About lostcauz3

lostcauz3 · ‎02-21-2023

Hi, I have an index= random_index which contains JSON data of a URL HTTP status code like {'availability':200,application:'random_name'}. the above index gets input from an RPA bot through sent to the splunk http event collector endpoint every hour. example search query index=random_index earliest=-24h latest=now | search availability=200 | lookup Application_details.csv application OUTPUT Service,ServiceOffering,AssignmentGroup,Priority | stats count as avaibility_count | eval availability_percentage= (avaibility_count/24)*100 | search availability_percentage < 95 | table availability_percentage,Service, ServiceOffering,AssignmentGroup,Priority | appendpipe[ | stats count | where count=0 | appendcols [| eval availability_percentage=0,Service=random_service,AssignmentGroup=random_group etc | table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority ]] | dedup availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority | table availability_percentage, Service,ServiceOffering, AssignmentGroup,Priority if the percentage is less than 95% then we will trigger an email and create a ServiceNow incident through the row that is returned in the Splunk search but in case the index didn't receive the data per hour due to some error, how to check that and still return a dummy result only if no results are returned but not to return the dummy result in the append-pipe section in the case where availability is less than 95%

lostcauz3 · ‎03-14-2022

KPI XYZ-123 XYZ-12345 Service-123 Service-12345 random_data random_data random_data random_data random_data random_data random_data random_data random_data random_data I Have a dashboard like this one above , I want to enable drilldown for the columns whose field-names start with XYZ and disable drilldown for the ones that start with Service. Is there any way i can achieve this in xml ?

lostcauz3 · ‎02-25-2022

thanks @gcusello i have done it the same way you mentioned, was just thinking if there was any alternate.

lostcauz3 · ‎02-25-2022

how can i change the id of a dashboard? The name and description i can edit but how to change the dashboard id after it has been created?

lostcauz3 · ‎02-18-2022

if i add crcSalt = <SOURCE> to the inputs.conf file what will this do in my case ? I'm very confused about this

lostcauz3 · ‎02-18-2022

I have a directory that is being monitored on a splunk heavy forwarder. /app_monitoring The above directory will receive a file everyday called Report.csv there may be duplicate data in it that is already indexed, how to prevent duplicate indexing in this case? do i have to change anything in the inputs.conf in the app folder? please advise.

lostcauz3 · ‎01-18-2022

Thanks a ton!! you taught me a lot.

lostcauz3 · ‎01-18-2022

KPI GLOBAL LOCAL random1 random_data random_data random2 random_data random_data random3 random_data random_data I have a dashboard like the above i want to design a conditional drilldown where : when someone clicks on any value(random_data) in the global column they must be redirected to a different page in a new tab when they click on any value(random_data) in the local column they must be redirected to a different page in a new tab is there any way to achieve this?

lostcauz3 · ‎01-17-2022

if the search is stuck in 'waiting for input' state then the progress tab will not run the condition and set the token you mean? As stated by you earlier that it will always be true so show_panel2 should be true also for the above code? Sorry I'm getting confused.

lostcauz3 · ‎01-17-2022

<row> <panel depends="$show_panel2$"> <chart> <search base="main_base"> <progress><condition> <set token="show_panel2">true</set> </condition> </progress> <query>| search date="$tok_mon$"</query> </search> </chart> </panel> </row> in the above case if i the token $tok_mon$ is not initialized and the search will be stuck at waiting for input but still it's not showing the panel.

lostcauz3 · ‎01-17-2022

when does the token get unset inside the progress tag? is it at the end of the search or when it is ongoing?

lostcauz3 · ‎01-17-2022

<panel depends="show_panel"> <title>xyz</title> <search base="main_base"> <progress> <condition> <set token="show_panel">true</set> <condition> <condition> <unset token="show_panel"></unset> <condition> </progress> <query> | search months="$tok_mon$" </query> </search> </panel> can anyone explain what the above xml code is doing with the token show_panel and what the progress Tag is doing or does? this is a drilldown xml code .

lostcauz3 · ‎12-30-2021

i have data in an index=xyz in json format like with http status code from specific applications this below is a single event data { "Application1": "200", "Application2": "200", "Application3": "200" } i want the data to be visualized like Application Status reltime application1 200 3 hours ago application 2 200 3 hours ago how can i get output like this ?

