Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About wcastillocruz
wcastillocruz
Path Finder
Member since:
12-04-2020
11-13-2021
Community Statistics
| Posts | 37 |
| Solutions | 0 |
| Karma Given | 20 |
| Karma Received | 1 |
| Member Since | 12-04-2020 |
Activity Feed
- Karma Re: Script python with search SPL for richgalloway. 09-16-2021 12:58 AM
- Posted Script python with search SPL on Splunk Dev. 09-15-2021 01:17 AM
- Posted Re: count time of my select time within week-ends on Splunk Search. 05-28-2021 06:24 AM
- Karma Re: count time of my select time within week-ends for ITWhisperer. 05-28-2021 12:16 AM
- Posted count time of my select time within week-ends on Splunk Search. 05-26-2021 07:47 AM
- Karma Re: Calculate total duration when many transactions are overlap in the time for ITWhisperer. 05-26-2021 03:50 AM
- Karma Re: Calculate total duration when many transactions are overlap in the time for ITWhisperer. 05-26-2021 03:50 AM
- Karma Re: Calculate total duration when many transactions are overlap in the time for ITWhisperer. 05-26-2021 03:50 AM
- Karma Re: Calculate total duration when many transactions are overlap in the time for ITWhisperer. 05-26-2021 03:50 AM
- Karma Re: Calculate total duration when many transactions are overlap in the time for ITWhisperer. 05-26-2021 03:50 AM
- Karma Re: Calculate total duration when many transactions are overlap in the time for ITWhisperer. 05-26-2021 03:49 AM
- Posted count time between each period time on Splunk Search. 05-21-2021 05:54 AM
- Posted Re: Calculate total duration when many transactions are overlap in the time on Splunk Search. 03-25-2021 04:06 AM
- Posted Re: Calculate total duration when many transactions are overlap in the time on Splunk Search. 03-25-2021 03:29 AM
- Posted Re: Calculate total duration when many transactions are overlap in the time on Splunk Search. 03-25-2021 02:46 AM
- Posted Re: Calculate total duration when many transactions are overlap in the time on Splunk Search. 03-25-2021 02:25 AM
- Posted Re: Calculate total duration when many transactions are overlap in the time on Splunk Search. 03-25-2021 02:16 AM
- Posted Re: Calculate total duration when many transactions are overlap in the time on Splunk Search. 03-25-2021 01:41 AM
- Posted Calculate total duration when many transactions are overlap in the time on Splunk Search. 03-24-2021 04:50 AM
- Tagged Calculate total duration when many transactions are overlap in the time on Splunk Search. 03-24-2021 04:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-15-2021
01:17 AM
Hello Splunk team, do you know if it's possible to do a splunk search in a python script? taking into account the selection of the desired period (last week, last month ...). for example for a simple search : | append [search sourcetype=ESP_Histo env="Web" service="Application" apps="Web Sharepoints" fn="*" managed_entity="*- URL" sampler="SHAREPOINT - URL" ID_EVENT | eval Applications=case( apps like "%Web Sharepoints%","WEB SHAREPOINTS") | `transactions` ] | eval max_time=if(info_max_time == "+Infinity", now(), info_max_time) | eval min_time=if(info_min_time == "0.000", 1577836800, info_min_time) | eval periode1=max_time-min_time | stats sum(duration) AS durationindispo by Applications, periode1 | outputcsv append=true override_if_empty=false web_search
... View more
Labels
- Labels:
-
Python
05-28-2021
06:24 AM
@ITWhisperer Thank you very much, that's right
... View more
05-26-2021
07:47 AM
Hi community, is it possible to calculate the time between info_max_time and info_min_time according to the period chosen in the button "select time" but removing the weekends contained in the period. for example I run a search like this: sourcetype = XXXXXXX | `transactions` | eval date_wday = strftime (_time, "% w% H") | search date_wday> = 106 AND date_wday <= 523 | I take the events between Monday 6 a.m. and Friday 10 p.m. if my select time equals "the last month" so April then I have to do : | eval period = info_max_time - info_min_time | and delete from my variable "period" the weekends < for the last month period must be = 22 days because 30 days of the month - 8 days of weekends. I want the calculation to be systematic according to the period chosen in the button "select time" can you help me please
... View more
05-21-2021
05:54 AM
