Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nmsaraujo
nmsaraujo
Explorer
Member since:
08-03-2021
09-07-2022
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 08-03-2021 |
Activity Feed
- Posted Re: Move all values from column, one row up on Splunk Search. 09-06-2022 12:24 AM
- Posted Re: Move all values from column, one row up on Splunk Search. 09-05-2022 07:12 AM
- Posted How do I move all values from column one row up? on Splunk Search. 09-05-2022 06:37 AM
- Posted Re: How to rename column and row labels after using transpose? on Splunk Search. 06-16-2022 06:19 AM
- Posted Splunk dashboard - How do I Add button to export PDF landscape? on Splunk Enterprise. 06-14-2022 07:38 AM
- Posted How to write a search that divides values in two distinct tables? on Splunk Search. 02-23-2022 06:43 AM
- Got Karma for Re: CsvDataProvider - Unable to find filename property for lookup. 12-06-2021 07:17 PM
- Posted Re: Regex for multiple Key value pair, after string on Getting Data In. 10-20-2021 04:57 AM
- Posted Regex for multiple Key value pair, after string on Getting Data In. 10-20-2021 04:31 AM
- Posted Re: CsvDataProvider - Unable to find filename property for lookup=* will attempt to use implicit fil on Monitoring Splunk. 08-20-2021 01:12 AM
- Posted Re: CsvDataProvider - Unable to find filename property for lookup on Splunk Search. 08-20-2021 01:12 AM
- Posted Re: Regex field extraction on Splunk Search. 08-04-2021 12:03 AM
- Posted Re: Regex field extraction on Splunk Search. 08-03-2021 07:48 AM
- Posted Regex field extraction on Splunk Search. 08-03-2021 07:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-06-2022
12:24 AM
Thanks once more @richgalloway , but what I am looking for is really to write the values in a different row. This doesn't worked for what I am looking for. I am looking to see if I can do it with mvindex. Cheers
... View more
09-05-2022
07:12 AM
Thanks for the quick reply @richgalloway I am trying to make something similar to this: index=_internal sourcetype=scheduler | head 10 | delta _time as time_delta | fillnull value="need to move next values here" time_delta | table _time time_delta Does this help?
... View more
09-05-2022
06:37 AM
Hello everyone,
Can not find how I may move all values from a column(Total), one row up, in a table
This is my current scenario
Day
Total
Monday
Tuesday
2
Wednesday
3
Thursday
4
Friday
5
Saturday
6
Sunday
7
This is my desired scenario:
Day
Total
Monday
2
Tuesday
3
Wednesday
4
Thursday
5
Friday
6
Saturday
7
Sunday
Can anyone help me please?
Thanks in advance
... View more
06-16-2022
06:19 AM
You need to use: ... | rename "row 1" as "This is Column 1", "row 2" as "This is Column 2", etc
... View more
06-14-2022
07:38 AM
Hello all,
is there any option that may allow me to add a button in a dashboard, to export a dasboard to PDF, in landscape mode, without having to change system settings?
This operation should specifically be applied just to this specific dashboard.
Any idea?
... View more
Labels
- Labels:
-
other
02-23-2022
06:43 AM
Hello all,
I have a scenario where I need to make calculations regarding license consumed, per host. However, since in the license_usage log, host value was squashed and I can not fix it for past events.
My theory to calculate average license consumption per host is: 1 - Calculate license used per index, per day
index=_internal source="*license_usage.log" component=LicenseUsage type=usage (idx=set1_*)
| timechart useother=false limit=100 span=1d sum(b) by idx
| fillnull value=0
Output Example for daily license consumption:
Date
set1_index1
set1_index2
set1_index3
22-02-2022
345
354
343
21-02-2022
3463
3463
234
2 - Calculate the distinct number of hosts in each index, using tstats:
| tstats values(host) as hosts, dc(host) as total_hosts where (index=set1_*) by _time,index
| timechart useother=false limit=100 span=1d max(total_hosts) as "TotalHosts" by index
| fillnull value=0
Output Example for number of hosts per index:
Date
set1_index1
set1_index2
set1_index3
22-02-2022
2
6
4
21-02-2022
4
1
2
ISSUE: The name of the columns is not static. I can only use a prefix, defined in the index naming conventions.
