Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About vanheer
vanheer
Explorer
Member since:
01-20-2022
02-27-2025
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 01-20-2022 |
Activity Feed
- Karma Re: Functionality of keepevicted not clear for richgalloway. 03-27-2024 05:28 AM
- Posted Search in square brackets on Splunk Search. 11-02-2023 04:15 AM
- Tagged Search in square brackets on Splunk Search. 11-02-2023 04:15 AM
- Karma Re: Fillnull command is not working in my search for specific sourcetype for woodcock. 01-05-2023 05:37 AM
- Posted Re: How to change all date fields with the correct time zone? on Getting Data In. 01-05-2023 12:37 AM
- Posted Re: Apply date offset for all date fields on Getting Data In. 01-04-2023 11:25 PM
- Posted How to change all date fields with the correct time zone? on Getting Data In. 01-03-2023 04:10 AM
- Tagged How to change all date fields with the correct time zone? on Getting Data In. 01-03-2023 04:10 AM
- Tagged How to change all date fields with the correct time zone? on Getting Data In. 01-03-2023 04:10 AM
- Tagged How to change all date fields with the correct time zone? on Getting Data In. 01-03-2023 04:10 AM
- Posted Re: How to create multiple source types from a single log file? on Getting Data In. 08-19-2022 11:29 AM
- Tagged Re: How to create multiple source types from a single log file? on Getting Data In. 08-19-2022 11:29 AM
- Tagged Re: How to create multiple source types from a single log file? on Getting Data In. 08-19-2022 11:29 AM
- Tagged Re: How to create multiple source types from a single log file? on Getting Data In. 08-19-2022 11:29 AM
- Karma Re: Using a timechart, why are all the results not being shown on the dashboard? for alacercogitatus. 06-15-2022 04:18 AM
- Karma Re: Query to display count boolean fields as seperate columns for kml_uvce. 06-08-2022 09:54 AM
- Posted Re: How to combine timechart, stats, and eval? on Dashboards & Visualizations. 04-14-2022 07:29 AM
- Karma Re: How to combine timechart, stats, and eval? for venky1544. 04-14-2022 07:29 AM
- Posted Re: How to combine timechart, stats, and eval? on Dashboards & Visualizations. 04-13-2022 09:35 AM
- Posted How to combine timechart, stats, and eval? on Dashboards & Visualizations. 04-13-2022 06:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-02-2023
04:15 AM
I don't understand how this works, what should replace the square brackets in this situation or what does the search works here? index=123 sourcetype=grades [|search index=123 sourcetype=grades line=6 AND class=4|return Name] Can anyone explain this please? I've tried to make it more simple with one search and get rid of the square brackets, but I always get different results.
... View more
- Tags:
- search
Labels
- Labels:
-
subsearch
01-05-2023
12:37 AM
Thanks @PickleRick Yes I'm doing that using the calculated fields: EVAL-DateOff
strftime(strptime(DateOff, "%F %H:%M:%S.%Q") + (strptime(strftime(strptime(DateOn, "%F %H:%M:%S.%Q"), "%c.%6N " . "UTC"), "%c.%6N %Z")-strptime(strftime(strptime(DateOn, "%F %H:%M:%S.%Q"), "%c.%6N " . "Europe/Berlin"), "%c.%6N %Z")), "%Y-%m-%d %H:%M:%S.%Q")
EVAL-DateOn
strftime(strptime(DateOn, "%F %H:%M:%S.%Q") + (strptime(strftime(strptime(DateOn, "%F %H:%M:%S.%Q"), "%c.%6N " . "UTC"), "%c.%6N %Z")-strptime(strftime(strptime(DateOn, "%F %H:%M:%S.%Q"), "%c.%6N " . "Europe/Berlin"), "%c.%6N %Z")), "%Y-%m-%d %H:%M:%S.%Q") Thanks anyway!
... View more
01-04-2023
11:25 PM
Thanks @richgalloway Actually, I'm using that right now. I thought that can be done somehow in the props configurations and changing all date-time fields directly from there.
