About Steve_A200

Steve_A200 · ‎06-26-2024

Thank you @yuanliu , you solution worked, I had to make minor modifications below, but thank you very much indeed. Modified the section after "... where count > 1" to below: | where count > 1 | table Date Token _time | eval idx = mvrange(0, mvcount(_time)) | eval TimeGaps_Secs = mvmap(idx, if(idx > 0, tonumber(mvindex(_time, idx)) - tonumber(mvindex(_time, idx - 1)), null())) | fieldformat Date = strftime(_time, "%F %T.%2N") | table Token Date TimeGaps_Secs Thank you Again.

Steve_A200 · ‎06-26-2024

Hi, I need help in extracting the time gaps in a multi-value field represented as Date. My data output looks like this: index=myindex | stats values(_time) as _time values(recs) as recs count by Token | eval Date= strftime (_time,"%F %H:%M:%S.%2q ") | where count > 1 | table Token Date Token Date 363311 2024-06-25 17:20:08.26 2024-06-25 17:23:51.12 231321 2024-06-25 18:10:58.86 2024-06-25 18:11:28.12 2024-06-25 18:12:19.38 2024-06-25 18:13:21.90 827341 2024-06-25 15:17:18.06 2024-06-25 15:37:47.93 2024-06-25 15:41:03.21 I would like to display the difference in time stamps in a new column called "time_gaps", and it would list the time in seconds between the latest time and the previous time, some Tokens have only 2 time stamps, so there should be only 1 value in the time_gap field, however, other that have 4, should have values representing the time difference between the 1st and 2nd, 2nd and 3rd, 3rd and 4th. I tried streamstats but it seems I may be doing something wrong. Any clean and effect SPL would be appreciated. Thanks

Steve_A200 · ‎01-03-2024

I figured it out, the universal _time would be used by default when no earliest/latest parameters are specified.

Steve_A200 · ‎01-03-2024

Hi, I am trying to create a splunk classic dashboard, but struggling with setting the earliest values. The goal is to run a search, and have the results pull data from 2 different index files while controlling the data pulled from the first index by a dropdown time parameter. The SPL is part of a radio button option with the dashboard and starts as such: ( (index=first_index source="first_file_location" $time_range$ latest=-1d@d() ) OR (index=second_index earliest=@d latest=now() source="second_file_location") ... rest of the SPL time_range token is the dropdown input with a static value set to earliest=-7d@d() When I run the search, it is not substituting the static value into the search, and is populating it as the token name with the $ sign. Would it be possible to set the earliest value for the first index using a dropdown menu. Any assistance would be greatly appreciated. Thanks

Steve_A200 · ‎12-07-2023

Hi, I am not sure if this is possible at all or not, but I figured best to ask the experts before I keep spinning in circles. I have created a classic dashboard, and would like to add the ability to toggle the visibility of the column chart data by having the user click on any of the desired legend label of the data series, and the columns belonging to that data visibility gets toggled Off or On. So in the below example, the column chart is displaying 2 labels in the legend, "Used" and "Discount" at the start, and I would like to have the user toggle that view. I do not have access to the backend server and would like to do everything from the GUI. I would like the user to be able to click on the legend "Used" listed entry, and the column chart would remove the "Used" columns, and only display the "Discount" columns preferably expanded to the width of the column chart. I have seen it occur in one of the other column chart within the same dashboard, and I have not added or modified anything to create that. The Drilldown option is set to None for this panel, and all other panels, yet by some magic the other panels sometimes behave to toggle Off/On the data being display by clicking on the legend labels. The section for this panel xml is below, and any help would be greatly appreciated: <panel> <chart id="chart1"> <title>Titte of the Dashboard</title> <search base="base_search"> <query>| search merchant IN ($merchant$) | chart sum(used) as Used sum(Discount) as Discount over _time by merchant | addcoltotals row=f col=t label="Totals" labelfield=merchant fieldname="Totals" Used Discount</query> </search> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.drilldown">none</option> <option name="charting.legend.placement">right</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> </chart> </panel>

Steve_A200 · ‎07-27-2023

Thank you for the reply, the solutions provided worked great, exactly what I needed. Much appreciated.

