Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jugarugabi
jugarugabi
Path Finder
Member since:
01-20-2021
11-15-2023
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 01-20-2021 |
Activity Feed
- Posted Font size of entire dashboard (classic) on Dashboards & Visualizations. 11-15-2023 07:22 AM
- Posted How to create a search string that can count the number of occurrences for the prefixes on [txn_key]? on Splunk Search. 09-21-2022 11:17 PM
- Posted How to trim information from search output? on Splunk Search. 05-03-2022 01:45 AM
- Posted Re: Show last update from indexed csv file on Splunk Search. 05-20-2021 03:21 AM
- Posted Re: Show last update from indexed csv file on Splunk Search. 05-20-2021 02:46 AM
- Posted Show last update from indexed csv file on Splunk Search. 05-20-2021 01:30 AM
- Posted appendcols with proper info on Splunk Search. 03-23-2021 05:06 AM
- Posted Re: Trimming last 8-9 chars from string on Splunk Search. 03-02-2021 12:09 PM
- Karma Re: Trimming last 8-9 chars from string for scelikok. 03-02-2021 12:08 PM
- Posted Re: Trimming last 8-9 chars from string on Splunk Search. 03-02-2021 11:56 AM
- Karma Re: Trimming last 8-9 chars from string for ITWhisperer. 03-02-2021 11:55 AM
- Posted Re: Trimming last 8-9 chars from string on Splunk Search. 03-02-2021 05:34 AM
- Posted Re: Trimming last 8-9 chars from string on Splunk Search. 03-01-2021 09:54 AM
- Posted Re: Trimming last 8-9 chars from string on Splunk Search. 03-01-2021 06:47 AM
- Posted Re: Trimming last 8-9 chars from string on Splunk Search. 03-01-2021 06:35 AM
- Posted Re: Trimming last 8-9 chars from string on Splunk Search. 03-01-2021 06:33 AM
- Posted Re: Trimming last 8-9 chars from string on Splunk Search. 03-01-2021 06:27 AM
- Posted Trimming last 8-9 chars from string on Splunk Search. 03-01-2021 05:16 AM
- Posted Re: First column of table to be sticky on Dashboards & Visualizations. 02-11-2021 10:32 PM
- Karma Re: First column of table to be sticky for ITWhisperer. 02-11-2021 10:31 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-15-2023
07:22 AM
Hi there, I have multiple panels added in a dashboard and I would like to reduce the font size of the entire dashboard contents - the dashboard is being created using classic dash, not the studio. Is there a possibility to achieve this? Ty!
... View more
09-21-2022
11:17 PM
Hi,
I am having the following output:
[txn_key] field2 field3 status thread [time1] time2 time3 status2
[IDMS-TJ_TJG022092200005GN00017] 332950 311551 OK 2 [133369] 342 29 OK [ZVKK_R1000001-235CDC24E191DBCE4906CCD0ND0000001] 498728 488378 OK 1 [133564] 509 9 OK [PE_CZ_R19.6_2226500012123062] 342295 331477 OK 2 [133365] 353 49 OK [BAFIROPC_R1.1_186951760] 289068 282128 OK 1 [133392] 295 5 OK [GALILEO_R19.4_MTA_03FH220922110216] 394234 383672 OK 2 [133537] 405 11 OK [DBINTERNET_R19.4_HU_RE02209223-06008] 187797 168329 OK 2 [133526] 201 7 OK [IDMS_1-I0781_944e2c3cafc0487db56f6b8d3a6a6e231] 193581 178804 OK 2 [133576] 206 4 OK [....] I need to create a search string that can count the number of occurrences for the prefixes on [txn_key]. Therefore, I would need to have the output similar to:
txn_key
count of txns
IDMS-TJ
1
ZVKK
543
PE_CZ_R19.6
0
BAFIROPC_R1.1
231
GALILEO_R19.4
12
DBINTERNET_R19.4_HU
212312
[...]
Tried so far using following logic | stats count(eval(tnx_key=="ZVKK")) as ZVKK, count(eval(tnx_key=="GALAPAC")) as GALAPAC by tnx_key
but it doesn't produce the desired output.
A bit of help please?
