Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About peterfox1992
peterfox1992
Explorer
Member since:
03-22-2022
03-25-2022
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 03-22-2022 |
Activity Feed
- Posted Re: How to exclude weekends from last 30 days search ? on Splunk Search. 03-24-2022 08:16 AM
- Posted Re: How to exclude weekends from last 30 days search ? on Splunk Search. 03-24-2022 06:51 AM
- Posted Re: How to have exclude weekend in the splunk dashboard as a input button? on Splunk Search. 03-24-2022 02:05 AM
- Posted Re: How to replace subsearch to achieve the same result? on Splunk Search. 03-23-2022 10:18 AM
- Karma Re: How to replace subsearch to achieve the same result? for ITWhisperer. 03-23-2022 10:18 AM
- Karma Re: How to replace subsearch to achieve the same result? for ITWhisperer. 03-23-2022 10:18 AM
- Posted How to have exclude weekend in the splunk dashboard as a input button? on Splunk Search. 03-23-2022 10:13 AM
- Posted Re: How to replace subsearch to achieve the same result? on Splunk Search. 03-23-2022 09:56 AM
- Posted Re: How to replace subsearch to achieve the same result? on Splunk Search. 03-23-2022 08:27 AM
- Posted Re: How to replace subsearch to achieve the same result? on Splunk Search. 03-23-2022 08:07 AM
- Posted How to replace subsearch to achieve the same result? on Splunk Search. 03-23-2022 06:30 AM
- Posted Re: How to extract time from the below message? on Splunk Search. 03-23-2022 04:56 AM
- Karma Re: How to extract time from the below message? for gcusello. 03-23-2022 04:55 AM
- Posted Re: How to extract time from the below message? on Splunk Search. 03-23-2022 04:06 AM
- Posted Re: How to extract time from the below message? on Splunk Search. 03-23-2022 04:00 AM
- Posted How to extract time from the below message? on Splunk Search. 03-23-2022 03:38 AM
- Posted Re: Splunk timechart not displaying data when last 30 days range is selected on Splunk Search. 03-23-2022 12:29 AM
- Posted Re: Splunk timechart not displaying data when last 30 days range is selected on Splunk Search. 03-23-2022 12:27 AM
- Posted Why is Splunk timechart not displaying data when last 30 days range is selected? on Splunk Search. 03-22-2022 10:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-24-2022
08:16 AM
@solarboyz1, Thanks for the reply. Created input option like this. Working as expected but what I noticed is Tick mark is not changing when I select the other option; showing both buttons as Checked. Any suggestions ? <input type="checkbox" token="weekends" id="weekends"> <label>Weekend Option</label> <choice value="| where NOT (date_wday="saturday" OR date_wday="sunday")">Exclude Weekend</choice> <choice value="">Include Weekend</choice> <delimiter> </delimiter> </input>
... View more
03-24-2022
06:51 AM
Hi @solarboyz1 , How can I have this as a customized input button ?
... View more
03-24-2022
02:05 AM
Thanks for the reply @ITWhisperer . I have added this in my source code but what I noticed is all panels are waiting for the user input. Once I click on Weekend Only check box, the data got populated only for MON-FRI. Actually what I was looking for is, When I open the dashboard, it should not be waiting for user input and each panels should be populated along with Weekend data as well and on the top I should have a Check box as 'Exclude Weekend'. Once I click this checkbox, all the panels should reload without weekend data. This is my current input source which I'm using. <fieldset autoRun="true" submitButton="false"> <input type="time" token="field2"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="group" searchWhenChanged="true"> <label>Group By</label> <choice value="1mon">Month</choice> <choice value="1w">Week</choice> <choice value="1d">Day</choice> <choice value="1h">Hour</choice> <default>1d</default> </input> </fieldset> Kindly need suggestion. Thanks.
... View more
03-23-2022
10:18 AM
Thanks a lot @ITWhisperer It worked 🙂 Much Appreciate for you patience and guidance. Cheers!
... View more
03-23-2022
10:13 AM
Hi Folks, I have been working on a dashboard that displays result as a timechart grouping by days. I see results are displayed for the dates I have chosen. My requirement here is to not to have weekend data on the dashboard. which I have achieved that by adding the below in the search query. | eval date_wday=lower(strftime(_time,"%A")) |where NOT (date_wday="saturday" OR date_wday="sunday") | fields - date_wday But my question here is how I can achieve this dynamically? Instead of adding this in the query, I should have input button in dashboard which should be used to select 'weekend data needed' or 'not needed' and accordingly result should be populated in Dashboard. Can someone advise on this? Much appreciate for the suggestions provided. Thanks.
