Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About NamrataRathore
NamrataRathore
Explorer
Member since:
01-31-2022
03-22-2022
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 01-31-2022 |
Activity Feed
- Posted Re: How to perform arithmetic operations on data fetched from csv file on Dashboards & Visualizations. 03-22-2022 11:38 AM
- Posted Re: How to perform arithmetic operations on data fetched from csv file on Dashboards & Visualizations. 03-22-2022 02:30 AM
- Posted Re: How to perform arithmetic operations on data fetched from csv file on Dashboards & Visualizations. 03-22-2022 01:54 AM
- Posted Re: How to perform arithmetic operations on data fetched from csv file on Dashboards & Visualizations. 03-21-2022 09:16 PM
- Posted Re: How to perform arithmetic operations on data fetched from csv file on Dashboards & Visualizations. 03-21-2022 12:04 PM
- Posted How to perform arithmetic operations on data fetched from csv file? on Dashboards & Visualizations. 03-08-2022 02:58 AM
- Karma Re: How to escape all the possible special characters in a search string for ITWhisperer. 02-02-2022 01:29 AM
- Posted Re: How to escape all the possible special characters in a search string on Dashboards & Visualizations. 02-02-2022 01:27 AM
- Posted Re: How to escape all the possible special characters in a search string on Dashboards & Visualizations. 02-01-2022 11:06 PM
- Posted How to escape all the possible special characters in a search string on Dashboards & Visualizations. 01-31-2022 09:21 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
03-22-2022
11:38 AM
Hi @PickleRick, I have checked for whitespaces in the lookup but couldn't find any. Below query runs perfectly fine for me: | from inputlookup:"IM_Prod_HostTotalBytes_Lookup" | table host | lookup "IM_Prod_HostTotalBytes_Lookup" host OUTPUT totalBytes AS TotalBytes But not when ran as subquery: index=perfmon ([| from inputlookup:"IM_Prod_HostTotalBytes_Lookup" | table host]) | lookup "IM_Prod_HostTotalBytes_Lookup" host OUTPUT totalBytes AS TotalBytes
... View more
03-22-2022
02:30 AM
I am getting counts of 1 for all the hosts.
... View more
03-22-2022
01:54 AM
Hi @PickleRick , still not getting the TotalBytes column.
... View more
03-21-2022
09:16 PM
Hi @PickleRick The below query does not work: index=perfmon ([| from inputlookup:"IM_prod_hosts_Lookup" | table host]) | lookup "IM_Prod_HostTotalBytes_Lookup" host OUTPUT totalBytes AS TotalBytes | chart max(TotalBytes) as "Total Bytes" by host However, the below one shows the total bytes: | from inputlookup:"IM_Prod_HostTotalBytes_Lookup" | table host, totalBytes What do you think am I missing in my query?
... View more
03-21-2022
12:04 PM
Hi @PickleRick My apologies for getting back to you after a while. What you suggested did not work for me. Please see the updated query below: index=perfmon ([| from inputlookup:"HostTotalBytes_Lookup" | table host]) earliest=-5m latest=now sourcetype=PerfmonMk:Memory OR (sourcetype=Perfmon:Memory counter="Available Bytes") | eval AvailableBytes=if(isnotnull(Available_Bytes),Available_Bytes,Value) | lookup "HostTotalBytes_Lookup" host OUTPUT totalBytes AS TotalBytes | eval MemoryUsedPct = round((TotalBytes - AvailableBytes) / TotalBytes * 100, 2) | chart max(Available_Bytes) as "Available Bytes", max(totalBytes) as "Total Bytes", max(MemoryUsedPct) as "Used Memory" by host This eliminated the error that I was getting earlier but it didn't return the desired result.
... View more
03-08-2022
02:58 AM
I have an index which has information for available bytes on each host. I want to display free bytes in a table for all the hosts. I have a csv file which has the hostname and the total bytes for each server.
I am trying something like below:
index="perfmon" ([| from inputlookup:"HostTotalBytes_Lookup" | table host]) earliest=-5m latest=now
| eval TotalBytes=[| from inputlookup:"HostTotalBytes_Lookup" | table totalBytes]
| eval MemoryUsedPct = round((TotalBytes - Available_Bytes) / TotalBytes * 100, 2)
| chart max(MemoryUsedPct) as "Used Memory", max(Available_Bytes) as "Available Bytes" by host
But it returns an error: Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).
I understand that I am trying to store an entire table in one variable and trying to use it as separate bytes against each host. I am quite new to Splunk and don't really know what to use in this case. Any help would be highly appreciated.
My csv file looks like the following:
host,name,totalBytes host1,host1_name,16000000000 host2,host2_name,16000000000 host3,host3_name,16000000000 host4,host4_name,16000000000
... View more
02-02-2022
01:27 AM
This worked like a charm. Thank you so much! And could you please let me know how the format worked here? I am new to Splunk so just wanted to know.
... View more
02-01-2022
11:06 PM
Hi ITWhisperer, Thank you for replying. Above solution doesn't work for me. I am getting the same error as before: "Unable to parse the search: Comparator '<' has an invalid term on the left side." My query also has split and substr as the error string is way too long and results in error. The whole query is: index=index_name sourcetype="sourcetype_name" [ | makeresults | eval cleansearch=replace(replace(substr(mvindex(split("$search$", ":00 - "),1), 0, 100) "<", "\<"), ">", "\>")."*" | return $cleansearch] which works but it only work for <,> operators. I tried |s as you suggested but it doesn't work: index=index_name sourcetype="sourcetype_name" [ | makeresults | eval cleansearch=substr(mvindex(split("$search|s$", ":00 - "),1), 0, 100)."*" | return $cleansearch] The error string looks like this: <r>2022-02-02 04:33:34 +11:00 - Serious: Very_long_error_string
... View more
01-31-2022
09:21 PM
I have a dashboard which has two panels; one of them shows the errors and the count of how many times similar error has occurred. Another panel shows the details of the error when clicked on an error. This error string sometimes has characters like <,>,\, etc. and splunk does not read them as string but characters, which results in error on the panel. I would like to use something which would escape all the possible characters in one go. Currently, my query looks like this: index=index_name sourcetype="sourcetype_name" [ | makeresults | eval cleansearch=replace(replace("$search$", "<", "\<"), ">", "\>") | return $cleansearch] Is there anything more simpler that I could use that would escape all the possible characters that could cause an issue instead of replacing each character individually?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-22-2022
03:02 PM
|
