Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jinishshah
jinishshah
Explorer
Member since:
03-30-2022
a month ago
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-30-2022 |
Activity Feed
- Posted Getting error while accessing Splunk dataset- How do I fix? on Splunk Search. a month ago
- Posted Re: Conditional graph depending on input parameter on Splunk Search. 04-19-2022 01:09 AM
- Posted Re: Conditional graph depending on input parameter on Splunk Search. 04-18-2022 11:34 AM
- Posted Re: Conditional graph depending on input parameter on Splunk Search. 04-18-2022 11:27 AM
- Posted Re: Conditional graph depending on input parameter on Splunk Search. 04-18-2022 11:26 AM
- Posted Re: Conditional graph depending on input parameter on Splunk Search. 04-18-2022 11:23 AM
- Posted How to create a conditional graph depending on input parameter? on Splunk Search. 04-18-2022 10:57 AM
- Posted Re: Why is Dashboard Studio not recognizing newline? on Dashboards & Visualizations. 04-18-2022 03:35 AM
- Posted Re: How to create a search to join 2 csv files? on Splunk Search. 04-13-2022 07:06 AM
- Posted How to create a search to join 2 csv files? on Splunk Search. 04-12-2022 09:13 AM
- Posted Why is Dashboard Studio not recognizing newline? on Dashboards & Visualizations. 04-04-2022 08:51 AM
- Got Karma for Re: Joining Alert lookup file with a mapping file depending on pattern search. 03-30-2022 09:14 AM
- Posted Re: Joining Alert lookup file with a mapping file depending on pattern search on Dashboards & Visualizations. 03-30-2022 02:24 AM
- Posted Re: Joining Alert lookup file with a mapping file depending on pattern search on Dashboards & Visualizations. 03-30-2022 02:05 AM
- Posted Re: Joining Alert lookup file with a mapping file depending on pattern search on Dashboards & Visualizations. 03-30-2022 01:12 AM
- Posted How to Join Alert lookup file with a mapping file depending on pattern search? on Dashboards & Visualizations. 03-30-2022 12:23 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
a month ago
Getting error : "The lookup table 'Horizon_Feb_2022.csv' requires a .csv or KV store lookup definition." while running simple query "|inputlookup Horizon_Feb_2022.csv". Facing similar issue for other datasets as well.
... View more
Labels
- Labels:
-
lookup
04-19-2022
01:09 AM
@ITWhisperer : what is the syntax for Dashboard Studio. This seems to be syntax for Classic Dashboard. Syntax format of Dashboard Studio is like below: "inputs" : { "input_month-year" : { "options" : { "items" : [ { "label" : "Q1-2022" , "value" : "\"Q1-2022\"" }, { "label" : "01-2022" , "value" : "\"01-2022\"" }, { "label" : "02-2022" , "value" : "\"02-2022\"" }, { "label" : "03-2022" , "value" : "\"03-2022\"" } ], "token" : "month_year" }, "title" : "Month-Year" , "type" : "input.dropdown" },
... View more
04-18-2022
11:34 AM
Input is defined as Dropdown: Label Value Q1-2022 "Q1-2022" 01-2022 "01-2022" 02-2022 "02-2022" and I am using this Token values for other calculations
... View more
04-18-2022
11:27 AM
@ITWhisperer Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as "Q1-2022","01-2022","03-2022"
... View more
04-18-2022
11:26 AM
Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as "Q1-2022","01-2022","03-2022"
... View more
04-18-2022
11:23 AM
@ITWhisperer : Token Input is "Q1-2022" which needs to be interpreted as "qtr" while same Token input if "01-2022","02-2022" needs to be interpreted as "1mon" so cannot directly pass $span$ tried below: eval span_time=if(input="Q%","qtr","1mon") | timechart span=span_time count(number) but gives an error " Error in 'timechart' command: The value for option span (jinmonth) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value."
... View more
04-18-2022
10:57 AM
Hello,
so I have an input on my dashboard page of either month"01-2022,02-2022" and also quarter"Q1-2022". So depending on the search I want to have my timechart command.
For example: query| timechart span="1mon" count(number) [For month] query| timechart span="qtr" count(number) [For quarter].
I want query like this:
if [input_month="Q%"] then
query| timechart span="qtr" count(number)
else
query| timechart span="1mon" count(number)
How can I do this ?
