Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Veeru
Veeru
Path Finder
Member since:
12-20-2021
04-24-2023
Community Statistics
| Posts | 42 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 12-20-2021 |
Activity Feed
- Posted How to expand the row in a table without expanding the respected rows on Splunk Search. 04-24-2023 05:08 AM
- Tagged How to expand the row in a table without expanding the respected rows on Splunk Search. 04-24-2023 05:08 AM
- Posted Re: How to throttle Splunk alert configuration? on Alerting. 04-17-2023 02:31 AM
- Posted How to throttle Splunk alert configuration? on Alerting. 04-14-2023 03:42 AM
- Tagged How to throttle Splunk alert configuration? on Alerting. 04-14-2023 03:42 AM
- Posted How to pass the time from one query to another query? on Splunk Search. 03-23-2023 09:57 PM
- Tagged How to pass the time from one query to another query? on Splunk Search. 03-23-2023 09:57 PM
- Posted Re: If atleast one processor is up i need to consider device is online on Splunk Search. 12-09-2022 12:22 AM
- Posted Re: If atleast one processor is up i need to consider device is online on Splunk Search. 12-08-2022 11:56 PM
- Tagged Re: If atleast one processor is up i need to consider device is online on Splunk Search. 12-08-2022 11:56 PM
- Posted If atleast one processor is up i need to consider device is online on Splunk Search. 12-08-2022 08:23 PM
- Tagged If atleast one processor is up i need to consider device is online on Splunk Search. 12-08-2022 08:23 PM
- Posted Re: Trigger alert not seen as email notification on Reporting. 10-13-2022 01:35 AM
- Karma Re: Trigger alert not seen as email notification for isoutamo. 10-13-2022 01:34 AM
- Posted Trigger alert not seen as email notification for some events? on Reporting. 10-13-2022 01:20 AM
- Tagged Trigger alert not seen as email notification for some events? on Reporting. 10-13-2022 01:20 AM
- Posted Re: Optimize the query that hits disk usage when computing with stats and percentage on Splunk Search. 08-23-2022 12:29 AM
- Posted Re: Optimize the query that hits disk usage when computing with stats and percentage on Splunk Search. 08-22-2022 11:30 PM
- Posted Re: Optimize the query that hits disk usage when computing with stats and percentage on Splunk Search. 08-22-2022 11:05 PM
- Tagged Re: Optimize the query that hits disk usage when computing with stats and percentage on Splunk Search. 08-22-2022 11:05 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-24-2023
05:08 AM
Hello, I have table below I want to expand the ERRORS row without expanding names column names errors B 3 4 5 C 1 3 D 3 4 5 E 1 5 I want the o/p to be in this form names errors B 3 4 5 c 1 Thank You! Happy Splunking!
... View more
- Tags:
- mv
04-14-2023
03:42 AM
Hello I need some assistance please with the alert throttle functionality in splunk
Even though we have the alert throttle enabled & suppressed for 60mins the alert still seems to generate a trigger every 10mins @ 00:10, 00:20, 00:30, 00:40, and 00:50
I only want the 00:10 event to trigger & then suppress the 00:20, 00:30, 00:40 & 00:50 events.
Thank you in advance Veeru
... View more
- Tags:
- throttle
Labels
- Labels:
-
alert action
-
throttling
03-23-2023
09:57 PM
Actually I want to pass the time from first query to second and get results out on basis of first query time. First query index="A" sourcetype="B" | rex "\d+\-\S+.(?<JobName>\w+)\," | transaction JobName startswith= start endswith=end | table _time _raw Second Query index="C" sourcetype="cpu" host="A.local" | eval firsttime=strftime(_time, "%d/%m/%Y %H:%M:%S"), secondtime=strftime(_time, "%d/%m/%Y %H:%M:%S") | where (firsttime >= "26/02/2023 03:03:03") AND (secondtime <= "26/02/2023 04:03:03") | eval Total=(pctSystem+pctUser) | table "firsttime" "host" "secondtime" "Total" I wanna combine and get the results from first query start and end
... View more
- Tags:
- eval
Labels
- Labels:
-
eval
-
stats
-
transaction
12-09-2022
12:22 AM
@yuanliu Thanks for the reply Let me try and update you. Happy splunking!
