Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Sivakesava574
Sivakesava574
Explorer
Member since:
02-26-2021
02-08-2022
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 02-26-2021 |
Activity Feed
- Posted Re: How to generate or repeat the search condition that generates some stats for multiple days? on Splunk Search. 02-08-2022 02:35 AM
- Posted How to generate or repeat the search condition that generates some stats for multiple days? on Splunk Search. 02-07-2022 11:38 PM
- Posted Re: How to pass a field from subsearch to main search and perform search on another source on Splunk Search. 08-09-2021 04:22 AM
- Posted Re: How to pass a field from subsearch to main search and perform search on another source on Splunk Search. 08-09-2021 03:40 AM
- Posted Re: How to pass a field from subsearch to main search and perform search on another source on Splunk Search. 08-06-2021 01:07 PM
- Posted How to pass a field from subsearch to main search and perform search on another source on Splunk Search. 08-05-2021 05:27 AM
- Posted Re: on list of _time values how to get start and end times by specific date in splunk on Splunk Search. 02-26-2021 08:00 AM
- Karma Re: on list of _time values how to get start and end times by specific date in splunk for ITWhisperer. 02-26-2021 07:59 AM
- Posted on list of _time values how to get start and end times by specific date in splunk on Splunk Search. 02-26-2021 03:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
02-08-2022
02:35 AM
it worked but, i see some of the fields are not giving the values. Start_Time,End_Time,CASS_Duration 2022/02/02 00:00:00.000, 2022/02/02 00:00:00.000, 0 these values are populating when running for single day
... View more
02-07-2022
11:38 PM
Hi, using logs i am generating some stats that are needed to track the performance of my app on daily basis using the below query. search ...| rex "elapsedTime=(?<ElapsedTime>.*?),\s*MLTime" | rex "X\-ml\-timestamp\: (?<TimeStamp>.*?)\s*\n*X-ml-maxrows" | rex "X\-ml\-size\: (?<size>.*?)\s*\n*X-ml-page" | rex "X\-ml\-page\: (?<page>.*?)\s*\n*X-ml-count" | rex "X\-ml\-elapsed\-time\: (?<MLelapsed>.*?)\s*\n*X-ml-timestamp" | stats max(size) AS Page_Size max(_time) AS End_Time min(_time) AS Start_Time max(page) as Pages count(page) AS Total_Pages max(ElapsedTime) AS Max_ElapsedTime min(ElapsedTime) AS Min_ElapsedTime avg(ElapsedTime) AS Avg_ElapsedTime max(MLelapsed) AS Max_MLElapsedTime min(MLelapsed) AS Min_MLElapsedTime avg(MLelapsed) AS Avg_MLElapsedTime | eval CASS_Date=strftime(Start_Time, "%Y-%m-%d") | eval CASS_Duration= (End_Time-Start_Time)/60 | eval End_Time=strftime(End_Time, "%Y/%m/%d %T.%3Q") | eval Start_Time=strftime(Start_Time, "%Y/%m/%d %T.%3Q") | table CASS_Date Start_Time End_Time CASS_Duration Page_Size Pages Total_Pages Max_ElapsedTime Min_ElapsedTime Avg_ElapsedTime Max_MLElapsedTime Min_MLElapsedTime Avg_MLElapsedTime can someone please help me to perform the same above for multiple days with single query instead of i manually collecting these stats on daily basis
... View more
08-09-2021
04:22 AM
This is working now. I used this option before posting the question but missed using "search" after extracting the field from main search. once i used that search it is working like a charm. Thanks very much for this
... View more
08-09-2021
03:40 AM
i explored couple more options, but still unable to get what i intended to do source = "Path2" [search source="path1" "HTTP/1.1\" 500" OR "HTTP/1.1\" 400" OR "HTTP/1.1\" 404" | rex "universal-request-id- (?<UUID>.*?)\s*X-df-elapsed-time-ms" | fields UUID | format ] I see sub search is returning valid results but some how it is not being applied to main search search source="path1" "HTTP/1.1\" 500" OR "HTTP/1.1\" 400" OR "HTTP/1.1\" 404" | rex "universal-request-id- (?<UUID>.*?)\s*X-df-elapsed-time-ms" | fields UUID | format Output: ( ( UUID="API-217008d9-373c-49f1-a51c-51c53f96c6c6-1628298298579" ) OR ( UUID="API-b5259d2f-5744-4745-b86c-f02877439c87-1628276133453" ) ) Please advise how to pass these values to main search
... View more
08-06-2021
01:07 PM
Hi, i tried the above options but it did not resolve my issue.
... View more
08-05-2021
05:27 AM
How to pass a field from subsearch to main search and perform search on another source i am trying to use below to search all the UUID's returned from subsearch on path1 to Path2, but the below search string is not working properly source ="Path2" | eval id=[search source="Path1" "HTTP/1.1\" 500" OR "HTTP/1.1\" 400" OR "HTTP/1.1\" 404" | rex "universal-request-id- (?<UUID>.*?)\s*X-df-elapsed-time-ms" | |return $UUID] suggest me on where i am doing wrong
... View more
02-26-2021
08:00 AM
This is resulting the data exactly what i intended
... View more
02-26-2021
03:57 AM
my search query returns list of _time values for multiple dates and below is start and end times for a each date 2021-02-23 12:27:13.173 2021-02-23 16:18:20.129 2021-02-24 09:18:06.191 2021-02-24 13:22:48.285 2021-02-25 09:02:38.042 2021-02-25 13:04:52.313 in the above list i need to display like below. i have tried multiple ways but unable to get the output in below format. is there any i can extract like below Date Start_time End_time difference in minutes 2/23/2021 2/23/21 12:27 2/23/21 16:18 231.11593
... View more
Labels
- Labels:
-
stats
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-08-2022
08:24 AM
|
