Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About priyastalin
priyastalin
Explorer
Member since:
12-15-2020
03-16-2021
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 12-15-2020 |
Activity Feed
- Posted Re: how to find percentage? on Splunk Search. 03-16-2021 01:26 AM
- Posted Re: how to find percentage? on Splunk Search. 03-16-2021 01:18 AM
- Posted how to find percentage? on Splunk Search. 03-16-2021 12:53 AM
- Tagged how to find percentage? on Splunk Search. 03-16-2021 12:53 AM
- Posted Re: how to create third dropdown and link first two dropdown on Splunk Search. 03-09-2021 05:50 AM
- Posted how to create third dropdown and link first two dropdown on Splunk Search. 03-09-2021 05:23 AM
- Tagged how to create third dropdown and link first two dropdown on Splunk Search. 03-09-2021 05:23 AM
- Karma Re: how to fetch the filed using regex for gcusello. 03-09-2021 12:56 AM
- Karma Re: how to fetch the filed using regex for gcusello. 03-09-2021 12:55 AM
- Posted Re: how to fetch the filed using regex on Splunk Search. 03-09-2021 12:45 AM
- Posted how to fetch the filed using regex on Splunk Search. 03-09-2021 12:13 AM
- Tagged how to fetch the filed using regex on Splunk Search. 03-09-2021 12:13 AM
- Posted how to use regex to captrure the port number from the port interfaces on Developing for Splunk Enterprise. 03-08-2021 11:41 PM
- Tagged how to use regex to captrure the port number from the port interfaces on Developing for Splunk Enterprise. 03-08-2021 11:41 PM
- Posted Re: how to replace join? on Splunk Search. 12-21-2020 04:03 AM
- Posted Re: how to replace join? on Splunk Search. 12-20-2020 10:49 PM
- Karma Re: How to replace join in this below query? for dmarling. 12-20-2020 10:38 PM
- Karma Re: How to replace join in below query? for bowesmana. 12-18-2020 08:50 PM
- Posted how to replace join? on Splunk Search. 12-18-2020 05:15 AM
- Tagged how to replace join? on Splunk Search. 12-18-2020 05:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-16-2021
01:26 AM
Hi @javiergn Thanks for you input Total no of ports Down ports percDownPorts 599 599 100 its giving the correct total no of ports but down ports count is 234 is giving wrong value for down ports.. is there any other way to fetch the output
... View more
03-16-2021
01:18 AM
Hi, Thanks for you input Total no of ports Down ports percDownPorts 599 599 100 its giving the correct total no of ports but down ports count is 234 is giving wrong value for down ports.. is there any other way to fetch the output
... View more
03-16-2021
12:53 AM
Hi, @gcusello @dmarling I Have a doubt in calculating the percentage. First query: (index=71412-cli sourcetype=show_interface) OR (index=71412-np sourcetype=device_details) | stats values(*) as * by deviceId |search deviceName ="BLV2-TI-SW_WAS18-01" |dedup interface | table deviceId interface deviceName adminStatus | sort interface | stats count(interface) as "Total no of ports" from the first query I'm fetching the total no of interface second query (index=71412-cli sourcetype=show_interface adminStatus="down") OR (index=71412-np sourcetype=device_details) | stats values(*) as * by deviceId |search deviceName ="BLV2-TI-SW_WAS18-01" |search adminStatus=down |dedup interface | table deviceId interface deviceName adminStatus | sort interface | stats count(interface) as "Down ports" from the second query I'm fetching only the interfaces which are admin down I want to find the percentage of (Down ports/Total no of ports) * 100. please help me in finding the percentage by appending these two queries thanks, priya
... View more
- Tags:
- percentage
Labels
- Labels:
-
count
03-09-2021
05:50 AM
Hi @gcusello Yes first and second dropdown are linked together and tokens are $group$ and $device$. But I dont know how to create third dropdown Timeframe and link first two dropdowns. Thanks, priya
... View more
03-09-2021
05:23 AM
Hi Team, @gcusello I have created two dropdown (Group and Device) I want create another dropdown timeframe and link first two dropdown with timeframe dropdown. How to achieve this? Group Device Timeframe Please help me in clearing my doubts. Thanks, Priya
... View more
- Tags:
- dropdown
Labels
- Labels:
-
other
03-09-2021
12:13 AM
Hi, @ITWhisperer @bowesmana @niketnilay @dmarling Could you Please help me with my doubt Query: "index=71412-cli sourcetype=show_interface | fields type interface operStatus |table type interface operStatus |search interface=port*" output of the query type interface Port-channel Port-channel1 Port-channel Port-channel261 Port-channel Port-channel100 Port-channel Port-channel99.202 Port-channel Port-channel99.200 Port-channel Port-channel99.160 Port-channel Port-channel99.159 Port-channel Port-channel99.158 Port-channel Port-channel99.157 I need to capture only the values after the Port-channel(99.157) from the interface column and create separate column to print only the ids of port-channel Expected output type interface port-id Port-channel Port-channel1 1 Port-channel Port-channel261 261 Port-channel Port-channel100 100 Port-channel Port-channel99.202 99.202 Port-channel Port-channel99.200 99.200 Port-channel Port-channel99.160 99.160 Port-channel Port-channel99.159 99.159 Port-channel Port-channel99.158 99.158 Port-channel Port-channel99.157 99.157 Please help me in solving this doubts Thanks and regards, Priya
... View more
- Tags:
- regex
Labels
- Labels:
-
regex
12-21-2020
04:03 AM
Hi @to4kawa , Couldn't see your solution can you send me again? Thanks
... View more
12-20-2020
10:49 PM
Hi @to4kawa , I didn't get output for this, Could you please help me in solving this?
