Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About tincupchalice
tincupchalice
Path Finder
Member since:
03-29-2011
12-19-2024
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 5 |
| Member Since | 03-29-2011 |
Activity Feed
- Posted Re: PLC & HMI Monitoring on Getting Data In. 12-18-2024 01:22 PM
- Got Karma for Re: How to break out multiple values into a new column?. 06-05-2020 12:47 AM
- Got Karma for Re: Saved Search Deletion. 06-05-2020 12:46 AM
- Karma Re: running a Saved Search from the Command Line Interface (CLI) for bwooden. 06-05-2020 12:45 AM
- Karma Re: Timezone and Timestamp modification at search/report time? for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: Strange character escaping in eval and rex for gkanapathy. 06-05-2020 12:45 AM
- Got Karma for How do I write a Custom stat function. 06-05-2020 12:45 AM
- Got Karma for How do I write a Custom stat function. 06-05-2020 12:45 AM
- Got Karma for Convert search value to field name for input to another search. 06-05-2020 12:45 AM
- Posted Re: Urgent !! Complex case statements in eval on Splunk Search. 05-28-2015 01:47 PM
- Posted Re: How to break out multiple values into a new column? on Splunk Search. 05-27-2015 03:04 PM
- Posted Re: How to edit my code to have all checkboxes automatically checked when my HTML dashboard loads? on Dashboards & Visualizations. 05-27-2015 12:56 PM
- Posted Re: Timestamps for two different field on Getting Data In. 09-09-2013 06:04 AM
- Posted Re: Timestamps for two different field on Getting Data In. 09-05-2013 05:11 AM
- Posted Re: Bitwise workaround on Splunk Search. 01-22-2013 07:03 AM
- Posted Bitwise workaround on Splunk Search. 01-18-2013 12:14 PM
- Tagged Bitwise workaround on Splunk Search. 01-18-2013 12:14 PM
- Tagged Bitwise workaround on Splunk Search. 01-18-2013 12:14 PM
- Posted Re: How to configure int64 epoch nanosecond timestamp as _time on Getting Data In. 11-08-2012 08:09 AM
- Posted Re: How to configure int64 epoch nanosecond timestamp as _time on Getting Data In. 11-08-2012 07:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 |
12-18-2024
01:22 PM
Have you looked at Factory Talk, Fiix, or Plex? They are priced software packages and my company sells them. I actually am looking to develop a Splunk solution for PLC's as I am a long time Splunk developer. I also just realized this question is 3.5 years old, ha!
... View more
05-28-2015
01:47 PM
so you can't just
| bin _time span=1h
| stats max(Usage) as maxUser by _time User
| stats sum(maxUser) by _time
... View more
05-27-2015
03:04 PM
1 Karma
So something like
| mvjoin(colc, ":")
| rex field=colc "x,(?<colcx>\d+):y,(?<colcy>\d+):z,(?<colcz>\d+)"
| table cola colb colcx colcy colcz cold
... View more
05-27-2015
12:56 PM
Did you try adding this to the initial body js, or onload()?
document.getElementById("btnCheckServers").click();
... View more
09-09-2013
06:04 AM
I just realized that the rex field got screwed up in formatting. I fixed it above by adding a \ where appropriate.
I don't know how the points work to be honest 😛
... View more
09-05-2013
05:11 AM
I did not see the date in the event, just the source file so to answer this I used the following...
*
| eval file="/home/f65351/EBM/A20130901.1600+0800-20130901.1615+0800_10_ebs.1158"
| eval fname=mvindex(split(file, "/"), -1)
| eval date=substr(mvindex(split(fname, "."), 0),2)
| eval blah="|service_request-success-15-3-0-137-140|||||#0(nocausecode)|ril3_cause|||||||||||||||||||||||||466-01-9113-1-0-25658|||466015801456696-4280957185-3556660525560234-886989688406||||||||||||0||||466015801456696-4280957185-3556660525560234-8869896884065-211.77.232.34-110.26.113.23-undefined|||wcdma|0||ms||data|||#0(bearer successful)|||||||"
| rex field=blah "service_request\-success\-(? \d{1,2})\-(? \d{1,2})\-(? \d{1,2})\-(? \d{1,3})\-(? \d{1,3})"
| eval ts=date . " " . hour . "-" . min . "-" . sec . "-" . msec
| eval uts = ts . usec
| eval numts=strptime(uts, "%Y%m%d %H-%M-%S-%f")
| eval sqlts=strftime(numts, "%Y-%m-%d %H:%M:%S.%f")
| stats count by date hour min sec msec usec ts uts numts sqlts
Now you will replace file with source and blah with _raw. ts I believe answers your question. uts adds what I think is the extra microseconds. numts gives you an epoch number for that exact time. sqlts is how you can now use that number for other types of applications (like sql).