... View more
Labels
- Labels:
-
count
05-03-2022
01:45 AM
Hi,
I am having the following query:
index=* sourcetype=CustomAccessLog | table "host", "source"
The output is:
host
source
server32.de.db.com
/path/to/server/instances/IFM_RT_1/logs/subdir_logs/log.file
server31.de.db.com
/path/to/server/instances/IFM_RT_2/logs/subdir_logs/log.file
I would need to alter the search query so that the output is becoming:
host
source
32
IFM_RT_1
31
IFM_RT_2
Tried using the following for the IFM_RT_
index=* sourcetype=CustomAccessLog | rex field=_raw "(?<IFM_RT_>.*)", but I couldn't get the needed data.
Can I have your help here?
Thanks!
... View more
Labels
- Labels:
-
regex
05-20-2021
02:46 AM
Thanks - that simple... One more question: the line with the header is added as well to the results. How can I remove that particular line and provide me only the information without the header that can be found in the csv file?
... View more
05-20-2021
01:30 AM
Hi, I have a csv file that is updated by a script once a minute. The output is similar to: time,queuename,vpn,last-message-id-spooled,max-message-size-exceeded,total-messages-spooled,num-messages-spooled,current-spool-usage-in-mb,bind-count,recordsinperiod,eol 2021-05-20_10-20,q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol 2021-05-20_10-20,q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol 2021-05-20_10-19,q.static.prp.solacequeue, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol 2021-05-20_10-19,q.static.prp.solacequeue-number2, test_uat_de, 0, 0, 0 , 0, 0, 0 ,0,eol Now, I want to create a search query that will show only the last update in the csv file and show me the result like this: q.static.prp.solacequeue, test_uat_de, 117446717393, 0, 40340019 , 0, 0, 25 ,0,eol q.static.prp.solacequeue-number2, test_uat_de, 117493, 0, 4039 , 0, 0, 25 ,0,eol Tried using the search below, but the output still shows everything that happened during the day, instead those only 2 lines. index=* sourcetype=queues | stats latest(time) by time queuename last_message_id_spooled current_spool_usage_in_mb bind_count recordsinperiod What am I missing? Thanks, Gabriel
... View more
Labels
- Labels:
-
stats
03-23-2021
05:06 AM
Hi, Following search query produces output in table below: index=_pods pod=* project=project_name state="Running" | eventstats latest(_time) as current | where current=_time | stats count as Active by pod | rename pod as "Pod Name" | table "Pod Name" "Active" | fillnull "Active" Output: Pod Name Active 1 pod5 2 2 pod1 2 3 pod3 2 Now, I am having a csv file with the following info: pod,Expected pod1,2 pod5,100 pod3,2 I want to add the "Expected" row from the csv file into the search output. So far I have done: index=_pods pod=* project=project_name state="Running" | eventstats latest(_time) as current | where current=_time | stats count as Active by pod | appendcols [| from inputlookup:"lookup_expected_pods_dk0766.csv"] | rename pod as "Pod Name" | table "Pod Name" "Active" "Expected" | fillnull "Active" But the output is: pod name Active Expected 1 pod5 2 2 2 pod1 2 100 3 pod3 2 2 As it can be seen, the value Expected=100 should be for pod5 (csv file), but the output is showing 100 to pod1 in splunk. I have no idea how to have inputlookup to search for the pod name in the csv file and have the "Expected" value added to the proper pod name. How should I adjust the search query to have the needed output? Also, is there a possiblity to highlight with a color differences between active and expected? Thanks
... View more
03-02-2021
12:09 PM
Looks like this one produces the needed output as well as the solution provided by @ITWhisperer Thanks, I upvoted this solution as well.
... View more
03-02-2021
11:56 AM
Sir, hats off to you for helping out! This did the trick! Thanks!
... View more
03-02-2021
05:34 AM
Unfortunately this didnt helped... I still seem to be getting some services with -2, -8, -1 etc... If I am changing the the length and make it to -9: | eval pod = rtrim(substr(pod, 1, len(pod)-9),"-") Some of the services that were showing up OK in the past will one more char trimmed (which is not something that's helping out).
