About Santosh2

Santosh2

@ITWhisperer Thank you so much, it really saved my time.

Santosh2

I would like to add a column called Management to my table. The management value is not part of the event data. It is something I would like to assign based on the value of Applications: Any help would be appreciated. Management Applications In IIT In ALP In MAL In HST Out OCC In ALY In GSS In HHS In ISD

Santosh2 · ‎04-10-2024

We have around 10 services, by using below query i am getting 8 services and other 2 are not getting displayed in the table. But we can view them in events. Filed extraction is working correctly. not sure why other 2 services are not showing up in the table. please find the output. index=test-index (data loaded) OR ("GET data published/data/ui" OR "GET /v8/wi/data/*" OR "GET data/ui/wi/load/success") |rex field=_raw "DIP:\s+\[(?<dip>[^\]]+)." |rex field=_raw "ACTION:\s+(?<actions>\w+)" |rex dield=_raw "SERVICE:\s+(?<services>\S+)" |search actions= start OR actions=done NOT service="null" |eval split=services.":".actions |timechart span=1d count by split |eval _time=strftime(_time, "%d/%m/%Y") |table _time *start *done Current output: (DCC:DONE &PIP:DONE fields are missing) _time AAP:START ACC:START ABB:START DCC:START PIP:START AAP:DONE ACC:DONE ABB:DONE 1/2/2022 1 100 1 100 1 1 66 1 2/2/2022 5 0 5 0 3 3 0 3 3/2/2022 10 0 10 0 8 7 0 8 4/2/2022 100 1 100 1 97 80 1 80 5/2/2022 0 5 0 5 350 0 4 0 Expected output: _time AAP:START ACC:START ABB:START DCC:START PIP:START AAP:DONE ACC:DONE ABB:DONE DCC:DONE PIP:DONE 1/2/2022 1 100 1 100 1 1 66 1 99 1 2/2/2022 5 0 5 0 3 3 0 3 0 2 3/2/2022 10 0 10 0 8 7 0 8 0 3 4/2/2022 100 1 100 1 97 80 1 80 1 90 5/2/2022 0 5 0 5 350 0 4 0 5 200

Santosh2 · ‎04-10-2024

Sample logs: {"date": "1/2/2022 00:12:22,124" DATA [http:nio-12567-exec-44] DIP: [675478-7655a-56778d-655de45565] Data: [7665-56767ed-5454656] MIM: [483748348-632637f-38648266257d] FLOW: [NEW] { SERVICE: AAP | Applicationid: iis-675456 | ACTION: START | REQ: GET data published/data/ui } DADTA -:TIME:<TIMESTAMP> (0) 1712721546785 to 1712721546885 ms GET /v8/wi/data/*, GET data/ui/wi/load/success, "tags": {"host": "GTU5656", "insuranceid": "8786578896667", "lib": "app"}} Sample logs: {"date": "1/2/2022 00:12:22,124" DATA [http:nio-12567-exec-44] DIP: [675478-7655a-56778d-655de45565] Data: [7665-56767ed-5454656] MIM: [483748348-632637f-38648266257d] FLOW: [NEW] { SERVICE: AAP | Applicationid: iis-675456 | ACTION: DONE | REQ: GET data published/data/ui } DADTA -:TIME:<TIMESTAMP> (0) 1712721546785 to 1712721546885 ms GET /v8/wi/data/*, GET data/ui/wi/load/success, "tags": {"host": "GTU5656", "insuranceid": "8786578896667", "lib": "app"}} Hi @PickleRick , added sample logs, let me know if u need any other details.

Santosh2 · ‎04-10-2024

index=test-index (data loaded) OR ("GET data published/data/ui" OR "GET /v8/wi/data/*" OR "GET data/ui/wi/load/success") |rex field=_raw "DIP:\s+\[(?<dip>[^\]]+)." |rex field=_raw "ACTION:\s+(?<actions>\w+)" |rex dield=_raw "SERVICE:\s+(?<services>\S+)" |search actions= start OR actions=done NOT service="null" |eval split=services.":".actions |timechart span=1d count by split |eval _time=strftime(_time, "%d/%m/%Y") |table _time *start *done When we run the above query , not all services getting captured, but we have data, attached the screen shot(highlighted ones are missing). can anyone let me know what is the issue with the query.

Santosh2 · ‎04-02-2024

Thankyou @richgalloway it was pretty simple.

Santosh2 · ‎03-31-2024

Application Success Failed Total percentage IPL 15 2 17 11.764 IPL 10 2 12 16.666 IPL 4 1 5 20.000 WWV 3 2 5 40.000 WWV 1 0 1 0.000 PIP 20 5 25 20.000 IPL 1 0 1 0.0000 WWV 30 15 45 33.333 PIP 20 10 30 33.333 From the above table, we want to calculate application wise data. Expected output: Application Success Failed Total percentage IPL 30 5 35 14.285 WWV 34 17 51 33.333 PIP 40 15 55 27.272 How can we do this???

Santosh2 · ‎03-27-2024

can anyone help on this??

