Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About GEB
GEB
Explorer
Member since:
12-08-2021
07-02-2024
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 12-08-2021 |
Activity Feed
- Posted Re: Find event in one search, get related events by time in another search on Splunk Search. 06-26-2024 07:03 AM
- Posted Re: Find event in one search, get related events by time in another search on Splunk Search. 06-25-2024 07:54 AM
- Posted Re: Find event in one search, get related events by time in another search on Splunk Search. 06-25-2024 05:30 AM
- Posted Find an error in 1st system and then find errors close in time in a 2nd system on Splunk Search. 06-24-2024 01:06 PM
- Tagged Find an error in 1st system and then find errors close in time in a 2nd system on Splunk Search. 06-24-2024 01:06 PM
- Tagged Find an error in 1st system and then find errors close in time in a 2nd system on Splunk Search. 06-24-2024 01:06 PM
- Tagged Find an error in 1st system and then find errors close in time in a 2nd system on Splunk Search. 06-24-2024 01:06 PM
- Tagged Find an error in 1st system and then find errors close in time in a 2nd system on Splunk Search. 06-24-2024 01:06 PM
- Karma Re: How can I count events by location with a list of SERVERNAME's? for bowesmana. 02-21-2024 05:30 AM
- Posted Re: How can I count events by location with a list of SERVERNAME's? on Splunk Search. 02-21-2024 05:29 AM
- Posted Re: How can I count events by location with a list of SERVERNAME's? on Splunk Search. 02-20-2024 01:42 PM
- Posted How can I count events by location with a list of SERVERNAME's? on Splunk Search. 02-16-2024 12:53 PM
- Tagged How can I count events by location with a list of SERVERNAME's? on Splunk Search. 02-16-2024 12:53 PM
- Tagged How can I count events by location with a list of SERVERNAME's? on Splunk Search. 02-16-2024 12:53 PM
- Karma Re: evaluate time range in splunk event data and alert for ITWhisperer. 12-09-2021 06:56 AM
- Posted Re: evaluate time range in splunk event data and alert on Alerting. 12-09-2021 06:51 AM
- Posted evaluate time range in splunk event data and alert on Alerting. 12-08-2021 12:58 PM
- Tagged evaluate time range in splunk event data and alert on Alerting. 12-08-2021 12:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
06-26-2024
07:03 AM
Perhaps a better title would be: "Find an error in one system and then find errors close in time in a 2nd system". In my case, both search strings include the word 'Error' and the values are text to indicate what the errors are about. Two Searches: index=first_index sourcetype=first_source error 500
| rex field=_raw "string(?<REF_VAL>\d+)"
| table _time REF_VAL Output: _time REF_VAL 2024-06-2024 10:48:04.003 Avalue index=second_index soucetype=second_souce error somestring
| rex field=_raw "ERROR - (?<ERR_MTHD>\S+)"
| table _time ERR_MTHD Output: _time ERR_MTHD 2024-06-24 10:48:51.174 Method1text 2024-06-24 10:48:51:158 Method2text Output that I would like: EVENT_TIME REFERENCE_VAL RELATED_TIME RELATED_VAL 2024-06-2024 10:48:04.003 Avalue 2024-06-24 10:48:51.174 Method1text 2024-06-2024 10:48:04.003 Avalue 2024-06-24 10:48:51:158 Method2text
... View more
06-25-2024
07:54 AM
Thanks for the response - I expect about 5 results for each reference result -> so I set maxsearches=5. However, nothing I have tried produces any results. Boss? You mean team SME? Don't actually have one of those, we are in a help yourself environment. Everything I've done with the above query results an a msg that says "unable to run query", specifying the query after the map.
... View more
06-24-2024
01:06 PM
"Find event in one search, get related events by time in another search" Found some related questions but could not formulate a working solution from them.... Of course this doesn't work, but maybe it will make clear what is wanted, values in 2nd search events within milliseconds (2000 shown) of first search's event.... index=someIndex searchString
| rex field=_raw "stuff(?<REFERENCE_VAL>)$"
| stats _time as EVENT_TIME
| append (search index=anIndex someSearchString
| rex field=_raw "stuff(?<RELATED_VAL>)$"
| eval timeBand=_time-EVENT_TIME | where abs(timeBand)<2000
| stats _time as RELATED_TIME)
| table EVENT_TIME REFERENCE_VAL RELATED_TIME RELATED_VAL
... View more
Labels
- Labels:
-
subsearch
02-21-2024
05:29 AM
You are correct, Thanks for the solution: The names must be in quotes AND they are case sensitive.
... View more
02-20-2024
01:42 PM
Thanks, but I haven't quite got it. The query is accepted, but the PODNAME is not being set (everything is under DANG). index=some_index | eval PODNAME=case(in(SERVERNAME, "servername1", "servername2", "servername3"), "ONTARIO", in(SERVERNAME, "servername4", "servername5", "servername6"), "GEORGIA", 1==1, "DANG" ) | timechart span=10min count by PODNAME
... View more
02-16-2024
12:53 PM
Our splunk implementation has SERVERNAME as a preset field, and there are servers in different locations, but there is no location field. How can I count errors by location? I envision something like this but cannot find a way to implement: index=some_index "some search criteria"
| eval PODNAME="ONTARIO" if SERVERNAME IN ({list of servernames})
| eval PODNAME="GEORGIA" if SERVERNAME IN ({list of servernames})
| timechart span=30min count by PODNAME Any ideas?
... View more
- Tags:
- comparison
- location
Labels
- Labels:
-
timechart
12-08-2021
12:58 PM
Given an event log specification of: "{DateTime} Times: Online_1: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM} Online_2: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM} Offline_1: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM} Offline_2: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}" which is logged 4 times a day and an example entry like: "2021-12-08 14:31:59 Times: Online_1: CNCT_TM: 2021-12-08 14:47:13.873; LOG_TM: 2021-12-08 14:47:16.387; Online_2: CNCT_TM: 2021-12-08 14:47:49.837; LOG_TM: 2021-12-08 14:47:50.480; Offline_1: CNCT_TM: 2021-12-08 14:48:27.303; LOG_TM: 2021-12-08 14:48:28.927; Offline_2: CNCT_TM: 2021-12-08 14:48:56.673; LOG_TM: 2021-12-08 14:48:58.750" How do I evaluate and graph the time range in Minutes and Seconds (just seconds would be fine for me) between the maximum and minimum times embedded in the 8 times captured in the log entry? Ultimately, I would like to create an alert if a time range greater than something like 30 minutes were to occur.
... View more
Labels
- Labels:
-
alert condition
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-02-2024
12:22 PM
|
