope I give clear idea about my issue. What would I do to resolve this?

Learner · ‎04-20-2021

index=dummy <mySearchCondition>| search response_code1!=200| stats count when i search for this query i get output as 0 in count column. but when i try this query: index=dummy <mysearchCondition> | bin _time span=1d |eval Time=strftime(_time , "%d/%m/%Y %H:%M")| search response_code1!=200| stats count by Time expected ans for this: Time count 2021-04-20 04:36 0 i'm not able to see any output. what to do?

Learner · ‎04-08-2021

Hi all, endswith=(notificationType="TestCompleted" OR notificationType="TestCancelled" OR notificationType="TestRejected" ) this is my part of query. when normally we use boolean like AND, OR they are in orange. but while using them with endswith, colour of booleans are grey. so is it right, that colour of boolean is different? If not then how to correct that?

Learner · ‎12-20-2020

i have tried | rex "correlation_id\\":\\"(?<CorrelationId4>[^\"]+)\\" but it gives me error as Error in 'rex' command: Encountered the following error while compiling the regex 'correlation_id\:\(?<CorrelationId4>[^"]+)\': Regex: unmatched closing parenthesis.

Learner · ‎12-20-2020

not getting the data

Learner · ‎12-10-2020

not getting the data. what if data is like: "{\"data\":{\"correlation_id:\"51g0d88f-3ab8-4mom-betb-b31ed6e1662z\",\"u_originator_uri

Learner · ‎12-10-2020

thank you @renjith_nair for help. now im again trying to extract correlation_id as CorrelationId4. {"data":{"correlation_id":"51g0d88f-3ab8-4mom-betb-b31ed6e1662z","u_originator_uri" i used following query to extract value: | rex "\{\"correlation\_id\"\:\"(?<CorrelationId4>[^\<]*)\s*\"" but now, i am not getting field as CorrelationId4. request you to guide further on this

Learner · ‎12-07-2020

hi all, in my original search im getting data by folloing command: | stats range(_time) as timetaken by CorrelationID| stats count as Total, avg(timetaken) as AvgResponseTime, perc95(timetaken) as P95ResponseTime but now, i want this data on hourly basis. so i tried the following script: |bin _time span=1d |eval Time=strftime(_time , "%d/%m/%Y %H:%M")| stats range(_time) as timetaken by CorrelationID| stats count as Total, avg(timetaken) as AvgResponseTime, perc95(timetaken) as P95ResponseTime by Time but this gives me 0 value. i'm seeking for the right way to get data on hourly basis.

Learner · ‎12-01-2020

yes, but still not getting right answer. i guess there is tab space rather than blank space before Duration. if tab, then how to write that?

Learner · ‎12-01-2020

there is more raw data after xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 as 'xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 Duration ---'. after using using your query, i'm getting data as 'xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 Duration ---' but i want data as 'xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1'

Learner · ‎12-01-2020

Hi all, I am having data as follows: REPORT RequestId: xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 i want a field as CorrelationId3 which is having xxxx2722-xx0d-xx35-95xx-xxxxxxb6b2e1 value

Learner · ‎11-05-2020

hi everyone, i want to scheduled a report at 00 hrs, from 1st to 15th day of previous month and this should run on 1st day of current month

Learner · ‎10-29-2020

hi all, i have no access to conf files as i have to admin access. i'm trying to do by using advanced edit. i have changed all maxresult value from 50000 to 500000 but not getting result more than 50000. what to do now?

Learner · ‎10-11-2020

Hi everyone, i'm trying to write query for this issue since long time but not able to get proper answer. Appreciate your help in advance! i have a dashboard in specific app of splunk which contains multiple scripts as panel. dashboard contains a submit button. when clicked on that button all scripts of panel start its execution. i want to know: total time require to the dashboard for each time to load data after clicking submit button to the executing all scripts total number of queries run total time require to run each individual script of dashboard in X days how many time the dashboard was loaded

Learner · ‎10-01-2020

some part is solved by your solution @renjith_nair , thank you for that! but now i'm getting only 50000 rows of data in csv file when i gave limit as 1000000. what to do now?

Learner · ‎09-30-2020

i am writing scripts for dashboard and report in splunk's search but i need to do some modification in its html tags. where i can do that changes?

Learner · ‎09-29-2020

i have created a report and scheduled it. i have added my email address to get result in csv format. but when the count of result rows are greater than 10000, only first 10000 rows are present in csv file. i want all data (more than 10000 rows) in my csv file. is there any way to resolve this?

Learner · ‎09-29-2020

i want an query for this, without using rest command

Learner · ‎09-21-2020

Hi, i want to get count of all panels present in the dashboard and total time required to each panel to execute the query (there is different query for each panel) after clicking submit button.

Learner · ‎08-16-2020

hi @mdorobek , i have same doubt. i tried your query but it gives me error at each 'dmc'. as you further said, check on macros but there also i don't find out anything. as i am to new to splunk i am interesting to learn. thanks in advance

Learner · ‎08-13-2020

Will it be possible to solve this problem without using Dashboard Monitoring App

Learner · ‎08-12-2020

I need a query that will give the count of views of dashboard, number of queries executed by dashboard, time taken by queries, count of executions by user.

Posts	25
Solutions	0
Karma Given	2
Karma Received	2
Member Since	‎08-12-2020

Online Status	Offline
Date Last Visited	‎10-28-2022 04:14 AM

Export csv data to specific folder

How to get data by _time

how to get data as per _time when count is 0

what is colour code of boolean while using endswit...

get data by time

How to extract data using rex?

cron expression for scheduled report

How to get details of dashboard?

get html script of dashboard

how to get all data of report in csv format?

Re: How to get data by _time

Export csv data to specific folder

Re: How to get data by _time

How to get data by _time

how to get data as per _time when count is 0

what is colour code of boolean while using endswit...

Re: How to extract data using rex?

Re: How to extract data using rex?

Re: How to extract data using rex?

Re: How to extract data using rex?

get data by time

Re: How to extract data using rex?

Re: How to extract data using rex?

How to extract data using rex?

cron expression for scheduled report

Re: How to overcome CSV max results to email?

How to get details of dashboard?

Re: how to get all data of report in csv format?

get html script of dashboard

how to get all data of report in csv format?

Re: How to get data related to panels?

How to get data related to panels?

Re: How can I measure the dashboard load time ?

Re: how can i create a query to find out usage of ...

how can i create a query to find out usage of dash...