Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About prateeksawhney
prateeksawhney
Explorer
Member since:
08-20-2020
03-02-2021
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 08-20-2020 |
Activity Feed
- Karma Re: limits.conf is not present under /opt/splunk/etc/system/local for manjunathmeti. 03-02-2021 03:56 AM
- Tagged limits.conf is not present under /opt/splunk/etc/system/local on Getting Data In. 03-01-2021 09:33 PM
- Tagged limits.conf is not present under /opt/splunk/etc/system/local on Getting Data In. 03-01-2021 09:33 PM
- Tagged limits.conf is not present under /opt/splunk/etc/system/local on Getting Data In. 03-01-2021 09:32 PM
- Posted limits.conf is not present under /opt/splunk/etc/system/local on Getting Data In. 03-01-2021 08:28 PM
- Posted Re: How to extract latest events of particular field. on Splunk Search. 11-05-2020 12:53 AM
- Posted Re: How to extract latest events of particular field. on Splunk Search. 11-05-2020 12:52 AM
- Posted Re: How to extract latest events of particular field. on Splunk Search. 11-04-2020 08:52 PM
- Posted Re: How to extract latest events of particular field. on Splunk Search. 11-03-2020 12:19 AM
- Posted How to extract latest events of particular field. on Splunk Search. 11-02-2020 08:14 PM
- Posted Re: How to extract latest event from particular field. on Splunk Search. 11-01-2020 10:15 PM
- Posted Re: How to extract latest event from particular field. on Splunk Search. 10-30-2020 01:02 AM
- Posted Re: How to extract latest event from particular field. on Splunk Search. 10-30-2020 01:00 AM
- Posted Re: How to extract latest event from particular field. on Splunk Search. 10-30-2020 12:54 AM
- Posted Re: How to extract latest event from particular field. on Splunk Search. 10-30-2020 12:21 AM
- Posted Re: How to extract latest event from particular field. on Splunk Search. 10-29-2020 11:57 PM
- Posted Re: How to extract latest event from particular field. on Splunk Search. 10-28-2020 12:17 AM
- Posted Re: How to extract latest event from particular field. on Splunk Search. 10-28-2020 12:05 AM
- Karma Re: How to extract latest event from particular field. for gcusello. 10-27-2020 11:59 PM
- Posted How to extract only latest events from particular field. on Splunk Search. 10-27-2020 11:53 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-01-2021
08:28 PM
Hi All, I need your help urgently, I am facing issue with one of the forwarder as it keeps taking lots of space in /opt directory and due to which sometimes it stops running. Upon checking further I noticed that this directory is taking maximum space. /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db On further investigation I came to know that if I do changes in limits.conf file I can limit size of this directory. But unfortunately I cannot find this file limits.conf under /opt/splunk/etc/system/local. Please suggest what can I do about it. Any replies to this will be highly appreciated. Also please correct me if I am using a wrong approach here. Thanks in advance. Prateek
... View more
Labels
- Labels:
-
universal forwarder
11-05-2020
12:53 AM
@ITWhisperer Hi, Thanks for your response. But your query is not returning any results either.
... View more
11-05-2020
12:52 AM
@t_shreya This query is not returning any results.
... View more
11-04-2020
08:52 PM
@t_shreya Your Question - Does the SNAPTIME_NEW have all the values that are older than last 15 min? Answer - Yes I have updated my question, I need to look for only today's events in a sorted manner. As of now I am getting around 22,000 events in last 15 mins which contain old and new both dates. Screenshot attached.
... View more
11-03-2020
12:19 AM
@t_shreya Thanks for your response, but this does not seem to be returning any result. Screenshot attached for your reference. And yes field is already in epoch time.