Hello dear community, I have a splunk search where I look for all the events that occur over a specific period of time. this period is "from Monday at 5 am until Friday 10 pm" I wish to be able to calculate the time that there is between this period independently of whether or not there are events in the period (it will depend on my choice in the "select time" button). if in my select time I chose the last month and the month is made up of 5 weeks I must calculate the time over all my periods "from Monday at 5 am until Friday 10 pm" i have this : ...| eval date_wday = strftime(_time, "%w%H") | search date_wday>=106 AND date_wday<=523 Could you help me on this
... View more
03-25-2021
04:06 AM
it's not you but me who explains badly Thank a lot
... View more
03-25-2021
03:29 AM
@ITWhisperer it is not as easy as it may seem. I have listed several months of events, this is not a specific case. moreover I can index several events for the same application in a day, and it is possible that these events do not overlap and which do not follow one another. by following your solution I get this: while for application A for example, nothing happened between 1:00 p.m. and 2:00 p.m. and with your solution I add this time to my total incident duration thank you very much anyway.
... View more
03-25-2021
02:46 AM
Here is an example of two transactions and underlined in blue which allows me to differentiate them
... View more
03-25-2021
02:25 AM
that explains better than me 🙂
... View more
03-25-2021
02:16 AM
@ITWhisperer, Thanks again for your reply. well, I identify each transaction thanks to a series of data that each transaction contains. this is the start of my search: index = index1 | eval ID = Service + "_" + Env + "_" + Apps + "_" + Function | addinfo | transaction ID startswith = (severity = 2) endswith = (severity = 0 OR severity = 1 OR severity = -1) maxevents = 4 "If I understand correctly, you want the time between first start (10 am) and last end (11:30 am), is that right?" yes, at this time the duration of the incident for the Application is 1:30 hour. but if transaction 1 = start 10:00 AM end 11:00 AM transaction 2 = start 11:00 AM end 12:00 PM in this case the duration is equal to the sum of the duration transaction 1 + duration transaction 2 note: I have several Applications, and my ID allows me to separate transactions.
... View more
03-25-2021
01:41 AM
Hi @ITWhisperer, Thank you for your answer. yes, I can identify each transaction with a unique ID. I'm already doing this. or do you mean to combine my two transactions into one?
... View more
03-24-2021
04:50 AM
Hello dear community, help me on this issue please. When using the concurrency command to find out if transactions overlap in time, and if so, is it possible to calculate the total duration of the incident taking the overlap into account. for example : transaction 1: start -> 10 a.m. end -> 11 a.m. Transaction 2: start -> 10:30 am end -> 11:30 am transaction 1 concerns process1 and transaction 2 concern porcess2 but the two transactions correspond to the same application X before, to calculate the total duration of the incident on application X I added the duration of transaction 1 + the duration of transaction 2. this is the correct way when incidents (transactions) do not overlap, but when they overlap as in the previous example. the total incident duration of the application is equal to 1h30 and not to 2h. using concurrency command can we calculate this duration?
... View more
- Tags:
- concurrency
Labels
- Labels:
-
chart
-
field extraction
-
regex
-
timechart
-
transaction
03-03-2021
10:59 AM
Hello, @scelikok Could you help me on the following search please? I have a main search which groups me together all the events with a unique ID (these events are critical, warning and normal alerts that I index on Splunk). I want to add a sub-search to my main search which could allow me to add other events in the form of a transaction. My problem here is that my unique ID in my main search is not the same as in my sub search. this is what I want to do : index=index1 (severity=2 OR severity=0 OR severity=1 OR (severity="-1" AND Function=Traps)) | eval ID=Service+"_"+Env+"_"+Apps+"_"+Function+"_"+managed_entity+"_"+varname | addinfo | append [search index=index_sqlprod-itrs_toc (managed_entity="vpw-neorc-103 - rec" OR managed_entity="vpw-neorc-903 - rec") rowname="ASC RecordingControl" | eval ID=Service+"_"+Env+"_"+Apps+"_"+Function+"_"+varname | addinfo | sort _time asc | eval peer_failed=if(severity=2,1,-1) | streamstats sum(peer_failed) as failed_peers by ID | eval failed_peers=if((failed_peers=1) AND (severity="0" OR severity="-1"),3,failed_peers) | where NOT (failed_peers=1 OR failed_peers=0) | sort _time desc | transaction ID startswith=(failed_peers=2) endswith=(failed_peers=3) maxevents=2] | transaction ID startswith=(severity=2) maxevents=2 my goal is to bring these transactions together without having the same ID, is that possible?
