About rangarbus

rangarbus · ‎03-17-2022

Hello Folks, I have the below query on one of my dashboard panel. Here I pass the IN_BUSINESSDATE field value from dashboard (form input) with default as % and prefix & sufix value as %. So incase user does not provide, the query gets IN_BUSINESSDATE as %%% (its ok) index=dockerlogs | search app_name = ABCD AND logEvent="Delivered" | spath input=businessKey path=businessDate output=businessDate | spath input=businessKey output=sourceSystem path=sourceSystem | eval businessDate=substr(businessDate,1,10) | where like(businessDate, "$IN_BUSINESSDATE$") | stats count by businessDate, sourceSystem Now I would like to change the stats on the query as below if IN_BUSINESSDATE is not provided (meaning value is %%%) | stats count by sourceSystem How can I achieve this ? Thank you!

rangarbus · ‎02-11-2022

Hello Splunk Experts: From a system, we receive following events in splunk. I would like to get the event which doesn't have logEvent as Received but has only logEvent as Delivered. traceId field will have same value on both Received and Delivered events. Here in the below example, traceId=101 is such an event. {"logEvent":"Received","traceId": "100","message":"Inbound received", "id" : "00991"} {"logEvent":"Delivered","traceId": "100","message":"Inbound sent", "id" : "00991-0"} {"logEvent":"Delivered","traceId": "101","message":"Inbound sent", "id" : "00992-0"} {"logEvent":"Received","traceId": "102","message":"Inbound received","id" : "00993"} {"logEvent":"Delivered","traceId": "102","message":"Inbound sent","id" : "00993-0"}

rangarbus · ‎01-10-2022

It worked actually. My input had issues which caused the SingleValue to be empty.

rangarbus · ‎01-10-2022

Thanks @ITWhisperer I am able to see the data on table format for all app_names and logEvents. But I couldn't get the "count" on the Single value dashboard based on "app_name" and "logEvent" filter condition. index=np-dockerlogs sourcetype=sales | rename log_processed.* as * | eval logEvent =upper(logEvent) | search logEvent IN ("RECEIVED", "DELIVERED", "MISSING") | chart count by app_name logEvent | eval RECEIVED=RECEIVED-MISSING | table app_name RECEIVED DELIVERED | untable app_name logEvent count | search app_name=app1 AND logEvent="RECEIVED" | stats sum(count) as "RECEIVED"

rangarbus · ‎01-10-2022

I am looking for help on stats with eval Input Events (each json is a event): { "app_name": "app1","logEvent": "Received"} { "app_name": "app1","logEvent": "Received"} { "app_name": "app1","logEvent": "Missing"} { "app_name": "app1","logEvent": "Delivered"} { "app_name": "app2","logEvent": "Received"} { "app_name": "app2","logEvent": "Delivered"} My current query is : index=np-dockerlogs sourcetype=sales | rename log_processed.* as * | eval logEvent =upper(logEvent) | search logEvent IN ("RECEIVED", "DELIVERED", "MISSING") | stats count by logEvent app_name Current Output: app1 RECEIVED 2 app1 MISSING 1 app1 DELIVERED 1 app2 RECEIVED 1 app2 DELIVERED 1 Output i want to generate is to remove MISSING and subtract the count of Missing from Received. Received = Total Count of Received - Total Count of Missing Delivered = Total Count of Delivered app1 RECEIVED 1 app1 DELIVERED 1 app2 RECEIVED 1 app2 DELIVERED 1 Thank you

rangarbus · ‎08-17-2021

Hey 👋 , I have a usecase where i need to take a difference between events and report the ones which are missing. Example Events (each line is an event). txId will be identifier field which will be sent with type "R", "D" or "F" Here in this case, i need to identify the txId for which i have "R" but missing "D" or "F" { "txId" : "0001", "type": "R"} { "txId" : "0001", "type": "F"} { "txId" : "0002", "type": "R"} { "txId" : "0003", "type": "R"} { "txId" : "0003", "type": "D"} In the above sample events, txId = 0002 is the one missing D or F type. I need to count such events & show in a panel as well as drill-down to those specific R events. Additional challenge is there will be more than 3 million "R" events and corresponding "D" or "F" events. Can you please help on this diff ?

