About mm12

mm12 · ‎03-23-2022

Hi , I need the help to write splunk query for calculating CPU Linux load average for last 1,5 and 15 mins. I have splunk TA nix app and collected the metrics vmstat_metric.loadAvg1mi and used this metrics for last 1 min query. But I am not sure how to calculate the load average for last 5 and 15 mins. can anyone

mm12 · ‎02-15-2022

@gcusello | mstats avg(cpu_metric.pctIdle) AS "cpu_idle" WHERE index=os_metric bY host | search [| inputlookup lookup_mapping | search service="os_metric" host= * | table host] | eval "cpu_usage"=round(100-cpu_idle, 2) | sitimechart avg(cpu_usage) as "cpu_usage" by host I used the above query to check the CPU usage and schedule it as report and enable the summary Metric index I got three fields like psrsvd_ct_cpu_usage, psrsvd_nc_cpu_usage and psrsvd_sm_cpu_usage. Now I need to query the summary index to use it in dashboard. How to achieve that. Can anyone help me on this please.

mm12 · ‎02-03-2022

@ITWhisperer I can able to write separate queries for example For Avg CPU | mstats avg(cpu_metric.pctIdle) AS "cpu_idle" WHERE index=linux_os_metrics by host CPU span=1m | eval "cpu%_Utilized"=round(100-cpu_idle, 2) |search CPU=all |fields - CPU cpu_idle | timechart span=1m avg(cpu%_Utilized) by host But how to combine that in summary index Thanks Manju

mm12 · ‎02-03-2022

Hi , I want to create summary index for the below OS metrics process . How to achieve this. 1.Avg CPU per week* 2.Avg memory per week* 3. Avg /var/log/ % used, per week* 4. # processes running, per week* Thanks

mm12 · ‎12-07-2021

@ITWhisperer - Thanks for the reply . I have modified the query little but in the x axis I am getting values like 100,000,000 200,000,000 300,000,000 etc. How to overcome this |inputlookup hsbc_es_pr_mapping.csv | eval "Configuration Item" = lower('Configuration Item') | rename "Open Date/Time(UTC/GMT)" as Open_Date | lookup hsbc_dc_app_eim_lookup_eim_basic_extract.csv hostname as "Configuration Item" OUTPUT IT_SERVICE | search Status = Open | stats count as "Count of PR's" by Open_Date IT_SERVICE | sort 10 - "Count of PR's" | eval Open_Time_timestamp =strptime(Open_Date, "%d %b %y %l:%M:%S")| table IT_SERVICE Open_Time_timestamp "Count of PR's" Thanks

mm12 · ‎12-07-2021

Hi, I have the below query, I need the scatter point visualozation for this. time on the x axis and the count on the y axis. How to achieve this. |inputlookup hsbc_es_pr_mapping.csv | eval "Configuration Item" = lower('Configuration Item') | lookup hsbc_dc_app_eim_lookup_eim_basic_extract.csv hostname as "Configuration Item" OUTPUT IT_SERVICE | search Status = Open | fields "Problem Number" IT_SERVICE | stats count as "Count of PR's" by IT_SERVICE | sort 10 - "Count of PR's" Thanks

mm12 · ‎11-26-2021

@PickleRick - I am using below query for time chart instead of stats command but it is not working. index=incident_index source="/mi_data/dc_in_events.json" | spath path=Incident__Number output=INC | stats values(*) as * by INC | timechart count Thanks

mm12 · ‎11-26-2021

Hi, I am just taking the total count of incident using stats command form the json and the query is working fine. But when I using timechart command it is not giving me the visualization. Please anyone help me on this. index=incident_index source="/mi_data/dc_in_events.json" | spath path=Incident__Number output=INC | stats values(*) as * by INC | stats count(Incident__Number) Thanks

mm12 · ‎11-18-2021

Hi, I have installed Jira issues collector add-on to onboard the jira logs in splunk. configuration is done and I am able to see the logs in splunk .But my jira board contains 4685 events but I can see only 1000 events in splunk. I have read somewhere that this add-on will limit only 1000 events at a time. ca anyone help me how to onboard other events Thanks

mm12 · ‎11-12-2021

@gcusello In my query it checks for the orders that were not submitted at all. But I should check for the orders that were not submitted only after 48 hours giving 2 days time to process the orders. Thanks

mm12 · ‎11-12-2021

@gcusello thanks for the reply. But I have the below search query and I want to achieve the below use case. I want to know what batches were ordered in the selected time period, and have EITHER not been submitted at all, OR were submitted more than 48 hours after being ordered. index= sfg_objects eventtype=Object_Ordered host=* NOT [| search index= sfg_objects eventtype="Object_Submitted" host=* | dedup Job_name | fields Job_name] | stats count by orders | sort 10 -count Thanks