... View more
Labels
- Labels:
-
join
-
lookup
-
transaction
03-03-2021
04:35 AM
Hi @scelikok it works!!!!!!! thank you
... View more
03-01-2021
12:45 AM
Hi @scelikok, Thank you for always being there despite the complexity of my questions. in my case i can't use the desc sort, because it disrupts my streamstats sum. here is a screenshot of what i get in my failed_peers with desc sort.
... View more
02-26-2021
11:06 AM
Hi @scelikok , I don't know where the error is in my search, could you help me, I would like to form a transaction with each event 2 and 3 in the failed_peers column of my table in time order. but I get a "not found" result while events exist this is my search : index=index_sqlprod-itrs_toc (managed_entity="vmc-neorc-20 - rec" OR managed_entity="vmc-neorc-19 - rec") rowname="ASC RecordingControl" | eval ID=Service+"_"+Env+"_"+Apps+"_"+Function+"_"+varname | addinfo |sort _time asc | eval peer_failed=if(severity=2,1,-1) | streamstats sum(peer_failed) as failed_peers by ID | eval failed_peers=if((failed_peers=1) AND (severity="0" OR severity="-1"),3,failed_peers) |where NOT (failed_peers=1) |transaction ID startswith=(failed_peers=2) endswith=(failed_peers=3) maxevents=2 2 is my second critical alert 3 is my first OK alert after 2 critical alerts here is the failed peers column whose values my search should follow in temporal order, but it's not like that.
... View more
02-10-2021
02:57 AM
Hello, @rnowitzki @renjith_nair could you help me on the following question please: I index every day at 6 p.m. splunk events from an ITRS database. each event is made up of a critical alert and an OK alert generated by ITRS. the events concern a pair of servers (Active and passive) I have to define a search with a condition like this: if server1 K0 AND server2 K0 AND server1 0K after server2 is K0 then I calculate the time of the last K0 servers and the first 0K server this corresponds to the downtime of my service but only if both servers are KO'd at the same time. i.e if server1 K0 at 3pm AND server2 K0 at 3:30 p.m. BUT server1 0K at 3:20 p.m. then do nothing i have this : index=index (severity=2 OR severity=0 OR severity="-1" OR severity=1) server=server1 OR server=server2 | eval ID=Service+"_"+Env+"_"+Apps+"_"+Function+"_"+managed_entity+"_"+varname | addinfo | eval periode=info_max_time-info_min_time | transaction ID startswith=(severity=2) maxevents=2 i dont now how to create condition Thank you for your help
... View more
Labels
- Labels:
-
stats
-
subsearch
-
timechart
-
transaction
02-10-2021
12:55 AM
@renjith_nair What lookup could I have used if I had a high number of applications? so as not to have to create them manually. could you give me an example pleas?
