About csahoo

csahoo · ‎12-08-2022

i am working on splunk cloud , i don't have access to server and i am using dashboard studio . This is my table code also i have attached the screenshot of my table , so i just want to know how can i add tooltip to each column header of my table. "viz_zfv78G8Y": { "type": "splunk.table", "title": "GP Metrics", "options": { "tableFormat": { "align": "> table |pick(alignment)" }, "columnFormat": { "messegetype": { "data": "> table | seriesByName(\"messegetype\") | formatByType(messegetypeColumnFormatEditorConfig)" } } }, "dataSources": { "primary": "ds_f9ztfdW3" } }

csahoo · ‎12-01-2022

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request" | eval LabelType=coalesce(labelType, documentType) | eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async") | stats count(eval(status="Received")) as received count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event where as the source : - is my application name event :- Type of request whether synchronous request or Asynchronous request labeltype : - Different type of label sourcenodecode and geocode :- is the shopcode and shopregion from where the label is requested received - no of label request received failed - no of label request failed Now i want to find the received and failed request count based on sourceNodeCode, geoCode, LabelType, event But for failed request count i want to add condition - in case of synchronous request or event the failed count should fetch from '*gps-request-processor-test*' application in case of asynchronous request or event the failed count should fetch from "*gps-external-processor-test*" OR "*gps-artifact-processor-test*" application The output should look something similar to this attached o/p.

csahoo · ‎12-01-2022

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request" | eval LabelType=coalesce(labelType, documentType) | eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async") | where event == "Sync" AND source like "%gps-request-processor%" OR event == "Async" AND (source like "%gps-external-processor%" OR source like "%gps-artifact-processor%") | stats count(eval(status="Received")) as received count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event suppose i need to calculate the count of both received and failed but i want this where clause to be applicable while calculating the failed count only, so in that case what should be my query.

csahoo · ‎12-01-2022

Let me simplifie my requirement , Below is my query index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request" | eval LabelType=coalesce(labelType, documentType) | eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async") | stats count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event where as the source : - is my application name event :- Type of request whether synchronous request or Asynchronous request labeltype : - Different type of label sourcenodecode and geocode :- is the shopcode and shopregion from where the label is requested Now i want to find the failed request count based on sourceNodeCode, geoCode, LabelType, event where in case of synchronous request or event the failed count should fetch from '*gps-request-processor-test*' application in case of asynchronous request or event the failed count should fetch from "*gps-external-processor-test*" OR "*gps-artifact-processor-test*" application The output should look something similar to this attached o/p where the failed count should fetch from different application based on the event type.

csahoo · ‎12-01-2022

Hi , i want to calculate count based on the condition , like in the below query if the event is 'sync' then the 'failed' count should fetch from source="*gps-request-processor-test*" if the event is 'Async' then the 'failed' count should fetch from source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request" documentType="*" OR labelType="*" | eval LabelType=coalesce(labelType, documentType) | eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async") | rex mode=sed "s/1067/Windrunner/g" field=sourceNodeCode | rex mode=sed "s/531/SFS/g" field=sourceNodeCode | rex mode=sed "s/EUROPE_MIDDLE_EAST_AFRICA/EMEA/g" field=geoCode | eval Geo=geoCode,Node=sourceNodeCode | eval syncelapsed=if(source like "%gps-request-processor%",elapsedTime,null()) | eval asyncelapsed=if(source like "%gps-external-processor%" OR source like "%gps-artifact-processor%",elapsedTime,null()) | stats count(eval(status="Received" AND source like "%gps-request-processor%" )) as received count(eval(deliveryStatus="Success")) as delivered count(eval(status="Failed")) as failed avg(syncelapsed) as syncelapsedtime avg(asyncelapsed) as asyncelapsedtime avg(deliveryElapsedTime) as deliverytime by Node Geo LabelType event

csahoo · ‎07-14-2022

index="*dockerlogs*" source="*gps-request-processor-dev*" OR source="*gps-external-processor-dev*" OR source="*gps-artifact-processor-dev*" | eval LabelType=coalesce(labelType, documentType) | stats count(eval(status="Received" AND source like "%gps-request-processor%" )) as received count(eval(status="Failed")) as failed by LabelType LabelType Received Failed ---------- -------- ------ CARRIERLABEL 2 2 NIKE 39 35 TASKSTART 1 0 i want to transform above result into below table 1) where category can be 'external' or 'internal' if labeltype is 'CARRIERLABEL' then category is 'external' else for other labeltype it should be 'internal' 2) successcount = Received - failed category successcount -------- ------------- external 0 internal 5

csahoo · ‎06-22-2022

Hi All, I am using Splunk Cloud where I have an index whose retention period is set as 10 years, so I just want to understand how can I get an email alert once my index is close to its retention period .

csahoo · ‎05-30-2022

Thank you @ITWhisperer it's working

csahoo · ‎05-29-2022

index="np-dockerlogs*" source="*gps-request-processor-dev*" sourcetype= "*eu-central-1*" event="*Request" | fields event category labelType documentType regenerate businessKey businessValue sourceNodeType sourceNodeCode geoCode jobId status sourcetype source traceID processingTime _time | eval LabelType=coalesce(labelType, documentType) | sort _time | table event LabelType sourceNodeCode geoCode status traceID processingTime Above query provide three record for each traceid which indicate for the respective traceid request was received request was success/failed total time taken by the request now from this data i want to produce below type of table geoCode sourceNodeCode LabelType event totalreqreceived successrate avgProcessingTime EMEA 1067 Blindilpn synclabelrequest 1 100% 450 taskstart synclabelrequest 5 98% 1500 1069 ilpn synclabelrequest 1 100% 420 NA 1068 NIKE synclabelrequest 1 100% 500 cgrade synclabelrequest 4 95% 2000 NIKE asynclabelrequest 1 100% 350 This table shows the 'total no of request received' , 'there success percentage' and 'average processingtime' for each 'event (either synclabelrequest or asynclabelrequest)' from a list of 'labelType' belongs to a specific sourceNodeCode and geocode

csahoo · ‎05-26-2022

i found for below query the search is happening based on default time field which is _time , so when ever i am choosing the date and time based on default time which is '5/26/22 7:40:00.000 AM' then the events are populating but if i am selecting any date and time which is align with my custom time field which is 'originaltime' then i am not getting any event , am i doing any thing wrong here index="summary_carrier_service" originalsource="*gps-request-processor-dev*" originalsourcetype= "*eu-central-1*" event="*Request" | fields event category labelType documentType regenerate businessKey businessValue sourceNodeType sourceNodeCode geoCode jobId status sourcetype source originaltime | addinfo | eval ts=strptime(originaltime,"%Y-%m-%d %H:%M:%S") | where (ts>info_min_time and ts<=info_max_time)

csahoo · ‎05-13-2022

We have a service for which we have splunk dashboard is in place and right now the dashboard have the limitation that it can populate based on 3 month old data due to log retention policy , but right now there is a business requirement that the dashboard should populate based on forever data. so here i want to understand what can be efficient and economical way to extend the log retention to forever in Splunk.

csahoo · ‎05-13-2022

Thank you very much @ITWhisperer @somesoni2 both the queries are working fine

csahoo · ‎05-11-2022

Posts	13
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎05-11-2022

Online Status	Offline
Date Last Visited	‎12-08-2022 10:13 AM

How to add tooltip on each table column?

How to do stats count based on condition?

How to calculate count based on the condition?

How to transform above result into below table?

How can I get an email alert once my index is clos...

How to summarize table from multiple records?

Help with Event Search based on custom time field

How to extend Splunk log retention to forever?

How to calculate successful percentage grouped by ...