... View more
Labels
- Labels:
-
timechart
04-18-2022
03:35 AM
@VatsalJagani : Sorry for late reply. Dataset is an excel file. Below are more details Excel file name: Writeup.csv Data: Header Month Writeup Autosys 01-2022 There are many Autosys failures this month as compared to previous. Main reason of failure is Server reboot. All host issues have been resolved and numbers would do down this month Query: | inputlookup Writeup.csv | where month="01-2022" and Header="Autosys"| fields Writeup O/P: There are many Autosys failures this month as compared to previous. Main reason of failure is Server reboot. All host issues have been resolved and numbers would do down this month Expected O/P: There are many Autosys failures this month as compared to previous. Main reason of failure is Server reboot. All host issues have been resolved and numbers would do down this month
... View more
04-13-2022
07:06 AM
Thanks @bowesmana for your quick response. Just have one issue with this, it is ignoring the rows which don't match any of pattern. How can I update the query such that all rows which don't match any criteria are termed as Header="Others"
... View more
04-12-2022
09:13 AM
Hello,
I have 2 CSVs in my splunk:
Alert.csv having below columns and data:
Alert_Header Alert_type Date
JNA/athena_VICTORIA_Load [FAILED] Autosys 01/03/2022
JNA/athena_VICTORIA_Staging [MAXRUN] Autosys 01/03/2022
JNA/athena_MAIN_Load [FAILED] Autosys 01/03/2022
JNA/athena_OLTP_Staging [MAXRUN] Autosys 01/03/2022
NYP02000 has high_cpu DATABASE 01/03/2022
Mapping.csv having below columns and data:
Alert_Type Inclusion Exclusion Header
Autosys athena VICTORIA ATHENA-Jobs
Autosys VICTORIA NONE VICTORIA-Jobs
Database high_cpu NONE CPU alerts
Output required:
Alert_Header Alert_type Date Header
JNA/athena_VICTORIA_Load [FAILED] Autosys 01/03/2022 VICTORIA-Jobs
JNA/athena_VICTORIA_Staging [MAXRUN] Autosys 01/03/2022 VICTORIA-Jobs
JNA/athena_MAIN_Load [FAILED] Autosys 01/03/2022 ATHENA-Jobs
JNA/athena_OLTP_Staging [MAXRUN] Autosys 01/03/2022 ATHENA-Jobs
NYP02000 has high_cpu DATABASE 01/03/2022 CPU alerts
Logic: Mapping file is for looking up pattern in the Alert.csv. So if any Alert_Header which has "athena"(mentioned in Inclusion) but doesn't have "Victoria" (mentioned in Exclusion) keyword in it will be termed as "ATHENA-Jobs" . Similarly if any Alert_Header which has "Victoria"(mentioned in Inclusion) only will be termed as "VICTORIA-Jobs". None in Exclusion column would mean there is no exclusion pattern to be searched in Alert_Header.
Can you please help with this query
... View more
Labels
- Labels:
-
join
04-04-2022
08:51 AM
When I just display field "Writeup" from my Excel dataset which is like below:
"This is the first line.
This is the second line.
This is the third line."
While displaying the same in Dashboard Studio, it prints like below:
"This is the first line.This is the second line.This is the third line."
How can I resolve this issue
... View more
Labels
- Labels:
-
Dashboard Studio
03-30-2022
02:24 AM
1 Karma
Sorry My Bad.....Its works Superbly !!! Thanks for your quick answer !!! Really appreciated !!
... View more
03-30-2022
02:05 AM
Hey @ITWhisperer , it worked for Module column but not working as expected for Header column. Picking up wrong value
... View more
03-30-2022
01:12 AM
Thanks for your quick reply @ITWhisperer . Merging for Type=Autosys is working fine but not for others. I am getting blank output in others. What if I change <blank> in Mapping.csv to "all". What will be the query then ?
... View more
03-30-2022
12:23 AM
Hello,
I have a alert dump data Horizon.csv having important columns like below:
Alert GRN Type ....
PNC/hz-hfp-l-abc[MAXRUN] PNC/hz-hfp-l-abc Autosys
Filesystem[ivp1234.xy.com] [91>90] ivp1234.xy.com Application
Filesystem[ivp1244.xy.com] [91>90] ivp1244.xy.com Application
p.start.script.pl is down Process down API
which I need to merge with Mapping.csv but on a condition that if Type=Autosys then merge on GRN else merge on Type
details of Mapping.csv
Type Name Module Header
Autosys hz-hfp-l-abc HF EOD Job
Application <blank> Eng Server alerts
API <blank> LF Service alerts
I need output as
Alert GRN Type Module Header
PNC/hz-hfp-l-abc[MAXRUN] PNC/hz-hfp-l-abc Autosys HF EOD Job
Filesystem[ivp1234.xy.com] [91>90] ivp1234.xy.com Application Eng Server alerts
Filesystem[ivp1244.xy.com] [91>90] ivp1244.xy.com Application Eng Server alerts
p.start.script.pl is down Process down API LF Service alerts
... View more
Labels
- Labels:
-
chart