... View more
03-01-2021
09:54 AM
The output, using eval pod = rtrim(substr(pod, 1, -8),"-") is not showing anything for the pod anymore 1 dk0766-c 2 dk0766-c 3 dk0766-c 4 dk0766-c
... View more
03-01-2021
06:47 AM
Still shows the output: 1 21-cljcp 2 21-9zr5k 3 -2-plkzb 4 -2-qcq62 Instead of following output: 1 ais-notification-service-tm-nft 2 ais-notification-service-tm-nft 3 ais-replay-notification-service-tm-nft 4 ais-replay-notification-service-tm-nft
... View more
03-01-2021
06:35 AM
Unfortunately, not all of the pods will end in "nft" as names. These items were just an example. It would've helped if they were finishing in this way, and it was ideal... but the people who created the services haven't used a naming convention for each service so that'd help me...
... View more
03-01-2021
06:27 AM
Using this, it displays only what has been trimmed from the string. By the looks of it, it removes the things I don't need - which is ok. 1 21-cljcp dk0766-c The desired output should be: 1 ais-notification-service-tm-nft- dk0766-c
... View more
03-01-2021
05:16 AM
Hello all, I am having the following list: 1 ais-notification-service-tm-nft-27-9gv6s 642 dk0332-e 2 ais-notification-service-tm-nft-2-snfhl 642 dk0332-e 3 ais-replay-notification-service-tm-nft-3-5n876 642 dk0332-e 4 ais-replay-notification-service-tm-nft-34-l4ks2 278 dk0332-e 5 ais-replay-notification-service-tm-nft-30-vnh9s 364 dk0332-e I need to have the following output: 1 ais-notification-service-tm-nft 642 dk0332-e 2 ais-notification-service-tm-nft 642 dk0332-e 3 ais-replay-notification-service-tm-nft 642 dk0332-e 4 ais-replay-notification-service-tm-nft 278 dk0332-e 5 ais-replay-notification-service-tm-nft 364 dk0332-e While I do know how to trim the last characters using evaluation below: <search string> | eval pod = substr(pod, 1, len(pod)-8) it doesn't trim them the way I want (because some of the services are being displayed with one more char). How can I make this trimming dynamic, so it automatically trims the extra chars when they're found? Thanks!
... View more
02-11-2021
10:32 PM
@ITWhisperer you're a life saver. Thanks a lot! It worked and now I have the results as expected.
... View more
02-11-2021
06:47 AM
@ITWhisperer yep, it tries to stay sticky, using only: #Table_Scoring_Server_Totals_Day div [data-view="views/shared/results_table/ResultsTableMaster"] th:nth-child(1) {
position: fixed !important;
} However, during the scrolling l-t-r the header vanishes behind the 2nd column and the speed isn't remaining sticky: If I am adding: #Table_Scoring_Server_Totals_Day div [data-view="views/shared/results_table/ResultsTableMaster"] td:nth-child(1) {
position: fixed !important;
} underneath the previous code... I'm getting back to square one. Even if I am removing "!important" from the position of td:nth-child(1), I still get the Scored column overlapping the Serv01.
... View more
02-11-2021
06:06 AM
Hello, So I am having a report in a panel that is having 65 columns. Due to the fact that the first row contains an information that needs to be freezed when scrolling from left to right. Now, I have tried the following approach: <panel id="Scoring_Server_Totals_Day"> <html depends="$alwaysHideCSS$"> <style> #Scoring_Server_Totals_Day { width:85% !important; font-size: 85%; } #Table_Scoring_Server_Totals_Day div [data-view="views/shared/results_table/ResultsTableMaster"] td:nth-child(1) { position: fixed; } #Table_Scoring_Server_Totals_Day div [data-view="views/shared/results_table/ResultsTableMaster"] th:nth-child(1) { position: fixed; } </style> </html> <table id="Table_Scoring_Server_Totals_Day"> <title>Txns scored per server & instance today</title> <search ref="Scoring Server Totals"></search> <option name="count">50</option> <option name="drilldown">none</option> </table> </panel> However output is defective - it overlaps the Serv01:::1 details when it should've kept the "Scored" column separately. Despite it works for the scrolling on left-to-right, it gets stuck even when scrolling up-to-down. I have using position: sticky instead of position: fixed, but it ignores it and it fails to remain sticky when scrolling left-to-right. Any idea what's wrong in the code? Thanks, Gabriel
... View more
02-06-2021
04:15 AM
So I needed to remove the # there for the sorting to work out. Thanks!