Steve_A200 · ‎07-26-2023

I am still trying to get my head around regular expressions in splunk, and would like to use regex that could parse the _raw data to create an extracted field with the contents that are between the square brackets: _raw example data looks like this: 2023-07-26 15:11:16.932 [ engine1] [Error-1] INFO java.Exception: example text 2023-07-26 15:11:16.932 [ core2] [Thread-5] WARN java.Exception: example text 2 2023-07-26 15:11:16.932 [ main3] [Token-2] INFO java.Exception: example text 3 2023-07-26 15:11:16.932 [ Job4] [Thread-1] WARN java.Exception: example text 4 I need to extract field that is based on the data between the first square brackets. If I need another field that is based on teh second square brackets. So, I would like the results to look like like below: Field_1 Field_2 engine1 Error-1 core2 Thread-5 main3 Token-2 Job4 Thread-1 Any feedback and help would greatly appreciated. Thanks

Steve_A200 · ‎05-12-2023

Thank you ITWhisperer, that indeed did the trick. I sandwiched your search between the fields and table commands.

Steve_A200 · ‎05-12-2023

Hi ITWhisperer, Unfortunately, that didn't do the trick. 2 issues: - it did not list events that contained the keyword being search i.e. like "java" - it listed a total of 20 events, I was hoping to list every event that contains the word "java" +/- 10 record, rather than just a single event +/- 10 events. Thanks

Steve_A200 · ‎05-12-2023

Hi, In the logs file, we are capturing java error is multiple entries, so in order for me to see the entire error set, I need to see the events/records (10 used here as an example) that are immediately prior-to and post the keyword that is being search. Currently, when I use the below SPL, I get only the events that contain the word "java" which is good, but I want to see the 10 records (i.e. log entry lines) prior to this "java" record and 10 entries post this "java" record". The records prior-to and post may not have any keyword "java" in them, but I still want to see those records as part of the result set being displayed. | from datamodel:"xyz" | fields host source _time | where like(_raw,"%java%") | table host source _raw Is there a way to display the 10 records/events prior-to and post the keyword being searched from the _raw field? Thanks

Steve_A200 · ‎05-03-2023

Thank you, that worked exactly how I needed it to work.

Steve_A200 · ‎05-02-2023

Hi, I need assistance with writing a regex that extracts all characters upto the character "_" underscore. so, the data could look like this: field1: ABCD_1234234 EFG_12349879 HIJK_12349850 And I would like to only see: ABCD EFG HIJK I tired this however it is not doing the trick: | regex field1 = "^.*?(?=\_)" regex101 seems to show it working but ... I must be missing something when converting it into splunk. Any help would be appreciated. Thanks,

Steve_A200 · ‎11-29-2022

Hi, I am not sure if this is possible or not in Splunk classic Dashboard, but if it is, it would make the user experience much better for the Dashboard that I am trying to designing. I have 2 panels within my dashboard. Once the user enters the text in the search box, and press submit, then the results are displayed in a table format in rows. The results have several columns: _time operation_id location account_number What I would like to have, is for each row of data, a specific field the operation_id, be selectable like a check box beside the field value. Typically, I expect the user to select 3-5 row at a time. Once the user selects the rows of interest, I would like the selected row's operation_id to be used in the second pannel within the Dashboard and provide a different search and display its results. Each operation_id in the first panel is unique, so there will be 3-5 operation_id selected. I am aware you can pass a token from the first to the second panel, but I am struggling with how to create a check-box beside each result row, so that it can be selected by the user to furnish the opration_id into the second panel (rather than copy and pasting each operation_id) Any input on how to achieve such an interactive Dashboard would be appreciated.