... View more
01-22-2013
07:03 AM
| rex field=StreamId "0x(?<oct4>\S{2})(?<oct3>\S{2})(?<oct2>\S{2})(?<oct1>\S{2})(?<engine>\S{2})"
| eval oct1=tonumber(oct1, 16)
| eval oct2=tonumber(oct2, 16)
| eval oct3=tonumber(oct3, 16)
| eval oct4=tonumber(oct4, 16)
| eval Engine=tonumber(engine, 16)
| eval Machine=oct1.".".oct2.".".oct3.".".oct4
This worked for me, now I just need to | nslookup. Thanks for the input.
... View more
01-18-2013
12:14 PM
I have a field StreamId=0x12da3b7514f19ce7
I want to do this:
(StreamId >> 😎 & 0xFFFFFFFF
I know I can /256 to shift 8, but I'm trying for a one-liner without any custom macros or search commands.
Without an extensive eval/if(if(if(if(...
Any suggestions?
Thanks,
Bob
... View more
11-08-2012
08:09 AM
however what is the point in using a nanosecond timestamp for _time if I cant get the precision out of Splunk???
sourcetype=OrderGW-RJ | eval tm=_time | eval stm=strftime(_time, "%Y-%m-%d %H:%M:%S.%9N") | stats count by _time tm stm | head 1 | table _time tm stm
_time tm stm
10/30/12 1:56:43.000 PM 1351623403.000225 2012-10-30 13:56:43.000225000
... View more
11-08-2012
07:56 AM
That worked, thanks for the clarification.
... View more
11-07-2012
02:46 PM
should be {19}, but still not working...
... View more
11-07-2012
02:45 PM
So I tried pattern as \d{18} for events looking like:
1351623403000225565 Type=VARIABLE, blah blah
1351623403000225568 Type=VARIABLE, blah blah
1351623403000225570 Type=VARIABLE, blah blah
when trying to add a data file from the manager, but splunk will not recognize this as a timestamp.
I've also tried ^\d, ^\d{18}.
With \d{18}, it generates a props.conf:
# your settings
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%9N
TIME_PREFIX=\d{18}
TZ=America/Chicago
... View more
04-04-2012
07:44 AM
1 Karma
Answering my own question...
I am going to try the dispatch method here, but what a pain we can't do this through the interface
*******
dispatch search options
*******
dispatch.ttl = [p]
* Indicates the time to live (in seconds) for the artifacts of the scheduled search, if no
actions are triggered.
* If an action is triggered Splunk changes the ttl to that action's ttl. If multiple actions are
triggered, Splunk applies the maximum ttl to the artifacts. To set the action's ttl, refer
to alert_actions.conf.spec.
* If the integer is followed by the letter 'p' Splunk interprets the ttl as a multiple of the
scheduled search's execution period (e.g. if the search is scheduled to run hourly and ttl is set to 2p
the ttl of the artifacts will be set to 2 hours).
* Defaults to 2p (that is, 2 x the period of the scheduled search).
... View more
04-04-2012
07:40 AM
I have several saved searches that are scheduled at staggered times in the afternoon. After several kick off, I reach my disk quota limit and the other searches try to kick off and hang. When I come in in the morning I still have several searches at 100% but failing to finalize and send the respective csvs via email. Outside of bumping my disk quota limits, is there a setting for saved searches that is some big secret where after the email is sent, splunk will delete it immediately? I've tried setting alerts and the what not to 1 sec, but no dice.
Thanks,
Bob
... View more
06-20-2011
07:19 AM
So there is another thread we have going on addressing this issue. The first is that percentiles are being calculated with nearest rank method which is on the level of 8th grade math and for what we do, we need linear interpolation. Second is that it is currently incorrect when doing this as it is taking the next lower value than it should. 1,2,3 returns a median of 1 instead of 2, - 1,2,3,4 will return 2 instead of 2.5. I think we are going to do an ER for either new, more precise percentile functions or ask the existing functions to be corrected. I'm working on the custom search for now.
... View more
06-17-2011
12:22 PM
The second will work given a handful of locations, I guess I was trying to be too clever.
... View more
06-17-2011
12:17 PM
2 Karma
I am not trying to write a custom search command from the docs I've read on that topic. I rather would like to write my own linear interpolation percentile functions to be called after stats rather than the splunk versions that are a light weight percentile calculator and typically will miscalculate the true percentile. Does anyone have their own stat function they have written or is there something in the search command docs I am missing?
... View more
03-29-2011
06:52 PM
1 Karma
Is there a way to take a value from one lookup or search and make it the field name for the other.
Example:
| eval idx=3
| lookup ltable1 idx OUTPUT location
| eval idx=5
| lookup ltable1 idx OUTPUT location AS location2
???| eval fname=value(location2) AS FIELD???
| lookup ltable2 location OUTPUT fname
example ltable1
idx,location
1,chi
2,lon,
3,nyc
ltable2
location,chi,lon,nyc
chi,NA,2,3
lon,6,NA,4
nyc,2,5,NA
wanting to Xref the 2 tables like a mileage matrix of sorts, therefore given chi as a value from ltable1 Xref to lon will get me 2.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-19-2024
08:30 AM
|
Karma from
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