rangarbus · ‎07-30-2021

I was able to make this work by placing the js on $SPLUNK_HOME/etc/apps/search/appserver/static Thank you https://docs.splunk.com/Documentation/Splunk/8.2.1/AdvancedDev/UseCSS

rangarbus · ‎07-30-2021

Thanks KV. Where should i place this a.js file in Splunk?

rangarbus · ‎07-30-2021

Below are the events: { "kubernetes" : { "pod_name" : "p1" }, traceId: "t-1" } { "kubernetes" : { "pod_name" : "p1" }, traceId: "t-2" } { "kubernetes" : { "pod_name" : "p2" }, traceId: "t-4" } { "kubernetes" : { "pod_name" : "p3" }, traceId: "t-5" } I am looking for a dashboard with 2 panels. 1. Showing the unique # of pods 2. Table with Pod Name, # of Number of unique traces For the above event, panels will be 1. Showing the unique # of pods = 3 2. Table with Pod Name, # of Number of unique traces ---------------------------------- | POD NAME | # of Traces | ---------------------------------- | p1 | 2 | ---------------------------------- | p2 | 1 | ---------------------------------- | p3 | 1 | ----------------------------------

rangarbus · ‎07-26-2021

I have a json in a field which i like to show on the dashboard as pretty formatted rather single line string. Is there an option in Splunk dashboard to do this? Currently i have the below {"A":"NAME", "B":"AGE"} In dashboard one of the column value will be this json which i like to render as { "A": "NAME", "B": "AGE" }

rangarbus · ‎06-24-2021

I have 4 applications. All of them generate events like RECEIVED, DELIVERED and DISCARDED. In my dashboard, i want to have panel which shows : sum of event count of RECEIVED from cs-app1 , cs-app2 and cs-app3. sum of event count of DELIVERED from cs-app4 and sum of all DISCARDED from all of the app. Currently these 3 are displayed as 3 different timecharts panels. I would like to combine them as one single timechart which would reduce the clutter on the dashboard.. Is that possible.? If so how should i frame the query which is efficient. Event example { "log_processed" : { "message" : { "app_name" : "cs-app1", "logEvent" : "RECEIVED" } } } RECEIVED events index=dockerlogs | search log_processed.app_name IN ("cs-app1", "cs-app2","cs-app3") | spath input=log_processed.message output=logEvent path=logEvent | search logEvent = "RECEIVED" | timechart span=1d count(logEvent) by logEvent DELIVERED events index=dockerlogs kubernetes.namespace_name=default | search log_processed.app_name IN ("cs-app4") | spath input=log_processed.message output=logEvent path=logEvent | search logEvent = "DELIVERED" | timechart span=1d count(logEvent) by logEvent DISCARDED events index=dockerlogs kubernetes.namespace_name=default | search log_processed.app_name=* | spath input=log_processed.message output=logEvent path=logEvent | search logEvent = "DISCARDED" | timechart span=1d count(logEvent) by logEvent

rangarbus · ‎06-15-2021

Thank you @kamlesh_vaghela. It worked.. Really appreciate your quick help!