Steve_A200 · ‎07-04-2022

Thanks for the tip on opening the results into the Panel. For some reason, the Name field is being used as the value being populated into the SPL query, which is very odd. I got the results working by entering % in the name field and any character in the value seem to work. Splunk seems to be ignoring the value field and using only the name field in the dropdown menu, which is a different from the previous entries in the same dropdown menu. I did manage to get it working for now even though. Thanks all.

Steve_A200 · ‎06-29-2022

Unfortunately it is still not providing me any results when I select All. The dropdown consist of several static values: name1 -- value1 name2 -- value2 name3 -- value3 and I want All to combine all the values, so All -- value1 and value2 and value3 Thank you

Steve_A200 · ‎06-28-2022

Hi, I am trying to get a static option that is "All" the individual static options combined. The mCode field contains different values in different events, and I would like to list all the events with specific mCode value. when I paste the query into a regular SPL search, I get the correct results, however, in a Dashboard, it tells me "no results found". The token I am using for the static options is mcode, and all the individual static options are working correctly: <query> | multisearch [ | from datamodel:"model1" ] [ | from datamodel:"model1" ] | fields "Action" "pCode" "mCode" "pCode2" | search Action="*" pCode="$pCode$" pCode2="*" | where mCode IN ("$mCode$") </query> I tried the following mCode Static option: % ... * .... even value1","value2","value3 nothing seems to work in the Dashboard. Any help would be appreciated.

Steve_A200 · ‎06-10-2022

Thanks @richgalloway . With the latest suggests SPL, I modified the min to latest, so it looks like latest(time), and it is displaying the time correctly/accurately. However, I only see ONLINE records, and there OFFLINE rows are no longer visible. What would like to see is within the specified date range selection, which calendar days are offline status (i.e. no events recorded) and which says were there event records (will be tagged as Online).

Steve_A200 · ‎06-08-2022

Thank you richgalloway. I did get a display of the time in hours, however, it was showing me the time for events in general, not specific to that location "xyz".

Steve_A200 · ‎06-03-2022

Hi, I am struggling with an SPL. I am trying to create a report which lists the Online status of specific Site/location pending if there is a message received from it. I need the Online (or Offline) status to be group in a daily format which I have achieved so far with the below SPL. However, the challenge for me is, when a Site/location goes "Offline", I would like to know the exact hour:min that Last communication was logged. Currently, the Last_Communication Column is showing me the Date but time is 00:00:00 which I know is not true, I need the exact hour/min the last event got logged for that specific day if it was "Online". Current SPL: | from datamodel:"mydatamodel" | bin _time span=1d | search field1="comm_message" | eval Online_Status=if(like(Location_field,"xyz"),1,0) | stats sum(Online_Status) AS Message_Counts by _time | eval Online_Status=if(Message_Counts=0,"OFFLINE", "ONLINE") | eval Last_Communication=if(Online_Status="ONLINE",(_time), "OFFLINE") | convert ctime(Last_Communication) Any help would be greatly appreciated. Thanks

Steve_A200 · ‎04-26-2022

Thank you for the prompt help, I found the best solution for my data logs was the suggestion below by @PickleRick : | rex field=_raw "Location\snot\sfound.ID:\s+(?<Location>ABC0\S+)) It was what I needed to extract. Thank you all for your help, appreciate this community and the Talent it has.

Steve_A200 · ‎04-25-2022

Hi, I managed to get my regex101 expression working, however, I am not able to get it working in splunk. I would like to extract only the location ID's that are listed in the _raw if they are preceded with the text "Location not found.ID: " Test string: Location not found. ID: ABC000123244343 Regex101 copied value: /[ABC0]\w+[a-zA-Z0-9]/gm However, when I tried the below in splunk it didn't provide me the results I expected: | from datamodel:"xyzlogs" | fields _raw | where like(_raw,"%Location not found.ID: ABC000%") | rex field=_raw "(?P<Location_id>/[ABC0]\w+[a-zA-Z0-9]/gm)" Any help would be appreciated. Thank you.

