Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ranjithan
ranjithan
Path Finder
Member since:
02-10-2022
02-23-2023
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 11 |
| Karma Received | 0 |
| Member Since | 02-10-2022 |
Activity Feed
- Posted Re: Split by delimiter on Splunk Search. 02-23-2023 09:19 AM
- Karma Re: Split by delimiter for ITWhisperer. 02-23-2023 09:19 AM
- Posted How to split by delimiter? on Splunk Search. 02-23-2023 08:37 AM
- Tagged How to split by delimiter? on Splunk Search. 02-23-2023 08:37 AM
- Posted Re: Timezone on Splunk Search. 10-24-2022 02:56 AM
- Tagged Re: Timezone on Splunk Search. 10-24-2022 02:56 AM
- Karma Re: Timezone for gcusello. 10-24-2022 02:55 AM
- Posted Re: Timezone on Splunk Search. 10-23-2022 08:41 AM
- Posted Timezone- Could you please help me convert all the values to a standard timezone(UTC)? on Splunk Search. 10-23-2022 07:27 AM
- Karma Re: regular expressions - field extractions for richgalloway. 07-25-2022 06:31 AM
- Posted Re: regular expressions - field extractions on Splunk Cloud Platform. 07-25-2022 06:30 AM
- Posted How to extract regular expressions? on Splunk Cloud Platform. 07-25-2022 04:28 AM
- Tagged How to extract regular expressions? on Splunk Cloud Platform. 07-25-2022 04:28 AM
- Karma Re: field extraction for gcusello. 03-20-2022 03:07 AM
- Karma Re: If else condition for dashboard using stats for ITWhisperer. 03-20-2022 03:07 AM
- Karma Re: If else condition for dashboard using stats for ITWhisperer. 03-20-2022 03:07 AM
- Karma Re: If else condition for dashboard using stats for ITWhisperer. 03-20-2022 03:07 AM
- Karma Re: If else condition for dashboard using stats for ITWhisperer. 03-20-2022 03:06 AM
- Posted Re: If else condition for dashboard using stats on Dashboards & Visualizations. 03-20-2022 03:03 AM
- Posted Re: If else condition for dashboard using stats on Dashboards & Visualizations. 03-20-2022 12:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-23-2023
08:37 AM
Hi Splunkers,
Reaching out for help
This is a sample _raw event:
12.23.454, abcd, 12.34.45,abc@gmail.com,"[EXTERNAL] 300,000+ software product demos",SEND,OK
i want to split this by using the split command , using comma as a delimiter and assign to different fields.
However, "EXTERNAL] 300,000+ software product demos" is a single field and i dont want it to be split into multiple fields
In few other events, comma is not present . For instance:
12.23.454, abcd, 12.34.45,abc@gmail.com, "[EXTERNAL] 300000+ software product demos" ,SEND,OK
How do i ensure that these values are assigned to the field in the events.
"EXTERNAL] 300,000+ software product demos"
"[EXTERNAL] 300000+ software product demos"
Thanks for your help
... View more
- Tags:
- fields
Labels
- Labels:
-
field extraction
-
fields
10-23-2022
08:41 AM
Thank you so much . Also I just realised that using %Z with strptime automatically converts to epoch time from any time zone and this also can standardise the time for time calculations.
... View more
10-23-2022
07:27 AM
Hi Community,
Please help me..
I have a field Expiration with values having different timezones . Could you please help me convert all the values to a standard timezone(UTC). Any help would be appreciated. Thanks in advance
Expiration
18:02:56 EDT Oct 5 2022
12:02:56 CDT Oct 5 2022
13:02:56 EDT Oct 5 2022
18:02:56 CDT Oct 5 2022
18:59:59 EST Nov 15 2022
19:59:59 EDT Oct 5 2022
17:02:56 UTC Oct 5 2022
18:59:59 CDT Oct 5 2022
... View more
Labels
- Labels:
-
eval
-
field extraction
07-25-2022
06:30 AM
Thank You so much for the help!
... View more
07-25-2022
04:28 AM
Hi ,
Need some help to extract regular expressions.
I have a set of unstructured logs . Part of the log is as shown below:
"RequestUTCDateTime":"2022-07-25T11:19:29.0106873Z"}
How would one extract 2022-07-25T11:19:29.0106873Z and assign it to field RequestUTCDateTime, .
This should be done whenever "RequestUTCDateTime" is encountered in the raw log.
Please help me.
Thank You,
Ranjitha N
... View more
Labels
- Labels:
-
development
03-20-2022
03:03 AM
Thank You for the detailed inputs. Let my give this a try and update you.
