Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About pgadhari
pgadhari
Builder
Member since:
10-17-2011
12-31-2025
Community Statistics
| Posts | 401 |
| Solutions | 4 |
| Karma Given | 105 |
| Karma Received | 18 |
| Member Since | 10-17-2011 |
Activity Feed
- Posted Re: S3 bucket with CSV files not extracting fields at index time on All Apps and Add-ons. 12-23-2020 09:43 AM
- Karma Re: How can I access app's static content via Splunk endpoint? for Leo. 12-07-2020 04:28 AM
- Karma Re: How to set a different drilldown for each cell in a table in my Simple XML dashboard? for sundareshr. 12-07-2020 04:28 AM
- Karma Re: Can you change the colors in bar graph results and make them constant? for niketn. 11-19-2020 01:40 AM
- Karma Re: Removing null columns from a table for pj. 11-03-2020 12:21 PM
- Karma Re: Removing null columns from a table for jadomaai. 11-03-2020 12:21 PM
- Karma Re: Convert month field from csv in different format? for renjith_nair. 11-03-2020 04:54 AM
- Got Karma for Re: Convert month field from csv in different format?. 11-03-2020 04:51 AM
- Posted Re: Convert month field from csv in different format? on Splunk Search. 11-03-2020 04:24 AM
- Karma Re: Props and transforms not extracting fields properly for csv data for richgalloway. 11-03-2020 02:11 AM
- Posted Convert month field from csv in different format? on Splunk Search. 11-03-2020 02:10 AM
- Posted SRe: Props and transforms not extracting fields properly for csv data on Knowledge Management. 10-16-2020 10:26 AM
- Posted Props and transforms not extracting fields properly for csv data on Knowledge Management. 10-13-2020 12:56 AM
- Got Karma for Re: Improving search performance of search powered by summary index, datamodel and using loadjob ?. 09-25-2020 04:08 AM
- Got Karma for Re: Improving search performance of search powered by summary index, datamodel and using loadjob ?. 09-25-2020 04:07 AM
- Got Karma for Re: Improving search performance of search powered by summary index, datamodel and using loadjob ?. 09-25-2020 04:07 AM
- Got Karma for Improving search performance of search powered by summary index, datamodel and using loadjob ?. 09-25-2020 04:04 AM
- Posted Re: Network Toolkit : ping status for Multiple IP in different columns ? on Reporting. 08-04-2020 03:23 AM
- Posted Re: Network Toolkit : ping status for Multiple IP in different columns ? on Reporting. 08-04-2020 02:44 AM
- Posted Network Toolkit : ping status for Multiple IP in different columns ? on Reporting. 08-04-2020 01:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-23-2020
09:43 AM
@ShaneNewman .. were you able to resolve this issue ? I am also getting same issues ? Please let me know.. Regards PG
... View more
11-03-2020
04:24 AM
1 Karma
Yes @renjith_nair . I am able to resolve the issue with the above query. Thank you very much for immediate respnose.
... View more
11-03-2020
02:10 AM
My csv file has "month" field and the values are as below : 2020-10
2020-09
2020-08
2020-07
2020-06
2020-05
2020-04
2020-03
2020-02
2020-01 I want to convert the months from number to Jan, Feb, Mar, Apr and so on... I tried using strptime, but that is not working. I want to show it as 2020-Jan, 2020-Feb, 2020-Mar... Please help , below is my query : index=azure sourcetype=azure_total_cost source="C:\total_cost\\azure_total_cost_by_year.csv" month!="month" | eval mymonth=strftime(month, "%Y-%b")
... View more
Labels
- Labels:
-
stats
10-16-2020
10:26 AM
sure. I will check that setting and get back to you.
