Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Sentira
Sentira
Explorer
Member since:
06-23-2021
12-05-2024
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-23-2021 |
Activity Feed
- Posted Re: Transaction starting and ending 'event' are not always showing the correct overview on Splunk Search. 10-07-2024 07:44 AM
- Posted Re: Transaction starting and ending 'event' are not always showing the correct overview on Splunk Search. 10-07-2024 05:08 AM
- Posted Transaction starting and ending 'event' are not always showing the correct overview on Splunk Search. 10-07-2024 03:13 AM
- Tagged Transaction starting and ending 'event' are not always showing the correct overview on Splunk Search. 10-07-2024 03:13 AM
- Posted Re: How to Calculate the Percentage of each entry on Splunk Search. 09-10-2021 01:30 AM
- Posted How to Calculate the Percentage of each entry on Splunk Search. 09-09-2021 11:36 PM
- Tagged How to Calculate the Percentage of each entry on Splunk Search. 09-09-2021 11:36 PM
- Posted Re: How to join multiple events based on one common value with different filters? on Splunk Search. 06-25-2021 06:25 AM
- Posted Re: How to join multiple events based on one common value with different filters? on Splunk Search. 06-25-2021 04:17 AM
- Posted Re: How to join multiple events based on one common value with different filters? on Splunk Search. 06-25-2021 03:12 AM
- Posted How to join multiple events based on one common value with different filters? on Splunk Search. 06-25-2021 12:40 AM
- Posted How to extract, convert and show data on Splunk Search. 06-23-2021 11:49 AM
- Posted How to extract, convert and show data on Splunk Search. 06-23-2021 08:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-07-2024
07:44 AM
Unfortunately your script does not provide the correct overview. I want to know how long a machine has had a "Full" status. I can calculate that by taking the first "full" status and the "first" Ready status together and the difference is the duration. for example: Full -->This one Full --> Skip Ready -->This one Full-->This one Ready-->This one Full-->This one Full -->Skip Ready -->This one Ready --> skip
... View more
10-07-2024
05:08 AM
Thanks, this script gives only 3 rows. But, I want to have an overview like (TS: Timestamp of the event):
... View more
10-07-2024
03:13 AM
Hi, I am trying to create a Transaction where my starting and ending 'event' are not always showing the correct overview. I expect the yellow marked group events as result: index=app sourcetype=prd_wcs host=EULMFCP1WVND121 "EquipmentStatusRequest\"=" D0022
| eval _raw = replace(_raw, "\\\\", "")
| eval _raw = replace(_raw, "\"", "")
| rex "Chute:DTT_S01.DA01.(?<Door>[^\,]+)"
| rex "EquipmentName:DTT_S01.DA01.(?<EquipmentName>[^\,]+)"
| rex "EquipmentType:(?<EquipmentType>[^\,]+)"
| rex "Status:(?<EquipmentStatus>[^\,]+)"
| rex "TypeOfMessage:(?<TypeOfMessage>[^\}]+)"
| eval Code = EquipmentStatus+"-"+TypeOfMessage+"-"+EquipmentType
| lookup Cortez_SS_Reasons.csv CODE as Code output STATE as ReasonCode
| where ReasonCode = "Ready" OR ReasonCode = "Full"
| transaction EquipmentName startswith=(ReasonCode="Full") endswith=(ReasonCode="Ready")
| eval latestTS = _time + duration
| eval counter=1
| accum counter as Row
| table _time latestTS Row ReasonCode
| eval latestTS=strftime(latestTS,"%Y-%m-%d %H:%M:%S.%3N") The script above is showing the following overview as result and the marked line is not correct. I don't know how this is happened. Because, I expect that Transaction function will always take first events starting with "Ready" and ending with "Full".. Thanks in advance.
... View more
- Tags:
- transaction
Labels
- Labels:
-
transaction
09-09-2021
11:36 PM
I have the following SPL and I want to show table below. The value of Total must be equal to count of events (1588). How can I pur the total count of events into Total variable? index=abc | stats count as Count by reason_code | where reason_code != "false" | addtotals col=t labelfield=reason_code label="Retrieval task cancelled" fieldname="Percentage" | eval "Percentage"= round((Count/Total) * 100,2)."%"
... View more
- Tags:
- percentage
06-25-2021
06:25 AM
I miss the following columns. LPN (first row below) 00008851780400696790 has data for all columns in events available, but it is not visible here.
... View more
06-25-2021
04:17 AM
I have use your solution but I got Columns without data. When first an row is selected from table 1 then I want to show all data in the second table below. PalletId is missing in first event and to get this i linked them by LpnNumber from second event and BarcodeScannerData from first event. Once this done, I will join this overview with another 2 Tables later (it is not defined here yet) Please see 2 example events. first event is for TELEGRAMID=[42] and second is for TELEGRAMID=[CONTAINERSTATUS]. 2021-06-19 04:18:56.975 "TELEGRAMID=[42], PIC=[78379], AlibiID=[00020210619041750108444], HostPIC=[<Null!>], HostData=[<Null!>], OriginalDestination=[51], OriginalDestinationState=[1], LastDestination=[51], LastDestinationState=[1], ActualDestination=[51], DestinationTranslateState=[1], AltDestination1=[0], AltDestination2=[0], AltDestination3=[0], AltDestination4=[0], AltDestination5=[0], BarcodeScannerDataState=[6], BarcodeScannerData=[00008851780400826944], EntrancePoint=[0050.11.01], EntranceState=[1], ExitPoint=[0050.32.19], ExitState=[1], BarcodeScannerId=[501], FixedWindow=[115], NumberOfWindows=[1], Length=[478], Width=[368], CircleCounter=[0], Height=[0], ParcelBlockedStatus=[0], DivertFailedReason=[0]" 2021-06-19 04:18:57.005 "TELEGRAMID=[CONTAINERSTATUS], LpnNumber=[00008851780400826944], ContainerState=[DIVERTED], Divert=[PALLETIZE], ReasonCode=[DS], ActualWeight=[<Null!>], LocationBarcode=[6302000000], WcsLocation=[6300051], PalletId=[12640000010000289912], TaskId=[<Null!>], ScannerId=[51], MsgDbId=[564761760]"
... View more
06-25-2021
03:12 AM
Thank you, but is not working for me. My goal is to create the following view. 1 to many relation. Timestamp Dump Holder Dump Chute Pallet group Deactivated reason Number of Parcel 2021-06-18 21:05:45 1 1 1 Full 4 2021-06-18 21:06:45 2 1 1 Full 6 Dump Holder Parcel Parcode Length Width Height Parcel Type 1 0111235 478 368 100 Standard 1 0111236 35 19 2 Env 1 0111237 61 36 1 Env 1 .. .. .. .. ..