... View more
02-06-2021
03:42 AM
Hey all, I am having a file that has the following stuff: #9 #10 #4 #1 .. #6 For everything that is not #9 or #10, I already made a replacement and it shows #other for #4/#6, etc. But when the statistics are shown, I am seeing the following order: #10 #9 #other I want to have the following output: #9 #10 #other. The search string i am using here is not providing the desired output: index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata Return_code_sent_to_SIL="#*" | eval Return_code_sent_to_SIL=if(Return_code_sent_to_SIL="#9" OR Return_code_sent_to_SIL="#10", Return_code_sent_to_SIL, "#other") | top limit=0 Return_code_sent_to_SIL | inputlookup append=true lookup_0_error_totals.csv | stats max(count) as "Total errors" by Return_code_sent_to_SIL | rename Return_code_sent_to_SIL as "#error" | eval sort_Return_code_sent_to_SIL=case("#error"="#9",1, "#error"="#10",2, "#error"="#other",4) | sort by sort_Return_code_sent_to_SIL What am I doing wrong? Thanks!
... View more
02-04-2021
09:29 PM
Hello, I have the following situation - in the original files I have the following information in the field: ServerName1 ServerName10 I need to replace the values in the output to be something like: srv01 srv10 while I know that the following command does replace the ServerName to srv, I cannot seem how to add 0 digit before the numbers that are having only one digit: | rex field=AIS_ServerHost mode=sed "s/ServerName/srv/g" The output will be: srv1 srv10 A bit of help, please? Thank you!
... View more
Labels
- Labels:
-
rex
02-04-2021
02:08 AM
Hello all, So, I am having the following information forwarded to splunk as sourcetype as below (with more than 15000 similar lines): 2021-Jan-14 09:07 2 servername2 instance1 2021-Jan-14 09:07:25.393 [transaction_string1] 79897 67163 OK 1 [269661] 97 28 OK I don't have any kind of header of this text file that is forwarded to splunk but I do know how to create one using the Fields options - that won't be an issue. I need to create a report that has the following specs: 1. Rows: "Scored" - a rangemap for the value which is represented in the text file as 97 (after [269661]) range map should be: 0s-to-0.05s=1-50 0.05s-to-0.10s=51-100 0.10s-to-0.15s=101-150 0.15s-to-0.20s=151-200 0.20s-to-0.30s=201-300 0.30s-to-0.50s=301-500 0.50s-to-1s=501-1000 1s-to-2s=1001-2000 2s-to-3s=2001-3000 3s-to-5s=3001-5000 5s-to-30s=5001-30000 >30s=30001-99999 2. Columns: - All: a sum(count) for each range present - if there are no records for a specific range, then 0 should be shown as a total. - servername (alphabetically sorted) with instanceId (there are 2: 1 and 2 for each servername) - each one getting the count value for each range value in "Scored" mentioned above ---- if there are is 0 as count for a specific range on the servername and instanceid, then 0 should be shown for each servername and instanceid. Now, by the looks of it, this can be achieved using a pivot. So far, this is what I could've come up with: The output I need should be similar to one below: Can anyone help me out on how to build up a search query to actually have the desired output? Thanks!
... View more
Labels
- Labels:
-
other
-
pivot
-
saved search
01-27-2021
11:02 AM
Tried with the search query: index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata | rangemap field=Time_taken_AIS_tomcat 0s-to-0.05s=0-50 0.05s-to-0.10s=51-100 0.10s-to-0.15s=101-150 0.15s-to-0.20s=151-200 0.20s-to-0.30s=201-300 0.30s-to-0.50s=301-500 0.50s-to-1s=501-1000 1s-to-2s=1001-2000 2s-to-3s=2001-3000 3s-to-5s=3001-5000 5s-to-30s=5001-30000 >30s=30001-99999 | fillnull range value=NULL but this didn't helped either.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-15-2023
10:54 AM
|