... View more
03-20-2022
12:58 AM
@ITWhisperer wrote: Can you share the events in code blocks </> as it makes them a lot easier to deal with than screenshots? ----------------------- DISK INFORMATION ---------------------------- DISK="/dev/sda" NAME="sda" HCTL="0:2:0:0" TYPE="disk" VENDOR="LSI " SIZE="222.6G" SCSIHOST="0" CHANNEL="2" ID="0" LUN="0" BOOTDISK="TRUE" DISK="/dev/sdm" NAME="sdm" HCTL="1:0:0:1" TYPE="disk" VENDOR="PURE " SIZE="100G" SCSIHOST="1" CHANNEL="0" ID="0" LUN="1" BOOTDISK="FALSE" DISK="/dev/sdp" NAME="sdp" HCTL="1:0:0:2" TYPE="disk" VENDOR="PURE " SIZE="300G" SCSIHOST="1" CHANNEL="0" ID="0" LUN="2" BOOTDISK="FALSE" DISK="/dev/sds" NAME="sds" HCTL="1:0:0:3" TYPE="disk" VENDOR="PURE " SIZE="2T" SCSIHOST="1" CHANNEL="0" ID="0" LUN="3" BOOTDISK="FALSE" DISK="/dev/sdx" NAME="sdx" HCTL="1:0:0:4" TYPE="disk" VENDOR="PURE " SIZE="1T" SCSIHOST="1" CHANNEL="0" ID="0" LUN="4" BOOTDISK="FALSE" DISK="/dev/sdaa" NAME="sdaa" HCTL="1:0:0:5" TYPE="disk" VENDOR="PURE " SIZE="500G" SCSIHOST="1" CHANNEL="0" ID="0" LUN="5" BOOTDISK="FALSE" DISK="/dev/sdae" NAME="sdae" HCTL="1:0:1:1" TYPE="disk" VENDOR="PURE " SIZE="100G" SCSIHOST="1" CHANNEL="0" ID="1" LUN="1" BOOTDISK="FALSE" DISK="/dev/sdah" NAME="sdah" HCTL="1:0:1:2" TYPE="disk" VENDOR="PURE " SIZE="300G" SCSIHOST="1" CHANNEL="0" ID="1" LUN="2" BOOTDISK="FALSE" DISK="/dev/sdaj" NAME="sdaj" HCTL="1:0:1:3" TYPE="disk" VENDOR="PURE " SIZE="2T" SCSIHOST="1" CHANNEL="0" ID="1" LUN="3" BOOTDISK="FALSE" DISK="/dev/sdal" NAME="sdal" HCTL="1:0:1:4" TYPE="disk" VENDOR="PURE " SIZE="1T" SCSIHOST="1" CHANNEL="0" ID="1" LUN="4" BOOTDISK="FALSE" DISK="/dev/sdan" NAME="sdan" HCTL="1:0:1:5" TYPE="disk" VENDOR="PURE " SIZE="500G" SCSIHOST="1" CHANNEL="0" ID="1" LUN="5" BOOTDISK="FALSE" DISK="/dev/sdl" NAME="sdl" HCTL="2:0:0:1" TYPE="disk" VENDOR="PURE " SIZE="100G" SCSIHOST="2" CHANNEL="0" ID="0" LUN="1" BOOTDISK="FALSE" DISK="/dev/sdo" NAME="sdo" HCTL="2:0:0:2" TYPE="disk" VENDOR="PURE " SIZE="300G" SCSIHOST="2" CHANNEL="0" ID="0" LUN="2" BOOTDISK="FALSE" DISK="/dev/sdt" NAME="sdt" HCTL="2:0:0:3" TYPE="disk" VENDOR="PURE " SIZE="2T" SCSIHOST="2" CHANNEL="0" ID="0" LUN="3" BOOTDISK="FALSE" DISK="/dev/sdw" NAME="sdw" HCTL="2:0:0:4" TYPE="disk" VENDOR="PURE " SIZE="1T" SCSIHOST="2" CHANNEL="0" ID="0" LUN="4" BOOTDISK="FALSE" DISK="/dev/sdz" NAME="sdz" HCTL="2:0:0:5" TYPE="disk" VENDOR="PURE " SIZE="500G" SCSIHOST="2" CHANNEL="0" ID="0" LUN="5" BOOTDISK="FALSE" DISK="/dev/sdad" NAME="sdad" HCTL="2:0:1:1" TYPE="disk" VENDOR="PURE " SIZE="100G" SCSIHOST="2" CHANNEL="0" ID="1" LUN="1" BOOTDISK="FALSE" second log: ------------------------- MULTIPATH STATUS ----------------------------- name uuid sysfs size dm-st paths failures action path_faults vend prod rev mpatha 3624a9370b405ec36b383443d000113e6 dm-1 100G active 8 0 create 0 PURE FlashArray 8888 mpathb 3624a9370b405ec36b383443d000113e7 dm-2 300G active 8 0 create 0 PURE FlashArray 8888 mpathc 3624a9370b405ec36b383443d000113e8 dm-3 2.0T active 8 0 create 0 PURE FlashArray 8888 mpathd 3624a9370b405ec36b383443d000113e9 dm-4 1.0T active 8 0 create 0 PURE FlashArray 8888 mpathe 3624a9370b405ec36b383443d000113ea dm-5 500G active 8 0 create 0 PURE FlashArray 8888
... View more
03-19-2022
11:42 PM
Yes, and it also maps to the "Vendor" and "Disk Name" fields in the other query. Please help me.