... View more
Labels
- Labels:
-
timechart
03-23-2022
09:56 AM
This is the exact eval command which I'm using. eval filterer=if(match(method_name,"pqr") AND match(message,"*Response Time for pqr*"),1,null())
... View more
03-23-2022
08:27 AM
Thanks @ITWhisperer , I tried but once again an error in eval. Error in 'eval' command: Regex: quantifier does not follow a repeatable item
... View more
03-23-2022
08:07 AM
Thanks @ITWhisperer for the reply. I noticed few issues while running the query. i) Open bracket before sourcetype="xyz" May I know where should I need to close the bracket. (sourcetype="xyz" Also getting below error in the eval command. Error in 'eval' command: The arguments to the 'searchmatch' function are invalid. Thanks once again.
... View more
03-23-2022
06:30 AM
Hi Folks, I'm using a query like below. But since subsearch returns more than 10K events, I'm not getting the expected result. Can someone advise me if there is an alternate way to replace subsearch and to achieve the expected result? index="foo" sourcetype="xyz" user!="abc" method=POST (url="*search*aspx*" AND code!=302 AND code!=304 AND code!=401 AND code!=403 AND code!=0) [search index="foo" method_name=pqr message="*Response Time for method pqr*" | fields uniqid] | eval hour=strftime(_time,"%H") | where hour >=7 AND hour <=19 | timechart span=1d count(eval(time_took)) as Total , count(eval(time_took<2000)) as Success, count(eval(time_took>2000)) as misses | sort by "_time" desc Thanks in advance for the help.
... View more
03-23-2022
04:56 AM
Thanks @gcusello . It worked 🙂 Cheers!
... View more
03-23-2022
04:06 AM
Thanks @gcusello . I have got the required result by using the rex command mentioned. Now is there any possible to convert the time in millisecond? If the output is "00:00:01.250" then i should get as 1250ms.
... View more
03-23-2022
04:00 AM
Thanks @gcusello . I have got the required result by using the rex command mentioned. Now is there any possible to convert the time in millisecond? If the output is "00:00:01.250" then i should get as 1250ms.
... View more
03-23-2022
03:38 AM
Hi Folks, Can someone help me on the below. I have the below message in the log and need to extract the time portion alone. [END~~Method.Search_Button] Response Time Search_Button: 00:00:00.3004626 The output I need is, 00:00:00.3004626 Also if possible, can suggest how I can get the value as millisecond? For the above message, I should get 300ms. If the output is "00:00:01.250" then i should get as 1250ms. Thanks.
... View more
Labels
- Labels:
-
rex
03-23-2022
12:29 AM
Hi, Yes. Job inspector shows the below message. The following messages were returned by the search subsystem: info : [subsearch]: Subsearch produced 10000 results, truncating to maxout [subsearch_maxout] 10000.
... View more
03-23-2022
12:27 AM
Hi, I tried to ran for a week but result populated for only 5 days and last 2 days populated as 0. This is the query which I'm using. Please let me know if I'm missing something. index="foo" sourcetype="xyz" user!="abc" method=POST (url="*search*aspx*" AND code!=302 AND code!=304 AND code!=401 AND code!=403 AND code!=0) [search index="foo" method_name=pqr message="*Response Time for method pqr*" | fields uniqid] | eval hour=strftime(_time,"%H") | where hour >=7 AND hour <=19 | timechart span=1d count(eval(time_took)) as Total , count(eval(time_took<2000)) as Success, count(eval(time_took>2000)) as misses | sort by "_time" desc
... View more
03-22-2022
10:31 AM
Hi Folks,
I'm new to Spunk and I was working on creating a dashboard for one of my Application.
Dashboard is built but when I want to populate the data for last 30 days, its giving result for only few day ( 7 to 8 days) and other days are populated as 0. When I look into that particular day, I can notice events are there.
Can someone please help here?
My Query format is as below,
Main Query [search <subquery> ] | timechart span=1d count as total | sort by "_time" desc
My Output is as below,
2022-03-22
647
2022-03-21
988
2022-03-20
279
2022-03-19
100
2022-03-18
879
2022-03-17
1169
2022-03-16
15
2022-03-15
0
2022-03-14
0
2022-03-13
0
2022-03-12
0
2022-03-11
0
2022-03-10
0
2022-03-09
0
2022-03-08
0
2022-03-07
0
2022-03-06
0
2022-03-05
0
2022-03-04
0
2022-03-03
0
2022-03-02
0
2022-03-01
0
2022-02-28
0
Before 15th March, I see data is populated as 0 but when the same query is ran for 15th March alone I noticed events are getting populated.
For eg, I selected time range as 14th March 00:00 to 15th March 24:00 for the same query, I got result as below. But this value not getting populated when last 30days time period is selected.
2022-03-15
587
2022-03-14
654
Kindly need help on this.
Thanks in Advance.
... View more
Labels
- Labels:
-
timechart
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-25-2022
01:17 AM
|