mm12 · ‎11-11-2021

Hi All, I need splunk query to identify orders which are ordered but not submitted even after 72 hours Any one help me on this Thanks

mm12 · ‎10-12-2021

Hi , I have a index sensitive_data that contains sensitive data. I want to ensure that ONLY one particular user with roles power, user has access to this index, but other users with same roles should not have access to this particualr index. How to do this reliably? What have I done is I created a LDAP group and mapped the role with this group and allowed the index access to particular role. Please someone helps whether the approach is correct. [role_power] cumulativeRTSrchJobsQuota = 10 cumulativeSrchJobsQuota = 200 list_storage_passwords = enabled schedule_search = disabled srchDiskQuota = 1000 srchMaxTime = 8640000 rtsearch = disabled srchIndexesAllowed = * srchIndexesDisallowed = sensitive_data [role_user] schedule_search = enabled srchMaxTime = 8640000 srchDiskQuota = 500 srchJobsQuota = 8 srchIndexesAllowed = * srchIndexesDisallowed = sensitive_data [role_sensitive-data-power] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = power srchIndexesAllowed = sensitive_data srchMaxTime = 8640000 [role_sensitive-data-user] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = user srchIndexesAllowed = sensitive_data srchMaxTime = 8640000 Thanks

mm12 · ‎10-05-2021

Hi, Has anyone worked with control-m logs in splunk. I want to understand what are the important attributes we need to consider for building dashboard for control-M logs. Thanks

mm12 · ‎09-23-2021

Hello, I have below query. Getting data from dc_nfast index and putting it in test index and using this test index in dashboard. we are not using test dc_nfast index anywhere. I want to refine the query so that it gets data from same index and putting in it same index. Can one advice on this `comment("Get latest NFAST data")` index=dc_nfast source=MIDDLEWARE_NFAST_DETECTION NOT "Nfast Version" IN ("NA","[no results]") [ | tstats latest(_time) as latest earliest(_time) as earliest count where index=dc_nfast source=MIDDLEWARE_NFAST_DETECTION host=nfast* earliest=-30d by _time , source , host span=2m | stats values(count) as count values(earliest) as earliest values(latest) as latest by _time , source , host | eventstats median(count) as median p5(count) as p5 p95(count) as p95 by source , host | eval range=(p95-p5) | eval lower_count=(median-range*3) , upper_count=(median+range*3) | where count >=lower_count AND count<=upper_count | eval earliest = earliest - 1 , latest = latest + 1 | dedup source , host sortby - latest | return 10 earliest latest host source ] `comment("Get lifecyclestate, country and ipaddress from master asset lists")` | lookup dc_app_dcmaster_master_asset_ul.csv hostname OUTPUT master_ipaddress as ul_master_ipaddress master_lifeCycleState as ul_master_lifeCycleState master_country as ul_master_country | lookup dc_app_dcmaster_master_asset_win.csv hostname OUTPUT master_ipaddress as win_master_ipaddress master_lifeCycleState as win_master_lifeCycleState master_country as win_master_country | lookup dc_app_unicorn_lookup.csv hostName as hostname OUTPUT locationCode | eval ipaddress=coalesce(ul_master_ipaddress, win_master_ipaddress) , lifeCycleState=coalesce(ul_master_lifeCycleState,win_master_lifeCycleState) , country=coalesce(ul_master_country,win_master_country) | fillnull value="UNKNOWN" ipaddress lifeCycleState country locationCode `comment("Join on serial number data from HSMC CSV import")` | rename "Serial Number" as HSMSerialNumber | makemv HSMSerialNumber `comment("Count the number of serial numbers per host")` | eval HSM_count=mvcount(HSMSerialNumber) | fillnull value=0 HSM_count | mvexpand HSMSerialNumber | join type=left HSMSerialNumber [ search `get_latest_source_in_range(test , /opt/splunk/etc/apps/dc_ta_nfast_inputs/git/master/HSMSplunkFeed/SPLUNK_HSM_Import_Listing.csv)` ] | rename Country as HSM_country "HSM *" as HSM_* "HSM * *" as HSM_*_ | foreach HSM* [ fillnull value="No_HSM_data" <<FIELD>> ] `comment("Add EIM service data - creating")` | lookup app_eim_lookup_eim_basic_extract.csv hostname OUTPUT PLADA_CRITICALITY SERVICE_IT_ORG6 SERVICE_IT_ORG7 IT_SERVICE SERVICE_OWNER SERVICE_OWNER_EMAIL | fillnull value="UNKNOWN" IT_SERVICE SERVICE_OWNER SERVICE_OWNER_EMAIL PLADA_CRITICALITY SERVICE_IT_ORG6 SERVICE_IT_ORG7 | eval servicedata=mvzip(IT_SERVICE ,SERVICE_OWNER ,"##") | eval servicedata=mvzip(servicedata,SERVICE_OWNER_EMAIL ,"##") | eval servicedata=mvzip(servicedata,PLADA_CRITICALITY ,"##") | eval servicedata=mvzip(servicedata,SERVICE_IT_ORG6 ,"##") | eval servicedata=mvzip(servicedata,SERVICE_IT_ORG7 ,"##") | eval servicedata=mvdedup(servicedata) | fields - PLADA_CRITICALITY SERVICE_IT_ORG6 ISERVICE_IT_ORG7 T_SERVICE SERVICE_OWNER SERVICE_OWNER_EMAIL | eval servicedata=mvdedup(servicedata) `comment("Now expand each servicedata into multiple lines where the is multiple values ")` | mvexpand servicedata `comment("Recreate the service values")` | rex field=servicedata "(?<IT_SERVICE>.*?)##(?<SERVICE_OWNER>.*?)##(?<SERVICE_OWNER_EMAIL>.*?)##(?<PLADA_CRITICALITY>.*?)##(?<SERVICE_IT_ORG6>.*?)##(?<SERVICE_IT_ORG7>.*)" `comment("Run addinfo command to capture info_search_time field")` | addinfo `comment("Write out to index")` | eval _time=now() | table hostname Combined Nfast* ipaddress lifeCycleState HSM_count country locationCode IT_SERVICE SERVICE_OWNER SERVICE_OWNER_EMAIL PLADA_CRITICALITY SERVICE_IT_ORG6 SERVICE_IT_ORG7 HSMSerialNumber HSM* | collect index=test source=stash Thanks