rangarbus · ‎06-15-2021

Thank you @kamlesh_vaghela . I got the problem, the app_name are prefixed with static string "cs-" which cause the resulted columns to be sorted in asc order rather just following the event sequence. | makeresults | eval raw="{ \"log_processed\": { \"app_name\": \"cs-xerox\", \"message\": {\"type\":\"R\",\"bk\":\"Cust-1|Order-2\"}, \"tId\": \"f7ac16537e4e89d16c0f5b8c83bd45f2\" }}@@{ \"log_processed\": { \"app_name\": \"cs-xerox\", \"message\": {\"type\":\"D\",\"bk\":\"Cust-1|Order-2\"}, \"tId\": \"f7ac16537e4e89d16c0f5b8c83bd45f2\" }}@@{ \"log_processed\": { \"app_name\": \"cs-printer\", \"message\": {\"type\":\"R\",\"bk\":\"Cust-1|Order-2\"}, \"tId\": \"f7ac16537e4e89d16c0f5b8c83bd45f2\" }}@@{ \"log_processed\": { \"app_name\": \"cs-printer\", \"message\": {\"type\":\"D\",\"bk\":\"Cust-1|Order-2\"}, \"tId\": \"f7ac16537e4e89d16c0f5b8c83bd45f2\" }}@@{ \"log_processed\": { \"app_name\": \"cs-copier\", \"message\": {\"type\":\"R\",\"bk\":\"Cust-1|Order-2|1\"}, \"tId\": \"f7ac16537e4e89d16c0f5b8c83bd45f2\" }}@@{ \"log_processed\": { \"app_name\": \"cs-copier\", \"message\": {\"type\":\"D\",\"bk\":\"Cust-1|Order-2|1\"}, \"tId\": \"f7ac16537e4e89d16c0f5b8c83bd45f2\" }}", raw=split(raw,"@@") | mvexpand raw | rename raw as _raw | eval t= 1000 | accum t | eval _time=_time + t | fields - t | extract | rename log_processed.* as *, message.* as message_* | fields tId app_name message_bk message_type | stats max(eval(if(message_type="D",_time,null()))) as message_type_D min(eval(if(message_type="R",_time,null()))) as message_type_R by tId app_name | eval diff= message_type_D - message_type_R, app_name="app_name=".app_name.". Time took (Sec)" | chart values(diff) as diff over tId by app_name | addtotals Ideally, the columns should have been tId, app_name=cs-xerox, app_name=cs-printer, app_name=cs-copier - just like the event sequence.

rangarbus · ‎06-15-2021

Thank you @kamlesh_vaghela . It worked. Only follow-up question i have is whether it is possible to sort the app_name in a specific sequence on the dashboard. ? app_name required on sequence as "Xerox, Printer, Copier, Marker" With the current dashboard output the app_name are sorted as "Copier, Marker, Printer , Xerox"

rangarbus · ‎06-13-2021

@kamlesh_vaghela Example Events are as below. There could be up to app-1 to app-6 (example here shows app-1 to app-3). { "log_processed": { "app_name": "app-1", message: {"type":"R","bk":"Cust-1|Order-2"}, "tId": "f7ac16537e4e89d16c0f5b8c83bd45f2" } { "log_processed": { "app_name": "app-1", message: {"type":"D","bk":"Cust-1|Order-2"}, "tId": "f7ac16537e4e89d16c0f5b8c83bd45f2" } { "log_processed": { "app_name": "app-2", message: {"type":"R","bk":"Cust-1|Order-2"}, "tId": "f7ac16537e4e89d16c0f5b8c83bd45f2" } { "log_processed": { "app_name": "app-2", message: {"type":"D","bk":"Cust-1|Order-2"}, "tId": "f7ac16537e4e89d16c0f5b8c83bd45f2" } { "log_processed": { "app_name": "app-3", message: {"type":"R","bk":"Cust-1|Order-2|1"}, "tId": "f7ac16537e4e89d16c0f5b8c83bd45f2" } { "log_processed": { "app_name": "app-3", message: {"type":"D","bk":"Cust-1|Order-2|1"}, "tId": "f7ac16537e4e89d16c0f5b8c83bd45f2" } Here tId is same for all events. So we need to group all events by tId field and generate the dashboard below

rangarbus · ‎06-12-2021

Hello Fo lks, In my current use case i receive events with 3 fields as json . { 'tid' '123', ' 'type': 'R', 'app_name': 'app-1' } Here app_name (app-1 to app-6) are micro services in which tid is generated by app-1 and passed on to other apps. Each app generate 2 events - with type as R and D. So for a transaction there will be 12 events with unique tid. I want generate a dashboard just out of time range the customer selects so that they get a tabular panel with below columns with the time the event was received. tid | app-1 R | app-1 D | time took| •••• for each app-* If I understand, I need to have 2 searches. (1) get unique tid in app-1 and (2) using the unique tid , search app events and form the above table Can you pls help me to frame this query as I am stuck with append query.