Steve_A200 · ‎03-15-2022

Yes, thank you. adding the lines below fixed it: | reverse | head 1 Thanks again.

Steve_A200 · ‎03-15-2022

I only care about the past hour results in the alert, but the Predicted_Percent values are generated from the past 7 day algorithm. I am only interested in comparing Percentage values during certain hours of the day. I am just not sure how to isolate the past 1 hour results for the alert to examine.

Steve_A200 · ‎03-15-2022

I have a search in which I segregated the result into 1 hour spans using: | bin _time span=1h I use predict command to compare the results from the search to the predicted values with actual data captured. I would like to have splunk check the results hourly, and alert me if the Actual_Percent < Predicted_Percent I would like to only evaluated results that are part of specific hours of the day, so I added: | eval date_hour=strftime(_time, "%H") | search date_hour>=8 date_hour<=23 | where Actual_Percent < Predicted_Percent Now, I have 3 columns of data: _time Actual_Percent Predicted_Percent 8:00 9:00 10:00 11:00 60 75 85 90 58 80 80 95 I need to get an alert based on individual time slots as the job is executed, so if the alert triggered for any value of Actual_Percent < Predicted_Percent (in this case 9:00, and 11:00), but I don't want to get new alerts subsequent to the original alert for that time slot. If I setup the alert to send email on any results greater than 0, then it will send email as soon as the first time it sees result set matching the criteria (i.e.9:00), and will continue throughout the rest of the day. However, I want only 1 alert per time slot if the condition Actual_Percent < Predicted_Percent. Is there a way to restrict the "where" statement to only look at data for that past 1 hour time slot?

Steve_A200 · ‎02-16-2022

I would like to list results from two events that are linked via common field (system_id), but searched via value only found in one event. Event1: client phone_number request_type system_id Event2: client_bank bank_request response_code system_id Both events share the same system_id, however, I only know the phone_number and need to use that to list both events. Any help would be greatly appreciated.

Posts	27
Solutions	3
Karma Given	15
Karma Received	1
Member Since	‎12-17-2021

Online Status	Offline
Date Last Visited	‎07-26-2024 02:38 PM

Need help in listing the time gaps in a multi-valu...

Using a Token to set the earliest value in a multi...

Toggle column chart data On/Off by clicking on the...

need help with regex field extraction between squa...

How can I display the 10 event entries prior to an...

What regex can extract everything up to a specific...

How to create a Dashboard with check-box like sele...

Why am I unable to create dropdown static option t...

How to display multiple _time span in single repor...

Why isn't regex101 to Splunk rex translation inser...

Re: Need help in listing the time gaps in a multi-...

Need help in listing the time gaps in a multi-valu...

Re: Using a Token to set the earliest value in a m...

Using a Token to set the earliest value in a multi...

Toggle column chart data On/Off by clicking on the...

Re: need help with regex field extraction between ...

need help with regex field extraction between squa...

Re: How can I display the 10 event entries prior t...

Re: How can I display the 10 event entries prior t...

How can I display the 10 event entries prior to an...

Re: need regex that extracts everything up to a sp...

What regex can extract everything up to a specific...

How to create a Dashboard with check-box like sele...

Re: Unable to create dropdown static option that i...

Re: Unable to create dropdown static option that i...

Why am I unable to create dropdown static option t...

Re: How to display multiple _time span in single r...

Re: How to display multiple _time span in single r...

How to display multiple _time span in single repor...

Re: regex101 to splunk rex translation insertion- ...

Why isn't regex101 to Splunk rex translation inser...

Re: "where" condition for only results of the past...

Re: "where" condition for only results of the past...

How to create an alert "where" condition for only ...

How to list results from two events that are linke...

Join the Conversation