... View more
12-08-2022
11:56 PM
@yuanliu Thanks for reply sorry my bad It's actually output.Considering the down output have Device 01 and 02 with Processors and Status For device atleast one processor status is in running state should consider as online otherwise offline. in device 01 we have 3 processors out of 2 are in status running.as per condition if one is in running state we need take 01 as online. Need query for this Device Processor status 01 splunkd running 01 sql stopped 01 python running 02 splunkd stopped
... View more
- Tags:
- @
12-08-2022
08:23 PM
Hello Greetings! i have data in the following way Device Processor status 01 Splunkd Running 01 Sql Stopped 01 Python Stopped 02 Spluknd. Stopped In the above output for a device if state is running of atleast on processor need to consider it as online otherwise offline can you please help me with query. Thank you in advance Happy splunking!
... View more
- Tags:
- eval
10-13-2022
01:20 AM
on 11th October we had 5 events, but we received only 2 email notification.
Below the 5 events of the alert for Yesterday (11th Oct)
1 2022-10-11 23:30:04 BST View Results
2 2022-10-11 23:00:05 BST View Results
3 2022-10-11 22:30:04 BST View Results
4 2022-10-11 22:00:02 BST View Results
5 2022-10-11 14:00:02 BST View Results
But we received email notification only for 1st and 5th event. No email notification for 2nd 3rd and 4th. Could please help us for this discrepancy since we had Client impact and caused so many transactions failures and for issues event was generated but email was not trigged. Can help me how to resolve this issue Thank you, Veeru
... View more
- Tags:
- alert
Labels
- Labels:
-
other
08-23-2022
12:29 AM
@bowesmana For | stats values(point) as point values(promotion) as promotionAction BY global _time i'm getting 6,446,807 results by scanning 6,773,378 events in 78.521 seconds for 4 rows globalOpId _time pointBankCode promotionAction 0000016 2022-08-22 19:00:00 000003b 2022-08-22 14:00:00 00000bb4 2022-08-22 07:00:00 ACCEPTED 00000c41 2022-08-22 05:30:00 00001136 2022-08-22 21:00:00 000015e7 2022-08-22 14:30:00
... View more
08-22-2022
11:30 PM
@bowesmana when i run for last 7 days This search has completed and has returned 337 results by scanning 49,396,521 events in 539.528 seconds. i want to optimize it to less sec stats taking more time can you please help me to take alternative for this.
... View more
08-22-2022
11:05 PM
So my time range is more than 15 days.but issue is for last 24 hours i'm having more than 4 lakh events. i want to optimize search to run dashboard panel fast.
... View more
- Tags:
- me
08-22-2022
09:38 PM
index=A host="bd*" OR host="p*" source="/apps/logs/*"
| bin _time span="30m"
| stats values(point) as point values(promotion) as promotionAction BY global _time
| stats count(eval(promotion="OFFERED")) AS Offers count(eval(promotion="ACCEPTED")) AS Redeemed by _time point=
| eval Take_Rate_Percent=((Redeemed)/(Offers)*100)
| eval Take_Rate_Percent=round(Take_Rate_Percent,2)
this search is running for 15 min but when i search for more than 15 min it is giving search suspened due to huge data. Please help me to optimize the query. Thank you in advance veeru
... View more
08-18-2022
12:05 AM
Hello @gcusello Thank you for reply, Can you please help me how to disable mails and tickets while i set to maintenance mode.
... View more
08-11-2022
04:57 AM
Hello Splunk team, I am trying for a logic to disable the alerts in the particular app while I disable maintenance mode in master app Is this possible in Splunk? Please help me out with this?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-24-2023
09:25 AM
|
Karma given to