mm12 · ‎09-21-2021

Thanks. I have tried that still I am not getting as single event

mm12 · ‎09-21-2021

I have a log file below format and props.conf wriiten below. I am getting first four lines as one event and the remaining lines as separate events. But I want as single event . Can anyone help me on this. ******************************************************************************** product = WebSphere Application Server 20.0.0.3 (wlp-1.0.38.cl200320200305-1433) wlp.install.dir = /opt/IBM/wlp/ java.home = /opt/IBM/sdk/jre java.version = 1.8.0_241 java.runtime = Java(TM) SE Runtime Environment (8.0.6.7 - pxa6480sr6fp7-20200312_01(SR6 FP7)) os = Linux (3.10.0-1160.11.1.el7.x86_64; amd64) (en_GB) process = 29193@128.161.210.72 ******************************************************************************** [17/09/21 16:40:27:860 BST] 00000001 com.ibm.ws.kernel.launch.internal.FrameworkManager I CWWKE0002I: The kernel started after 3.119 seconds [17/09/21 16:40:28:003 BST] 0000003b com.ibm.ws.kernel.feature.internal.FeatureManager I CWWKF0007I: Feature update started. [17/09/21 16:40:28:809 BST] 0000003b com.ibm.ws.config.xml.internal.ConfigEvaluator W CWWKG0033W: The value [localHostOnly] specified for the reference attribute [allowFromEndpointRef] was not found in the configuration. [17/09/21 16:40:29:051 BST] 00000030 com.ibm.ws.security.ready.internal.SecurityReadyServiceImpl I CWWKS0007I: The security service is starting... [17/09/21 16:40:29:524 BST] 00000032 com.ibm.ws.annocache.service I OSGi Work Path [ /opt/IBM/wlp/usr/servers/e2/workarea/org.eclipse.osgi/43/data ] [17/09/21 16:40:31:924 BST] 00000031 com.ibm.ws.app.manager.internal.monitor.DropinMonitor A CWWKZ0058I: Monitoring dropins for applications. [17/09/21 16:40:33:586 BST] 00000031 com.ibm.ws.cache.ServerCache I DYNA1001I: WebSphere Dynamic Cache instance named baseCache initialized successful props.conf LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true BREAK_ONLY_BEFORE = (.\d{7}.\d\d:\d\d:\d\d.\d\d) MAX_TIMESTAMP_LOOKAHEAD = 18 DATETIME_CONFIG = TIME_FORMAT = %d/%m/%y %H:%M:%S:%3N %z TZ = BST TIME_PREFIX = "^ TRUNCATE = 0

Posts	17
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎09-21-2021

Online Status	Offline
Date Last Visited	‎03-24-2022 07:17 AM

How to create search for CPU linux to load average...

How to create a summary index?

scatter plot

timechart

Jira issues collector add-on

Splunk search query

Restrict Index access

control-m

Help to write the query

splunk event splitting