... View more
01-03-2023
04:10 AM
I have data with multiple date fields in GMT time. when I import the data with setting the TZ=Europe/Berlin, I see that the _time in the correct time zone but for other date fields are still in GMT time.
props.conf:
[machine_log]
BREAK_ONLY_BEFORE_DATE=null
CHARSET=UTF-8
FIELD_DELIMITER = ,
FIELD_NAMES = DB_ID, DateOn, DateHist, DateOff, ExportTime, Item, Machine, Section
TIMESTAMP_FIELDS = DateOn, DateHist, DateOff, ExportTime
INDEXED_EXTRACTIONS=csv
KV_MODE=none
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
TZ=Europe/Berlin
category=Structured
disabled=false
pulldown_type=true
I'm still getting data in this way:
_time
DB_ID
DateOn
DateHist
DateOff
ExportTime
Item
Machine
Section
2023-01-03 12:42:38.787
B0123
2023-01-03 11:41:52.897
2023-01-03 11:42:38.787
2023-01-03 11:42:38.787
2023-01-03 11:42:38.787
I01
M01
S01
2023-01-03 12:41:43.847
B0223
2023-01-03 11:40:18.800
2023-01-03 11:41:43.847
2023-01-03 11:41:43.847
2023-01-03 11:41:43.847
I12
MD1
S02
index time in the correct time, but all date fields in the original timing with one hour offset.
The question is: How to change all date fields with the correct time zone?
Thanks in advance!
... View more
Labels
- Labels:
-
props.conf
-
sourcetype
-
transforms.conf
08-19-2022
11:29 AM
Hi, I have a question here, can we use different index for each sourcetype in these conf files?
... View more
04-14-2022
07:29 AM
@venky1544 Thank you very much, I haven't used xyseries before. One more optional question 😀: I've created a manual dropdown span interval, but can we keep it automated as in timechart?
... View more
04-13-2022
09:35 AM
Thanks @venky1544 , almost there! now I have each building in a field, |bin _time span=5m| stats count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(gate_id, "RG%") )) as all_items by _time,building
| eval Total=all_items-items_RG
|fields - all_items,items_RG _time building Total 2022-04-13 17:20:00 GT01 24 2022-04-13 17:20:00 GT02 13 2022-04-13 17:20:00 GT03 29 2022-04-13 17:25:00 GT01 64 2022-04-13 17:25:00 GT02 52 2022-04-13 17:25:00 GT03 94 I need each building in a separate field to stack them in the graph. _time GT01 GT02 GT03 Total 2022-04-13 17:20:00 24 13 29 =24+13+29 2022-04-13 17:25:00 64 52 94 =64+52+94
... View more
04-13-2022
06:11 AM
Hi,
I have multiple fields like, counting how many items passing through gates:
| timechart count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(gate_id, "RG%") )) as all_items by building
I want to exclude the counts of items_RG from the all_items, so I'm using :
| eval Total=all_items-items_RG
But it is not showing Total in the output, but when I use stats instead, I don't get the time column to show the graph as timechart.
| stats count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(gate_id, "RG%") )) as all_items by building
| eval Total=all_items-items_RG
I tried to use eventstats also couldn't get what I want.
... View more
03-17-2022
05:22 AM
Thanks @VatsalJagani it works fine. Actually it was a stupid question, but it was going on the opposite direction all the time and couldn't think good 🙂
... View more
03-15-2022
07:22 AM
Hi, I'm trying to query tables from postgres database. All tables there are under Foreign tables and nothing under tables. when I use db connect it get the schema name but it couldn't get the list of tables. How can I access the foreign tables using db connect?
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
01-20-2022
07:39 AM
Hi all, I'm wondering how to use the icons and styles in this page: http://127.0.0.1:8000/en-US/static/docs/style/style-guide.html For example, where to find the code for using the accordion table? I don't want to use js or css, only what in this page of Splunk . Regards,
... View more
Labels
- Labels:
-
CSS
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-27-2025
09:37 AM
|
Karma given to