... View more
03-19-2022
10:36 AM
Please find the screenshots of sample events: For query 2: ------------------------- MULTIPATH STATUS ----------------------------- name uuid sysfs size dm-st paths failures action path_faults vend prod rev mpatha 3624a9370b405ec36b383443d000113e6 dm-1 100G active 8 0 create 0 PURE FlashArray 8888 mpathb 3624a9370b405ec36b383443d000113e7 dm-2 300G active 8 0 create 0 PURE FlashArray 8888 mpathc 3624a9370b405ec36b383443d000113e8 dm-3 2.0T active 8 0 create 0 PURE FlashArray 8888 mpathd 3624a9370b405ec36b383443d000113e9 dm-4 1.0T active 8 0 create 0 PURE FlashArray 8888 mpathe 3624a9370b405ec36b383443d000113ea dm-5 500G active 8 0 create 0 PURE FlashArray 8888 I need to map the appropriate UUID's to the appropriate LUN ID's. For instance UUID values should be mapped to LUN ID's ranging 1-5 . Thank You, Ranjitha N
... View more
- Tags:
- dashboard
03-19-2022
05:04 AM
Hi Team,
Below is my query:
index=os sourcetype=linux_mpio Firmware_Version="----------------------- DISK INFORMATION --------------------------*" host IN (r3ddclxp00003*) | dedup host
| rex max_match=0 "(?ms)^DISK\=\"(?<DISK>[^\"]+)\"\s+NAME\=\"(?<NAME>[^\"]+)\"\s+HCTL\=\"(?<HCTL>[^\"]+)\"\s+TYPE\=\"(?<TYPE>[^\"]+)\"\s+VENDOR\=\"(?<VENDOR>[^\"]+)\"\s+SIZE\=\"(?<SIZE>[^\"]+)\"\s+SCSIHOST\=\"(?<SCSIHOST>[^\"]+)\"\s+CHANNEL\=\"(?<CHANNEL>[^\"]+)\"\s+ID\=\"(?<ID>[^\"]+)\"\s+LUN\=\"(?<LUN>[^\"]+)\"\s+BOOTDISK\=\"(?<BOOTDISK>[^\"]+)\""
| stats values(_time) AS TIME, values(NAME) as "DISK NAME" , list(SIZE) AS SIZE, list(VENDOR) AS VENDOR, list(LUN) AS LUN, list(BOOTDISK) as BOOTDISK by host | appendcols [search index=os sourcetype=linux_mpio host IN (r3ddclxp00003*) Firmware_Version="------------------------- MULTIPATH STATUS ----------------------------*" | dedup host |rex max_match=0 "^(?<lines>.+)\n+" | eval first_line=mvindex(lines,2,15) | rex field=first_line "^(?<name>\w+)\s+(?<uuid>[^ ]+)" | stats list(name) AS "MPATH" , LIST(uuid) AS UUID BY host ] | table host, "DISK NAME" ,VENDOR SIZE, LUN, UUID , MPATH| rename host as Host, SIZE AS Size, "DISK NAME" AS "Disk Name", VENDOR AS Vendor, LUN AS "LUN ID"
and below is my output:
Would it be possible to add a line break for UUID and MPATH?
For example: can we use an if else condition where in IF VENDOR(1) =LSI then add a line break for UUID so that the appropriate values will be mapped...
Thanks for the help,
Ranjitha N
... View more
Labels
- Labels:
-
Dashboard Studio
02-24-2022
03:17 AM
name uuid sysfs size dm-st paths failures action path_faults vend prod rev mpatha 360002ac000000000000010e30001c751 dm-1 120G active 4 0 0 3PARdata VV 3315 mpathb 360002ac000000000000010fb0001c751 dm-0 240G active 4 0 0 3PARdata VV 3315 The above is my multiline event in table format... I need to extract the below values(mpath, uuid): mpatha 360002ac000000000000010e30001c751 mpathb 360002ac000000000000010fb0001c751 Please help me. im new to this.. thank you so much..