... View more
10-13-2020
12:56 AM
I have a CSV data in following format and I have written props and transforms to extract the fields. Somehow, the ""Summary|vSphere Tag"" field values are not getting extracted wherein I have written transforms for it. Below are my configuration files - inputs, props and transforms : CSV Data: "Name","Summary|vSphere Tag"
"DC4VPWSAM","[<Application_category-Software Asset Management>, <Sub_class-Facilities>, <Department-Infrastructure & Operations>, <Primary_System_Owner-Pankaj Gadhari>, <Section-SM Service Support_Sec>, <Organisation-Technology & Infrastructure>, <Division-I&O Service Management>, <Application_Name-Manager Suite>, <Unit-SM Service Support>, <Class-Line of Business>]"
"DC1VPWSAM","[<Application_category-Software Asset Management>, <Sub_class-Facilities>, <Department-Infrastructure & Operations>, <Primary_System_Owner-Pankaj Gadhari>, <Section-SM Service Support_Sec>, <Organisation-Technology & Infrastructure>, <Division-I&O Service Management>, <Application_Name-Manager Suite>, <Unit-SM Service Support>, <Class-Line of Business>]"
"DC3VPWSAM","[<Application_category-Software Asset Management>, <Sub_class-Facilities>, <Department-Infrastructure & Operations>, <Primary_System_Owner-Pankaj Gadhari>, <Section-SM Service Support_Sec>, <Organisation-Technology & Infrastructure>, <Division-I&O Service Management>, <Application_Name-Manager Suite>, <Unit-SM Service Support>, <Class-Line of Business>]"
"DCVPWSCCM","[<Primary_System_Owner-Pankaj Gadhari>]"
"witsql-esx","none" Inputs.conf [monitor://C:\VMware-Tags\tagsplit\*.csv]
disabled = false
index = vmware
sourcetype = vmware-tags-csv
crcSalt = <SOURCE> Props.conf [vmware-tags-csv]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
disabled = false
pulldown_type = true
REPORT-vmtags = myplaintransform1
EXTRACT-vmname = (?<vmname>[A-Za-z0-9]+), transforms [myplaintransform1]
REGEX=(?<vmname>[A-Za-z0-9]+),\<(.*?)-(.*?)\>
FORMAT=$1::$2 somehow the transforms is not working and the fields are not getting extracted. I want to extract Key Value pairs from "Summary|vSphere Tag" field so that it should show in search as below : vmname, Application_category Primary_System_Owner and so on... Please help resolve the issue.
... View more
Labels
- Labels:
-
field extraction
08-04-2020
02:44 AM
@thambisetty - even if I search both sources, showing Server_IP and Time_Server_IP will be problem, as I have 200 Server_IPs and only 10 Time_Server_IP. Actually, some Server_IPs (for eg 50 Server_IPs point to one Time_Server_IP), hence, showing the status will actually not work after taking from the lookup ? hope you got it ?
... View more
08-04-2020
01:57 AM
I am using Network Toolkit app for pinging some of my servers and getting the status as "Down" or "UP" and using lookup file I am showing other details of that server such as Area, Location, Data_Port and Time_server. But along with this, I have to show the ping status of "Time_Server" also into the same table panel. I don't want to create separate panels for Time Server health status. Attaching screenshot for your reference, so basically there should be one more column named "Time_Server_Status" showing "Down" or "UP" at the end of the table ? I have installed Network Toolkit app on HF and collecting the data into my index, the server ping is getting collected as sourcetype "ping", and I am also collecting ping status for Time_Server IPs in different sourcetype as timeserver_ping. In our environment, I want to monitor 200 server IPs and 10 Time_Server IPs, and I am using lookup file to show all the details as mentioned above. Hence, how can I show both Server and Time_Server IP ping status in the same table ? Please advise ?
... View more
- Tags:
- Network Toolkit
- ping
07-21-2020
10:22 PM
@niyaz006 - no I did not get resolution on attaching image. Instead, I used plain text message and did not attach the image.
... View more
06-12-2020
02:50 AM
@prettysunshinez - were you able to change the font color ? Actually the answers got read-only., hence could not post the solution. Actually I used the table_row_highlighting.js from dashboard examples and disabled the whole row highlighting code and used the table_row_highlighting CSS file and changed the font color instead of background color and removed the background-color property and used color property for changing the font color to green, amber and red. Hope this can help you in case if you want to do it.
... View more
- Tags:
- @
06-04-2020
09:06 AM
@richgalloway - tried putting that settings in props.conf, but still it is indexing as current time and not the Time field from CSV. Can you suggest any other alternative ?
[exec]
DATETIME_CONFIG = NONE
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
disabled = false
pulldown_type = true
TIMESTAMP_FIELDS = Time
TIME_FORMAT = %d/%m/%Y %H:%M
... View more
06-04-2020
07:28 AM
Also I have tried these settings from heavy forwarder also, but same results. The events are taking current time as index time and not the Time field from CSV?
... View more
06-04-2020
07:26 AM
I am trying to index a CSV file from UF, which contains some historical data. Below is the sample of the events. Somehow the events are not getting indexed based on the timestamp from the CSV file. Instead, they are getting indexed with current time (all the events having current timestamp) and not the timestamp from the time field in the CSV.
How can I fix this issue? I want to index the events based on the time field that goes to Jan to March 2020. Please help to resolve this? I have attached the screenshot also for your reference.