... View more
06-25-2021
12:40 AM
Hi, I've written a query query below which joins 2 different event types from same source with different filters. source="C:\\Logs\\*" host="myHost" index="dumpchutes" "TELEGRAMID=[42]" "LastDestination=[51]" | rex "OriginalDestination=\[(?<OriginalDestination>[^\]]+)" | rex "OriginalDestinationState=\[(?<OriginalDestinationState>[^\]]+)" | rex "EntrancePoint=\[(?<EntrancePoint>[^\]]+)" | rex "EntranceState=\[(?<EntranceState>[^\]]+)" | rex "ExitPoint=\[(?<Chute>[^\]]+)" | rex "ExitState=\[(?<ExitState>[^\]]+)" | rex "BarcodeScannerId=\[(?<BarcodeScanner>[^\]]+)" | rex "BarcodeScannerDataState=\[(?<BarcodeScannerDataState>[^\]]+)" | rex "BarcodeScannerData=\[(?<LPN>[^\]]+)" | rex "Length=\[(?<Length>[^\]]+)" | rex "Width=\[(?<Width>[^\]]+)" | rex "Height=\[(?<Height>[^\]]+)" | join LPN [ search index="dumpchutes" source="C:\\Logs\\*" "TELEGRAMID=[CONTAINERSTATUS]" "ContainerState=[DIVERTED]" "Divert=[PALLETIZE]" "ReasonCode=[DS]" |rex "LocationBarcode=\[(?<LocationBarcode>[^\]]+)" |rex "PalletId=\[(?<ChuteHolder>[^\]]+)" |rex "LpnNumber=\[(?<LPN>[^\]]+)" |rex "WcsLocation=\[(?<WcsLocation>[^\]]+)" |rex "LocationBarcode=\[(?<LocationBarcode>[^\]]+)" ] |table _time Chute ChuteHolder LPN Length Width Height | dedup LPN I'm having a number of issues here: Using joins is too slow . is there another way instead of using join? is it better to save this both searches into 2 tables and then join them in the search part?
... View more
06-23-2021
11:49 AM
I have following data and : ...... 2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[20202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]" 2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[10202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]" 2021-06-18 21:05:45.037 +02:00 [Information] ChuteAndStatus=[00202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020]" ..... I need to extract the "First_Status" and "Second_Status" of a Chute and the field from log data and each 2 characters of value belongs to one Item. Example: first character set "20", 2 is for First_Status and means OK and 0 is for Second_Status and means NOT OK for Item_1. (Total Items= 128/2 = 64) Finally I want to extract the raw data and convert to First_Status , Second_Status and link them to a fix Item (Item_1...Item_64): _time Items First_Status Second_Status 2021-06-18 21:05:45.037 Item_1 Ok Ok 2021-06-18 21:05:46.037 Item_1 Not Ok Not Ok 2021-06-18 21:05:47.037 Item_2 Ok Ok 2021-06-18 21:05:49.037 Item_n .... ..... ....
... View more
06-23-2021
08:25 AM
I have following data and : ...... 2021-06-18 21:05:45.037 +02:00 [Information] Status=[1111111111111111111111111111111111111111111111111111111111111111]" 2021-06-18 21:05:45.037 +02:00 [Information] Status=[1111111111111111111111111111111111111111111111111111111111111111]" 2021-06-18 21:05:45.037 +02:00 [Information] Status=[1111111111111111111111111111111111111111111111111111111111111111]" ..... I need to extract the Status field from log data and each character of value belongs to one Item. Example: 1 is status OK for Item_1, second 1 is status OK for Item_2, etc. * (Total Items=64) Finally I want to extract the raw data and convert to Status and link to a Item: _time Items Status 2021-06-18 21:05:45.037 Item_1 Ok 2021-06-18 21:05:46.037 Item_1 Not Ok 2021-06-18 21:05:47.037 Item_2 Ok 2021-06-18 21:05:49.037 Item_n .... .... I have tried the following Script without success: source="C:\\Logs\\*" host="392" index="Items" | eval length=len(Status) | where length > 60 | eval Item_1=substr(Status , 2 ,1), Item_2=substr(Status , 3 ,1), Item_3=substr(Status , 4 ,1),Item_4=substr(Status , 5 ,1), |eval fieldnames = "" |foreach Item_* [ eval "<<FIELD>>" = case(<<FIELD>> == 0,"Not Ok",<<FIELD>>== 1, "Ok",<<FIELD>>== 2 ,"Not Known")| eval test=<<FIELD>>] |foreach Dump_Chute* [ eval fieldnames= fieldnames."<<FIELD>>;"] |eval fieldnames = split(fieldnames, ";") |table fieldnames test _time
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-05-2024
03:34 PM
|
