About Als123

Als123 · ‎12-06-2021

Hi Team, I want to monitor my Unix Server CPU usage . If the CPU usage exceeds 90% then needs to send alert mail . Can you please help me in doing this?

Als123 · ‎06-10-2021

Hi Team, When I did below search, I am getting the count of event details under "Null" column name. index=main|search query|timechart span=5m count by events Result: _time Null 06/10/2021. 200 But instead of column name as null, I need some other alias name.How to do that?

Als123 · ‎06-10-2021

Hi @t_shreya , Now I can able to open in new window.But in this case I am facing another one issue. My panel will contains the count details of different type of http status code in table format.For example like below. 200 400 500 3 5 20 In this case, If I am using Auto type option for drilldown it is navigating to particular log message details on clicking the cell. But If I am using custom search then it is navigating to splunk search page with table format. Because my search string is like that only. Index = main | search query | timechart span=5m count bt httpstatus But I need the same functionality of Auto type like on click need to get corresponding log message details.

Als123 · ‎06-09-2021

Hi, In my dashboard, for table type I have added drilldown option(On click - link to search) with "Auto" type. If I am clicking any row means it is navigating to the search page in same tab itself. But in custom type,I can able to see the option as "Open in new tab" but in this case when I am selecting any row means it is opening in new tab with "No page found" error. How to open in new tab window?

Als123 · ‎06-05-2021

Hi Team, I am having 5 panels in my dashboard and having two drop downs. First drop down: A, B and C Second From down : Depends on first drop down values will populate in second drop down. Example : A1, B1 and C1. Now If i am selecting A or B, I need to get only 4 panels in my dashboard. But If I am selecting C then I need to get all the 5 panels in my dashboard. Can you please help me on this?

Als123 · ‎05-14-2021

Hi @gcusello , Thank you.

Als123 · ‎05-14-2021

Hi @gcusello , In my logs, I couldn't able to see the response time of the transaction.How to get that one?Can you please help me?

Als123 · ‎05-13-2021

@gcusello , Thank you. Got it now.

Als123 · ‎05-13-2021

Hi Team, I am having a question regarding log details in Splunk. 1.How response time is generating in logs.? 2.From where it gets configured?

Als123 · ‎05-03-2021

Hi Team, I am having two panels and a drop down. For example the drop down contains two values (A and B). If I am choosing A from drop down means , two panel should display in my dashboard. Suppose If I am choosing B from drop down means only first panel should display and second Panel should not be display like it should be hide from my dashboard. Can you please help me how to do this hide?

Als123 · ‎04-29-2021

Hi @gcusello , Thank you for your help. I am having another one question. In panel 1, I am having two graphs (Success and Failure) for present date. In panel 2, I am having two graphs (Success and Failure) for yesterday's date. I need all 4 graphs (panel 1 and panel 2) in a single graph. With yesterday and today named in X or Y axis. Please help on this .

Als123 · ‎04-29-2021

Hi @gcusello Now it is working fine for me.Thank you so much for your help.

Als123 · ‎04-29-2021

Hi @gcusello , Yeah in yesterday's time range result is there . But don't know why I am getting no results.I have used the same query as you mentioned.

Als123 · ‎04-29-2021

Hi @gcusello , I have tried like this before also .In this case also I got No results found only.

Als123 · ‎04-29-2021

Hi @gcusello , I am getting No results found for above query.

Als123 · ‎04-28-2021

Hi Team, If I am modifying the query like this ("$field1.earliest$"), I am not getting eval error but I am not getting any search results. <query> index=xyz [ | makeresults | eval earliest=relative_time("$field1.earliest$","-1d"), latest=relative_time("$field1.latest$","-1d") | fields earliest latest ] | timechart span =5m count by specification </query Please help on this.

Als123 · ‎04-28-2021

Hi @gcusello , I have used the query u mentioned. But again I am getting "Erroe in 'eval' command.The expression is malformed.Expected)" error in my panel.

Als123 · ‎04-28-2021

Hi @gcusello , I gave my query like this . <query>index=xyz |makeresults|eval earliest=relative_time($field1.earliest$,"-1d"),latest=relative_time($field1.latest$,"-1d")|fields earliest latest|timechart span =5m count by specification </query> My token name is field1

Als123 · ‎04-28-2021

@gcusello , I am getting Error in 'eval' command:The expression is malformed.Expected ).

Als123 · ‎04-28-2021

My requirement is like I need to create two panels in my dashboard. First Panel: When I am choosing last 15 min means I need to get the values from 10 am to 10.15am for today's date(for example). Second Panel: In second Panel I need to get the data from 10am to 10.15 am for yesterday's date. It should be like comparison between today's data vs yesterday's data.please help me how to frame query for second Panel?

Posts	20
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎04-28-2021

Online Status	Offline
Date Last Visited	‎12-06-2021 10:17 AM

Unix Server CPU usage Monitoring

Splunk dashboard

Drilldown Editor

Panel Hide

Response time

Splunk Dashboard

Splunk dashboard

Unix Server CPU usage Monitoring

Splunk dashboard

Re: Drilldown Editor

Drilldown Editor

Panel Hide

Re: Response time

Re: Response time

Re: Response time

Response time

Splunk Dashboard

Re: Splunk dashboard

Re: Splunk dashboard

Re: Splunk dashboard

Re: Splunk dashboard

Re: Splunk dashboard

Re: Splunk dashboard

Re: Splunk dashboard

Re: Splunk dashboard

Re: Splunk dashboard

Splunk dashboard