rangarbus · ‎05-25-2021

Hello Friends, I am looking for your help for a rex expression. message = [2021-05-26 00:00:33,477] {taskinstance.py:669} INFO - Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]> I would like to split this message field as below fields: logDateTime = 2021-05-26 00:00:33,477 logLevel = INFO logMessage = Dependencies all met for <TaskInstance: example_dag_oidc.test_bash 2021-05-25 00:00:00+00:00 [None]> Thanks

rangarbus · ‎03-10-2021

Hey friends, I am facing a problem with my new dashboard. My Event: { kubernetes: { container_name: adapter docker_id: a15db0337d70979f0f6e042f5bd609bfe1c42a97472faea56c77924c2ec43158 namespace_name: default pod_name: adapter-767585d989-x5fj7 } log: {"thread":"simpleMessageListenerContainer-2","level":"INFO","loggerName":"adapter.repository.S3Repository","message":"Getting s3object bucket=adapter-test, key=in/1234.json","endOfBatch":true,"loggerFqcn":"org.apache.logging.slf4j.Log4jLogger","instant":{"epochSecond":1615350586,"nanoOfSecond":904000000},"threadId":14,"threadPriority":5,"app_name":"adapter"} log_processed: { app_name: adapter endOfBatch: true instant: { epochSecond: 1615350586 nanoOfSecond: 904000000 } level: INFO loggerFqcn: org.apache.logging.slf4j.Log4jLogger loggerName: adapter.repository.S3Repository message: Getting s3object bucket=adapter-test, key=in/1234.json thread: simpleMessageListenerContainer-2 threadId: 14 threadPriority: 5 } stream: stdout time: 2021-03-10T04:29:46.90639262Z } When i create a dashboard out of this event, I get 2 entries on each cell of the dashboard. My dashboard query is as below index=logs sourcetype=test | rename log_processed.app_name as AppName | rename log_processed.loggerName as LoggerName | rename log_processed.level as LogLevel | rename log_processed.message as Message | rename kubernetes.pod_name as EKS_POD | table _time, AppName, LoggerName, LogLevel, Message, EKS_POD | where Message!="" Output is like: Ideally the output should be : Could you please help on this.

rangarbus · ‎01-14-2021

rangarbus · ‎01-13-2021

Hey Team I have events which contains a field "job_code". index=default source=jobfeed I have a lookup (jobs.csv) which has the list of allowed job codes. jobCode jobDesc 000 EX 001 PT My requirement is to generate an alert every day, If any of the jobCode available in lookup didn't show up at all on the events for past 2 days. For instance, for past 2 days if splunk didn't receive event with job_code as 000 , then i need an alert. I need this check for all the jobCode in the lookup table. Can you please help me with a query for this? Thank you

Posts	30
Solutions	0
Karma Given	14
Karma Received	1
Member Since	‎09-12-2020

Online Status	Offline
Date Last Visited	‎03-21-2022 11:40 AM

How to change stats on optional field?

How to Identify the events based on condition on o...

Eval with stats on multiple fields

Diff based on field data with count and drilldown ...

Stats for Values and count - Dashboard

Pretty Format a JSON field in Dashboard

Multiple Search for Chart

Append search result

Help required on regex

Query with multiple values in cell

How to change stats on optional field?

How to Identify the events based on condition on o...

Re: Eval with stats on multiple fields

Re: Eval with stats on multiple fields

Eval with stats on multiple fields

Diff based on field data with count and drilldown ...

Re: Pretty Format a JSON field in Dashboard

Re: Pretty Format a JSON field in Dashboard

Stats for Values and count - Dashboard

Pretty Format a JSON field in Dashboard

Multiple Search for Chart

Re: Append search result

Re: Append search result

Re: Append search result

Re: Append search result

Append search result

Help required on regex

Query with multiple values in cell

Re: Identify missing events based Lookup list of v...

Identify missing events based Lookup list of value...