... View more
11-02-2020
08:14 PM
Hi Folks, I need your help in fetching latest event from a particular field. Sharing you a sample event and query when I execute for last 15 mins. Query -> index=Blah sourcetype=blah_blah* Example event :- 2020-11-02 05:35:00.319 , SOURCE= " Tullett ", COUNTVOL= " 879 ", TO_CHAR ( SNAPTIME ,' MM/DD/YYHH24:MI:SS ') = " 08/31/20 00:59:00" Initial date on this event seems to be OK which is todays date" 2020-11-02 05:35:00.319 ", but date at the end which is field SNAPTIME_NEW seems to be old " 08/31/20 00:59:00" . Can you please help me with a query so that I see only "todays" events in a sorted manner by date in field SNAPTIME_NEW when I execute query for last 15 mins. Screenshot attached. Thanks, Prateek
... View more
Labels
- Labels:
-
field extraction
-
fields
11-01-2020
10:15 PM
@gcusello Were you able to check the same, any response will be highly appreciated. Thanks again for helping.
... View more
10-30-2020
01:02 AM
@gcusello sure, attaching the screenshot of logs.
... View more
10-30-2020
01:00 AM
@gcusello Sure, updated screenshot attached.
... View more
10-30-2020
12:54 AM
@gcusello Attaching it again.
... View more
10-30-2020
12:21 AM
@gcusello Apologies and Thanks for highlighting the mistake. I have updated the query but still no success. It is still showing old events. Screenshot attached.
... View more
10-29-2020
11:57 PM
@gcusello Hi, I have updated my SNAPTIME time format as mentioned by you in your last comment. This is my new format of event in splunk. 2020-10-30 06:40:00.056 , SOURCE= " Quotes ", COUNTVOL = " 22818 ", TO_CHAR ( SNAPTIME ,' MM/DD/YYHH24:MI:SS ') = " 10/19/20 07:00:02" And I am using this query as mentioned by you. index=Blah sourcetype=blah* | eval SNAPTIME_epoch=strptime(SNAPTIME, "%m/%d/%Y %H:%M:%S") | sort -SNAPTIME_epoch I am not using head 1 command as I need all the results. | head 1 I have updated my field extraction for the new format of SNAPTIME. But the result I am getting still does not seem to be helping as I can still see old events. I have attached screenshot for your reference. Please check. Thanks again.
... View more
10-28-2020
12:17 AM
@gcusello Time period I am using is only last15 mins. Can we do something in query that when I execute it for last 15 mins, it shows me data with today's date only. Particularly in field SNAPTIME and that too with latest event on the top.
... View more
10-28-2020
12:05 AM
@gcusello Thanks for your prompt response. I can see latest event on the top with field SNAPTIME. This command is helping me a bit but not much. Actually with this command I can still see events with old date and I do not want them. I need events with just today's date in a sorted manner from field SNAPTIME. I have used this command - index=Blah sourcetype=blah_blah*
| reverse I am not using head in this as I need all events with today's date.
... View more
10-27-2020
11:53 PM
Hi Folks, I need your help in fetching latest event from a particular field. Sharing you a sample event and query when I execute for last 15 mins. Query -> index=Blah sourcetype=blah_blah* Example event :- 2020-11-02 05:35:00.319 , SOURCE= " Tullett ", COUNTVOL= " 879 ", TO_CHAR ( SNAPTIME ,' MM/DD/YYHH24:MI:SS ') = " 08/31/20 00:59:00" Initial date on this event seems to be OK which is todays date" 2020-11-02 05:35:00.319 ", but date at the end which is field SNAPTIME_NEW seems to be old " 08/31/20 00:59:00" . Can you please help me with a query so that I see only latest events in a sorted manner by date in field SNAPTIME_NEW when I execute query for last 15 mins. Screenshot attached. Thanks, Prateek
... View more
Labels
- Labels:
-
field extraction
09-17-2020
07:16 PM
yes correct, frequency is 15 mins, monday to friday.
... View more
09-16-2020
10:41 PM
Hi All, I have created a custom alert in splunk and I want to put a suppression window in that alert on daily basis from 12am UTC -7am UTC. How can this be achieved? from cron expression or adding something to the original query? Please help!!!
... View more
Labels
- Labels:
-
saved search
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-02-2021
08:11 AM
|