Time,Mbps_IN,Mbps_OUT
01/01/2020 0:00,17222030,874306
02/01/2020 0:00,19368200,1504505
03/01/2020 0:00,15194740,150084
04/01/2020 0:00,4768362,1790559
05/01/2020 0:00,57691290,6339732
06/01/2020 0:00,44419200,2114772
07/01/2020 0:00,16432560,1144577
08/01/2020 0:00,9053104,23321280
09/01/2020 0:00,16265580,12490060
10/01/2020 0:00,2274004,4886436
11/01/2020 0:00,28840920,1388473
12/01/2020 0:00,6569902,6743890
13/01/2020 0:00,9766315,31771390
14/01/2020 0:00,8418418,2619432
15/01/2020 0:00,8751632,4382776
16/01/2020 0:00,22305280,8519139
17/01/2020 0:00,2989921,157784
18/01/2020 0:00,5307088,225203
19/01/2020 0:00,21432030,22773270
20/01/2020 0:00,29338980,2971322
21/01/2020 0:00,9230931,2120051
22/01/2020 0:00,7299774,10691780
23/01/2020 0:00,50019440,6489089
24/01/2020 0:00,3431143,241807
25/01/2020 0:00,5989488,830827
26/01/2020 0:00,77886710,7772389
27/01/2020 0:00,6841259,23842100
28/01/2020 0:00,79912540,26599700
29/01/2020 0:00,50530910,5565867
30/01/2020 0:00,21047160,6741192
31/01/2020 0:00,10868270,784867
01/02/2020 0:00,7047898,1671952
02/02/2020 0:00,67265450,8155953
03/02/2020 0:00,36689240,5077973
My inputs.conf :
[monitor:///home/splunk/bw_history/exec_hist.csv]
sourcetype = exec
index = testindex
crcSalt = <SOURCE>
My props.conf :
[exec]
DATETIME_CONFIG = NONE
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
disabled = false
pulldown_type = true
TIMESTAMP_FIELDS = Time
... View more
Labels
- Labels:
-
CSV
-
inputs.conf
-
props.conf
-
universal forwarder
06-04-2020
02:08 AM
Sure. I will share the details.
... View more
06-02-2020
11:02 PM
@niketnilay - how can I hide the text ? It would be good to know.
... View more
06-02-2020
02:05 PM
@niketnilay - I was able to do the font color same as background. No worries.. Thanks for your support as always :-)...
... View more
06-02-2020
04:08 AM
below is the url of the image :
https://imgur.com/a/O3wVhot
... View more
06-02-2020
04:05 AM
@niketnilay - - one small requirement, I was able to format the background of the cell based on format expression option, but now I want to show the font color also to the same color as of background, as it will display only background color and not the numeric values ?
Actually, I have to show only cell with background green red amber grey, and don't have to show the values now ? is there a way using CSS or some other way to hide the numeric values of the cell ? Please advise ? I am attaching the screenshot of the table for your reference.
... View more
06-01-2020
10:21 AM
@niketnilay - I dont see any option to "Accept" the answer in your comment ?
... View more
06-01-2020
10:16 AM
I have changed the viz to table and used format option to apply colors. I am ok with it. Thanks for your step-1.
... View more
06-01-2020
10:08 AM
yes it worked. That was easy. 🙂 Thank you very much.
... View more
06-01-2020
02:57 AM
some how the set token word did not come. I am already using "set" token in my drilldown option, due to which it is not allowing to put the conditional-drilldown ? please advise ?
... View more
06-01-2020
02:42 AM
@kamlesh_vaghela - when I try to add that conditional-drilldown, it gives following warning :
invalid child="set" is not allowed in node=conditional-drilldown"
below is my XML code, I am already using for that row (table)
<drilldown>
<set token="tok_sas_cat">$click.value$</set>
<unset token="tok_fm_cat"></unset>
<unset token="tok_al_cat"></unset>
<condition match="match('click.value',"Average")">
</condition>
<!-- Put here other values's condition-->
<!-- OR put single condition for all values -->
<condition>
</condition>
</drilldown>
Also, do I need to put any values where you have written "Put here other value's condition" ??
... View more
05-31-2020
11:31 PM
In my table the last row is the "Average" of all the columns which is calculated based on the query. I want to disable the drilldown click for it. how it can be done ? Attaching image for your reference.
Below is the snippet of query I am using for the table :
| transpose header_field=Category 10 | addtotals | eval Average=round(Total/8,0)| fields - Total | table column "Availability Management" "Identity Access & AD" "Information Security Management" "Monitoring & Analysis" "Server & Storage" "Service Asset & Configuration Mangement" "Service Management" Others Average | transpose header_field=column 25 | rename column as Category
... View more
05-30-2020
10:33 AM
1 Karma
I will try to use the table and see how it looks instead of single viz and revert.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-31-2025
07:06 AM
|