lostcauz3 · ‎12-29-2021

Tab1 Tab2 Tab3 Tab4 Tab5 _time 200 200 200 200 200 timestamp value 200 200 200 200 200 timestamp value the above data i'm getting from an index which has json data after writing index = xyz | table Tab*,_time Tab1 Tab2 Tab3 Tab4 Tab5 _time reltime 200 200 200 200 200 timestamp some hours ago the above table i'm getting after adding | sort - _time | head 1| reltime to the above query then i'm doing transpose column_name=Application_list | rename 'row 1' as Status | eval status = if((Status=200),"up","down) is there any way to retain the reltime column to the above table after transposing it because i'm getting below output? application_list Status Tab1 up Tab2 up Tab3 up Tab4 up Tab5 up reltime down _time down and i want it like application_list Status reltime Tab1 up x hours ago Tab2 up x hours ago Tab3 up x hours ago Tab 4 up x hours ago Tab 5 up x hours go below is the whole query: index = xyz | table Tab*,_time | sort - _time | head 1| reltime | transpose column_name=Application_list | rename 'row 1' as Status | eval status = if((Status=200),"up","down)

lostcauz3 · ‎12-07-2021

Yes you got it correct @gcusello I want to check the individual fields in the lookup to the one in the index and then join the result.

lostcauz3 · ‎12-07-2021

lostcauz3 · ‎12-07-2021

i need the fields which are present in the index to be joined with the ones common to the ones in the lookup file. like assigntment in the index to the assignment in the lookup SO in the index to SO in the lookup file Ser in the index to Ser in the lookup the above 3 conditions are separate conditions they are not in pairs, i need splunk to give me only results which values for these fields which is present in the lookup as well as the index

lostcauz3 · ‎12-07-2021

lostcauz3 · ‎12-06-2021

TYPE Month KPI_1 KPI_2 GLOBAL Oct'21 76 24 LOCAL Oct'21 46 67 I'm searching the table like | search TYPE="GLOBAL" | search Month="Oct'21" Then i'm transposing the table after deleting the months field | fields - Month | transpose header_field=TYPE column_name=KPI My problem is sometimes when I'm searching something that is not there like Month="Sep'21" only the first column of the transposed table is coming like KPI KPI_1 KPI_2 How to show no results found instead of this 1 column table

lostcauz3 · ‎11-30-2021

thanks a ton, Solved it!

lostcauz3 · ‎11-30-2021

this is happening after stats values(*) as * by ORG,MONTH. any way i can delete the multivalues of these fields that is NA @ITWhisperer

lostcauz3 · ‎11-30-2021

thanks for the suggestion this is working but there is something with my data that i am missing i guess that's why extra "NA" is being added to the fields containing 100.

lostcauz3 · ‎11-30-2021

ORG Month KPI_1 KPI_2 KPI_3 KP_4 first Sep21 100 NA 100 NA 100 NA 100 NA output is coming like this for the above query you mentioned

lostcauz3 · ‎11-30-2021

ORG Month KPI_1 KPI_2 KPI_3 KPI_4 first Sep21 100 NA NA NA first Sep21 NA 100 NA NA first Sep21 NA NA 100 NA first Sep21 NA NA NA 100 how do i convert the table above to get the table below: ORG Month KPI_1 KPI_2 KPI_3 KPI_4 first Sep21 100 100 100 100

lostcauz3 · ‎11-25-2021

i have a query like index="default_index" source="source1.csv" *calculations* | appendcols [search index="default_index" source="source1.csv" | * different calculations*] | appendcols [ search index="default_index" source="source1.csv" | *differenct calculations*] is there any way i can optimize the indexing in this search because the same index is used multiple times for multiple different calculations

Posts	38
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎11-09-2021

Online Status	Offline
Date Last Visited	‎02-21-2023 06:03 PM

Why are results showing when there are none?

How to to enable drilldown for the columns whose f...

How can i change the id of a dashboard?

Experiencing duplicate indexing- How do I solve th...

Conditional DrillDown

progress and token explanation

table creation from data

reltime

inner join

showing table despite no results

Why are results showing when there are none?

How to to enable drilldown for the columns whose f...

Re: dashboard id change

How can i change the id of a dashboard?

Re: Duplicate indexing

Experiencing duplicate indexing- How do I solve th...

Re: Conditional DrillDown

Conditional DrillDown

Re: progress and token explanation

Re: progress and token explanation

Re: progress and token explanation

progress and token explanation

table creation from data

reltime

Re: inner join

Re: inner join

Re: inner join

inner join

showing table despite no results

Re: result combination

Re: result combination

Re: result combination

Re: result combination

result combination

query optimization