About N-W

N-W · ‎10-04-2021

The search is something along line this: index=testIndex_* host=* "Trigger_error_alert_by_Splunk" | table _time, errorLogMessage, index, sourcetype

N-W · ‎10-04-2021

I have a alert that should be sent out every 8 am and 4pm everyday even if there is no results. I can only see the email get sent out sometimes even if there is less results then the trigger. I've sent it out to several diffrent email addresses to make sure there is no email filter that stops it. Splunk version is 8.0.4.1 we are going to upgrade soon however i would need the alert set up before then. This is my configures: Title: Error Report Alert type: Scheduled - Run on Cron Schedule Time Range: Last 24 Hours Cron Expression: 00 8,16 * * * Expires: 60 min Trigger alert When: Number of Results is less than 999999 Trigger: Once When Triggered: Email Include: Inline Table & Attach CSV When i check in the python.log it says that: sendemail:139 was done for all of the alerts. Does anyone know what there can be that is stopping it from working?

N-W · ‎09-27-2021

Hello! I have in my fields statuscode and status. Problem is that it runs only once when i put the input, how many times i change the input it still doesnt change the search 😞 //N-W

N-W · ‎09-27-2021

Hello! I have been trying to make a base search on a dashboard with a time and environment input as a drop-down. It only search it once and don't actually change my search ones i change my input. Is there something I'm missing? This is my form inputs: <form> <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="env"> <label>Environment</label> <choice value="TEST">TEST</choice> <choice value="DEV">DEV</choice> <choice value="PRD">PRD</choice> </input> <input type="time" token="time"> <label>Time</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> </fieldset> This is my basesearch and 2 diffrent pie charts: <search id="base_search"> <query>index=Lorem logtype=ipsum enviroment=$env$ | stats count BY status</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <row> <panel> <chart> <search base="base_search"> <query> search statuscode<400 <query> </search> <option name="charting.chart">pie</option> </chart> </panel> </row> <row> <panel> <chart> <search base="base_search"> <query> search statuscode>400 <query> </search> <option name="charting.chart">pie</option> </chart> </panel> </row>

N-W · ‎08-09-2021

I have a dashboard with several different base searches that is transformative searches. However I get the error of maximum amount of concurrent historical searches. Unfortunately we can't upgrade the cpu count or change the role. I was thinking is there a way of making it so that there is a queue set for them so for example when the first 3 are finished the next 3 searches starts. Or set the order of when the searches start and finish?

N-W · ‎07-06-2021

Thank you this answer made it so that i could also use it for diffrent queries without having to dubble the amount of searches 😃

N-W · ‎07-06-2021

Thank you i will also try this one 🙂

N-W · ‎07-06-2021

Thank you so much for this! I will try this today 😊

N-W · ‎07-06-2021

Hello everyone! I need some help with figuring out how to make this base search the best way without hitting the 500.000 limit aswell. <search id="base_search"> <query>index=Test | fields orders status countryCode <earliest>-60m@m</earliest> <latest>now</latest> </search> Since i need it to be used with these different searches: <search base="base_search"> <query>search | timechart span=1d count(orders) by status</query> </search> <search base="base_search"> <query>search | timechart span=30m count(orders) by status</query> </search> <search base="base_search"> <query>search status=!"Cancelled" | timechart span=1d count(orders) by status</query> </search> <search base="base_search"> <query>search countryCode="SWE" | timechart span=1d count(orders) by status</query> </search> Or am I missing something simple? I know base searches needs to be transformative to not hit the cap but how would I do that without making it unable to use the search command for the different things I need later? Like for specific countries etc.?

Posts	10
Solutions	0
Karma Given	6
Karma Received	0
Member Since	‎07-06-2021

Online Status	Offline
Date Last Visited	‎10-05-2021 06:33 AM

Email alert doesn't always send out a email

Base search on a dashboard

Setting a queue for dashboards when maximum of con...

Best way of making base search

Re: Email alert doesn't always send out a email

Email alert doesn't always send out a email

Re: Base search on a dashboard

Base search on a dashboard

Setting a queue for dashboards when maximum of con...

Re: Best way of making base search

Re: Best way of making base search

Re: Best way of making base search

Best way of making base search