Objective:
If I am able to divide the daily license consumption by the number of hosts, I have the average consumption per host.
Doe any of you can help me find how I made divide the values in the first query by the ones in the second query, geting a similar output to the table below?
Date
set1_index1
set1_index2
set1_index3
22-02-2022
172,5
59
85,75
21-02-2022
865,75
3463
117
Thanks in advance for your help on this issue.
... View more
10-20-2021
04:57 AM
Thanks @ITWhisperer for the quick reply. This worked perfectly.
... View more
10-20-2021
04:31 AM
Hello all, I am looking to extract automatically, all key value pairs, from the following event. Oct 20 12:52:40 11.22.33.44 status: Info: Status: CPULd 0 DskIO 0 RAMUtil 4 QKUsd 0 QKFre 8388608 CrtMID 184222 CrtICID 2257015 CrtDCID 83915 InjMsg 126359 InjRcp 133519 GenBncRcp 2695 RejRcp 39342 DrpMsg 6 SftBncEvnt 9183 CmpRcp 139771 HrdBncRcp 3372 DnsHrdBnc 560 5XXHrdBnc 2406 FltrHrdBnc 0 ExpHrdBnc 406 OtrHrdBnc 0 DlvRcp 136399 DelRcp 0 GlbUnsbHt 0 ActvRcp 0 UnatmptRcp 0 AtmptRcp 0 CrtCncIn 0 CrtCncOut 0 DnsReq 5081719 NetReq 2029480 CchHit 5092135 CchMis 1888266 CchEct 891535 CchExp 1239213 CPUTTm 283360 CPUETm 123729299 MaxIO 7211 RAMUsd 182837940 MMLen 0 DstInMem 5 ResCon 0 WorkQ 0 QuarMsgs 0 QuarQKUsd 0 LogUsd 6 SophLd 0 BMLd 0 CASELd 0 TotalLd 53 LogAvail 175G EuQ 0 EuqRls 0 CmrkLd 0 McafLd 0 SwIn 1743004 SwOut 1980200 SwPgIn 8219419 SwPgOut 19669768 RptLd 0 QtnLd 0 EncrQ 0 InjBytes 21864651864 For that, I used the folowing regex: (?<key>\S+)\s(?<value>\d+) However, I can not get a 100% match, because I only want this to be valid for all the data after "Status:" (in bold, in the example). Can anyone help me get a regex for this key value pair extraction? Thanks in advance.
... View more
Labels
- Labels:
-
field extraction
08-20-2021
01:12 AM
Check here is my solution works for you: https://community.splunk.com/t5/Splunk-Search/CsvDataProvider-Unable-to-find-filename-property-for-lookup/m-p/539620/highlight/false#M152613
... View more
08-20-2021
01:12 AM
1 Karma
Can you check what is the character-encoding of that file, directly in the cli with command file -i lookup_name.csv? In my situation, the encoding type was different from "text/plain; charset=us-ascii", was in fact "application/octet-stream; charset=binary". I opened the file in Notepad++, changed encoding to UTF8, loaded the file again to splunk with lookup editor, and it worked. Let me know if this works for you also.
... View more
08-03-2021
07:48 AM
Thanks @ITWhisperer for the swift reply. With your suggested regex I still have issues with fields and values that includes spaces, right? Thanks
... View more
08-03-2021
07:05 AM
Hello all, I have one sourcetype that does not allow me to create a static field extraction, because we have several fields with different name and is almost impossible to cover all of them. My data is similar to this: fieldname1 : values1 with spaces - fieldname2 : value2 - fieldname3 : value-for-field3 field name4 : values4withoutspaces - fieldname5 : value5 (this should be included in value5) - fieldname6 : value-for-field3 fieldname7 : All kv pairs are delimitd by " - " and the pair delimiter is " : " . To cover this requirement, I have a field transforms that uses a regex to calculate key-value pairs automatically [wildcard_extractions] CLEAN_KEYS = 0 FORMAT = $1::$2 REGEX = (\S+)\s:\s(\S+) PROBLEM: When the field name or the value has spaces, I can not get the full values. Could some, more experienced than me, help me with my regex expression, please? https://regex101.com/r/R9XhmD/1
... View more
Labels
- Labels:
-
field extraction
-
regex