... View more
12-18-2020
05:15 AM
Hi, @493669 @MuS @dturnbull_splun @bowesmana Anyone please help me in replacing join in the below query?? " index=167515-np sourcetype=hardware | fields deviceId, productType, productId, physicalType | search physicalType=Chassis | dedup deviceId | join deviceId [ search index=167515-np [| `last_np_sourcetype( "index=167515-np", "group_members")` ] groupId=288348 | fields deviceId ] | stats dc(productId) as PIDs by productType | search productType=Routers | table PIDs" Thanks
... View more
Labels
- Labels:
-
join
12-18-2020
05:00 AM
@dmarling Hi, Thanks for the help!! There is another query with the join. I tried replacing with "OR" but I'm not getting exact output "index=167515-np sourcetype=hardware | fields deviceId, productType, productId, physicalType | search physicalType=Chassis | dedup deviceId | join deviceId [ search index=167515-np [| `last_np_sourcetype( "index=167515-np", "group_members")` ] groupId=288348 | fields deviceId ] | stats dc(productId) as PIDs by productType | search productType=Routers | table PIDs" Could you please help me in solving this?? Thanks
... View more
12-17-2020
12:51 AM
@bowesmana Hi Bowesmana, Can you also help me in solving the query ? Thanks.
... View more
12-17-2020
12:49 AM
Hi @dmarling Thanks for replying the below query which you shared it not working exactly. I would like to give some inputs, This is query with join: " index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=309425 | fields deviceId ] | fields deviceName, physicalElementId, hwEoxId | dedup physicalElementId | table deviceName, physicalElementId, hwEoxId | stats count as Devices by hwEoxId | stats sum(Devices) as Devices" sample ouput of the 1stquery " index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId" cpyKey : 168347 currentEoxMilestone : LDoS currentEoxMilestoneDate : 2018-01-31T00:00:00 deviceId : 18468220 deviceName : 10.24.13.240 hwEoxId : 286609 nextEoxMilestone : null nextEoxMilestoneDate : null physicalElementId : 362026445 physicalType : Power Supply productId : C3K-PWR-265WAC timeStamp : 2020-12-15T12:57:03 Output of second query"index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=309425 | fields deviceId" " deviceId : 16642716 groupId : 309425 groupName :Cisco 3900 ISR Routers timeStamp : 2020-12-15T12:56:41" Output of the query till dedup of physicalElementId "index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681 | fields deviceId ] | fields deviceName, physicalElementId, hwEoxId | dedup physicalElementId" '' '' cpyKey : 168347 currentEoxMilestone : LDoS currentEoxMilestoneDate : 2018-03-31T00:00:00 deviceId : 15459204 deviceName : 10.82.112.71 hwEoxId : 266079 nextEoxMilestone : null nextEoxMilestoneDate : null physicalElementId : 341757347 physicalType : Module productId : SFP-GE-L timeStamp : 2020-12-15T12:57:02"" Also I have attached the table values as pdf for ""| table deviceName, physicalElementId, hwEoxId"" Please help me in removing the join in the query at the top. Thanks a lot
... View more
12-15-2020
10:08 PM
@dmarling Hi, I've replaced join in the below query and posted that query as well but I'm not getting proper output correct me if I made any mistake Query with join: "index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681 | fields deviceId ] | fields deviceName, physicalElementId, hwEoxId | dedup physicalElementId | table deviceName, physicalElementId, hwEoxId | stats count as Devices by hwEoxId | stats sum(Devices) as Devices " Replaced join from the above query: "index=168347-np ([| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*)) OR ([| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681) | fields deviceId deviceName physicalElementId hwEoxId sourcetype | stats values(sourcetype) as sourcetype values(deviceName) as deviceName values(physicalElementId) as physicalElementId values(hwEoxId) as hwEoxId by deviceId | search sourcetype=hw_eox sourcetype=group_members | table deviceName, physicalElementId, hwEoxId | stats count as Devices by hwEoxId | stats sum(Devices) as Devices" Thanks
... View more
Labels
- Labels:
-
join
12-15-2020
05:58 AM
Content of first query "index=168347-np [ | `last_np_sourcetype("index=168347-np","hardware")`] (physicalType=*) | fields physicalElementId deviceId " This query has 39718 events similarly like below "chassisName : 10.241.241.22 cpyKey : 168347 deviceId : 19206245 deviceName : 10.241.241.22 hwRev : null installedFlash : null installedMemory : null pcb : null pcbRev : null physicalElementId : 388725541 physicalSubType : null physicalType : Power Supply productFamily : Catalyst 2K/3K Series Power Supplies productId : PWR-C1-1100WAC productType : Power Supplies serialNumber : DTN2246V1S4 serialNumberStatus : UNKNOWN slot : PWRSPPLY2 swVersion : null tan : null tanRev : null timeStamp : 2020-12-14T13:35:46" Content of second query: "index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681 | fields deviceId" This query has 25 events similarly like below { [-] deviceId : 16681845 groupId : 290681 groupName : ASR 1K Routers timeStamp : 2020-12-14T13:35:27 } Final output is: 210
... View more
12-15-2020
04:55 AM
@bowesmana Hi, could you please help me in replacing the join in below query? index=168347-np [ | `last_np_sourcetype("index=168347-np","hardware")`] (physicalType=*) | fields physicalElementId deviceId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681 | fields deviceId ] | stats dc(physicalElementId) as Devices Thanks
... View more
- Tags:
- replace join
Labels
- Labels:
-
join