... View more
Labels
- Labels:
-
field extraction
02-23-2022
04:02 AM
----------------------- DISK INFORMATION ----------------------------
DISK="/dev/sda" NAME="sda" HCTL="0:0:0:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="0" CHANNEL="0" ID="0" LUN="0" BOOTDISK="TRUE"
DISK="/dev/sdb" NAME="sdb" HCTL="0:0:0:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="0" CHANNEL="0" ID="0" LUN="1" BOOTDISK="FALSE"
DISK="/dev/sdc" NAME="sdc" HCTL="0:0:1:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="0" CHANNEL="0" ID="1" LUN="0" BOOTDISK="TRUE"
DISK="/dev/sdd" NAME="sdd" HCTL="0:0:1:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="0" CHANNEL="0" ID="1" LUN="1" BOOTDISK="FALSE"
DISK="/dev/sde" NAME="sde" HCTL="7:0:0:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="7" CHANNEL="0" ID="0" LUN="0" BOOTDISK="TRUE"
DISK="/dev/sdf" NAME="sdf" HCTL="7:0:0:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="7" CHANNEL="0" ID="0" LUN="1" BOOTDISK="FALSE"
DISK="/dev/sdg" NAME="sdg" HCTL="7:0:1:0" TYPE="disk" VENDOR="3PARdata" SIZE="120G" SCSIHOST="7" CHANNEL="0" ID="1" LUN="0" BOOTDISK="TRUE"
DISK="/dev/sdh" NAME="sdh" HCTL="7:0:1:1" TYPE="disk" VENDOR="3PARdata" SIZE="300G" SCSIHOST="7" CHANNEL="0" ID="1" LUN="1" BOOTDISK="FALSE"
My multiline event log looks like this in Splunk. Could someone please help me extract all the fields like DISK, NAME, HCTL TYPE, VENDOR, SIZE using SPL...
... View more
Labels
- Labels:
-
field extraction
-
regex
02-22-2022
07:20 AM
Kindly suggest if it could be done via SPL or regex extractions..
... View more
02-22-2022
07:05 AM
----------------------- DISK INFORMATION ----------------------------
DISK="/dev/sda" NAME="sda" HCTL="0:0:0:0" TYPE="disk" VENDOR="VMware " SIZE="210G" SCSIHOST="0" CHANNEL="0" ID="0" LUN="0" BOOTDISK="TRUE"
DISK="/dev/sdb" NAME="sdb" HCTL="0:0:1:0" TYPE="disk" VENDOR="VMware " SIZE="100G" SCSIHOST="0" CHANNEL="0" ID="1" LUN="0" BOOTDISK="FALSE"
My log (multiline event) looks like this but Splunk is automatically extracting just the first line . I want to extract all the values.
for example:
NAME=sda
NAME=sdb
Could someone please help me with it
... View more
- Tags:
- rex
02-11-2022
01:53 AM
My Query is
index=windows Type=Disk host IN (abc) FileSystem="*" DriveType="*" Name="*"
| dedup host, Name
| table _time, host, Name
| sort host, Name
| join type=left host [| search index=perfmon source="Perfmon:CPU" object=Processor collection=CPU counter="% Processor Time" instance=_Total
host IN (abc)
| convert num(Value) as value num(pctCPU) as value
| stats avg(value) as "CPUTrend" max(value) as cpu_utz by host
| eval "Max Peak CPU" = round(cpu_utz, 2)
| eval "CPUTrend"=round(CPUTrend, 2)
| fields - cpu_utz
| sort -"Peak CPU"
| rename "Max Peak CPU" AS "maxCPUutil"
| dedup "maxCPUutil"
| table _time, host, "maxCPUutil"]
| table host, "maxCPUutil", Name
I have this below output
host maxCPUutil Name
host maxCPUutil Name
abc 5.59 c:
abc 5.59 E:
abc 5.59 F:
What i want is
my result has multiple hosts.. Not single host. Output should be
1. abc 35.16 C:
2. 😧
3. E:
4. def 45.56 C:
5. I:
6. J
Please help me remove the repeated values for drive letter. I need it only once for single host
... View more
02-10-2022
05:51 AM
In the query _time is already formatted. But when i try to export the data in csv its showing different formats.
Query:index="wineventlog" host IN (USMDCKPAP30074) EventCode=6006 OR EventCode="6005" Type=Information | eval BootUptime = if(EventCode=6005,strftime(_time, "%Y-%d-%m %H:%M:%S"),null()) | table host BootUptime Eg:
2022-31-01 10:00:42
2022-29-01 06:40:11
2022-27-01 12:55:56
After exporting :
8/1/2022 4:08
1/1/2022 4:03
2021-25-12 04:03:29
2021-18-12 04:02:54
2021-16-12 10:14:45
2021-16-12 10:08:21
11/12/2021 4:08
4/12/2021 4:11
Please help me resolve this
... View more
Labels
- Labels:
-
timechart
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-23-2023
02:50 PM
|