... View more
02-10-2021
12:41 AM
hi @renjith_nair I added the following lines and it works: |append [| makeresults 1 | eval liste="ICS SPEAKER BUS" |table liste ] |append [| makeresults 1 | eval liste="ENREGISTREMENT TELEPHONIE" |table liste ] |append [| makeresults 1 | eval liste="OTMS ALCATEL" |table liste] |append [| makeresults 1 | eval liste="OXE WORLDWIDE" |table liste] thank you
... View more
02-08-2021
01:19 PM
Can you help me, i have the same probleme with this search : index=index_sqlprod-itrs_toc (severity=2 OR severity=0 OR severity="-1") | eval ID=Env+"_"+Apps+"_"+Function+"_"+varname | addinfo | eval periode=info_max_time-info_min_time | transaction ID startswith=(severity=2) maxevents=2 | eval start_time=mvindex(timestamp,0), end_time=mvindex(timestamp,1) | stats sum(duration) AS duration_indispo by Function, periode | eval Percent_Available = round((periode-duration_indispo)*100/periode,3) | eval Env = case( Function like "%OTMS%", "OTMS Alcatel", Function like "%ASC Recorder%", "Enregistrement Téléphonie", Function like "%ASC Core%", "ASC Core", Function like "%OXE WORLDWIDE%", "OXE WORLDWIDE", Function like "%Proxy%", "Téléphonie Alcatel Mobilité", Function like "%Environnement Monitor%", "Environnement Monitor", Function like "%Traps%", "Traps", Function like "%System Management%", "System Management", 1==1, 100 ) | fillnull value=100.00 |table Env, Percent_Available Works fine when I have values for all rows of each function, but when I don't have a value for any row then the (function) row is not visible. How can I make this visible with 100 values against this row
... View more
02-08-2021
07:23 AM
Hello dear community, I absolutely need your help. I have the following research which allows me to perform an availability calculation. index=index (severity=2 OR severity=0 OR severity="-1") | eval ID=Env+"_"+Apps+"_"+Function+"_"+varname | addinfo | eval periode=info_max_time-info_min_time | transaction ID startswith=(severity=2) maxevents=2 | eval start_time=mvindex(timestamp,0), end_time=mvindex(timestamp,1) | stats sum(duration) AS duration_indispo by Function, periode | eval Percent_Available = round((periode-duration_indispo)*100/periode,3) |rename Function AS "Applications" | fillnull value=100.00 |table Applications, Percent_Available my research calculates the unavailability of each function (applications) the problem is that I have a button to select the period (previous year, previous month, previous week ... etc) I have exactly 5 functions for which I want to calculate availability but depending on the period chosen it is possible that one or more applications do not return any result and if I display the result on a graph then the applications without result are not taken into account in my graph. how I can do to statically enter the name of my 5 functions and display the results dynamically if the result is not null or display 100% if the result is null. fillnull value = 100.00 does not work in this case
... View more
- Tags:
- @rnowitzki
- all
01-28-2021
05:37 AM
@rnowitzki
... View more
01-28-2021
03:50 AM
I may have explained myself badly. I have to calculate the availability of a service over a period which can be a year, a month, last week, month to date etc ... in my dashboard I have a time button where you can select the desired period to calculate the availability. so I have to create a formula that calculates the availability but there is a variant which is the number of seconds of the period over which we calculate the availability, I put my desired search: index=index_sqlprod-itrs_toc | eval ID=Env+"_"+Apps+"_"+Function+"_"+varname | transaction ID startswith=(severity=2) maxevents=2 | eval start_time=mvindex(timestamp,0), end_time=mvindex(timestamp,1) | eval periode = $earliest$ - $latest$ """""these variables will look for the earliest and latest of my time button according to the selected period""""" | stats sum(duration) AS duration_indispo by Function | eval Percent_Available = round((periode - duration_indispo)*100/periode,4) """""here I use the result to calculate the availability according to the desired period """"" but the search is not working. thk for your help
... View more
01-28-2021
02:34 AM
Hello @rnowitzki, I would like to ask you one last question, is it possible to know the number of seconds between earliest and latest based on relative time?
... View more
- Tags:
- _time
01-28-2021
02:30 AM
1 Karma
i used this : | eval start_time=mvindex(timestamp,0), end_time=mvindex(timestamp,1)
... View more
01-25-2021
02:26 AM
when i regroup the alerts to make event the two times temps are in the same fiel "timestamp start and timestamp end" how I can do to separate two values contained in the same field. values are separated by a space
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-13-2021
09:17 PM
|
Karma given to