Santosh2 · ‎03-26-2024

from the below query, i am running for 2 to 3 and posted the output and ran again same query from 3 to 4 and posted the output. i want a query where i can compare pervious hour(2 to 3 data) with (3 to 4) data and i want to calculate the difference percentage |mstats sum(transaction) as Trans where index=host-metrics service=login application IN(app1, app2, app3, app4) span=1h by application output: 02:00 to 03:00 hours data _time application Trans 2022-01-22 02:00 app1 3456.000000 2022-01-22 02:00 app2 5632.000000 2022-01-22 02:00 app3 5643.000000 2022-01-22 02:00 app4 16543.00000 03:00 to 04:00 hours data output: _time application Trans 2022-01-22 03:00 app1 8753.000000 2022-01-22 03:00 app2 342.000000 2022-01-22 03:00 app3 87653.000000 2022-01-22 03:00 app4 8912.00000

Santosh2 · ‎03-06-2024

If I want to exclude only 10pm then what will be the cron job

Santosh2 · ‎03-06-2024

Hi @kiran_panchavat , yes your are correct but my requirement is in 24 hours I don’t want to receive the alert at 10pm, 11pm only. how can I do that????

Santosh2 · ‎03-06-2024

I did it it’s saying it won’t run from 9pm to 7 am but it’s not working

Santosh2 · ‎03-06-2024

Hi all, I set a corn job on alert my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm 0 0-21, 7-23 5-9 3 1-7 is this corn job correct?? Do I need to do any changes????

Santosh2 · ‎02-17-2024

Hi @ITWhisperer , i tried adding the missing line, but i am not getting the results by site. I think we need to do some changes in the query but i am not getting it. Can anyone help on this.

Santosh2 · ‎02-13-2024

Tried below query, but not getting values by site index=abc mal_code=xyz TERM(application) OR (TERM(status) TERM(success)) NOT (TERM(unauthorized) TERM(time) TERM(mostly)) site=* |stats count by Srock site |stats sum(count) as Success |appendcols [search index=abc mal_code=xyz (TERM(unauthorized) TERM(time) TERM(mostly)) NOT (TERM(status) TERM(success)) site=* |stats count by ID site |fields ID site |eval matchfield=ID |join matchfield [search index=abc mal_code=xyz site=* "application" |stats count by Srock site |fields Srock site |eval matchfield=Srock] |stats count(matchfiled) as Failed] |eval Total=Success+Failed |eval SuccessRate=round(Success/Total*100,2) |table *

Santosh2 · ‎02-13-2024

I tried in many ways but I am not getting expected output

Santosh2 · ‎02-13-2024

Hi @ITWhisperer , I tried giving as site=* it’s not working l am getting total value but I need values by site.

Santosh2 · ‎02-12-2024

Query: index=abc mal_code=xyz TERM(application) OR (TERM(status) TERM(success)) NOT (TERM(unauthorized) TERM(time) TERM(mostly)) site=SOC |stats count by Srock |stats sum(count) as Success |appendcols [search index=abc mal_code=xyz (TERM(unauthorized) TERM(time) TERM(mostly)) NOT (TERM(status) TERM(success)) site=SOC |stats count by ID |fields ID |eval matchfield=ID |join matchfield [search index=abc mal_code=xyz site=SOC "application" |stats count by Srock |fields Srock |eval matchfield=Srock] |stats count(matchfiled) as Failed] |eval Total=Success+Failed |eval SuccessRate=round(Success/Total*100,2) |table * From the above query i am getting data only for one site. but I want data for both sites SOC and BDC. I tried giving as site=* its not working Any help would be appreciated.

Santosh2 · ‎10-03-2022

Hi, when i am checking the health check dashboard i saw error in indexing ready. Indexing Ready Root Cause: Cluster is not indexing ready, please bring up at least RF number of peers. Unhealthy Instance: xxxxx Last 50 related messages: None Note: the instance is not active instance. But when i check SF and RF are met it is showing How to resolve this issue????

Santosh2 · ‎09-01-2022

but how can i identify that

Santosh2 · ‎09-01-2022

Santosh2 · ‎08-30-2022

We are receiving error from _internal index for Json logs: 1. error: ERROR JsonLineBreaker - JSON StreamId:1254678906 had parsing error:Unexpected character: "s" 2. error: ERROR JsonLineBreaker - JSON StreamId:1254678906 had parsing error:Unexpected character: "a" sample logs: { [-] level: debug message: Creating a new instance of inquiry call timestamp: 2022-08-25T20:30:45.678Z } my props.conf: TIME_PREFIX=timestamp" : " TIME_FORMAT= %Y-%m-%dT%H:%M:%S.%3N MAX_TIMESTAMP_LOOKAHEAD=40 TZ=UTC how to resolve this issue.

Santosh2 · ‎08-21-2022

Hi, i came to know the issue, i was doing a wrong query. Now the issue resolved. Thanks in advance

Santosh2 · ‎08-16-2022

Hi All, I have one dashboard in that I am fetching the results from a input look up file. I am getting the results but result are getting combined (multiple field values into single event) But I want them separately like how we have updated in our look up file In the same way I want to see in splunk. Lookup file data: Storage_name type. Quality Abcd. Fty. 100 Efgd. Iju. 2000 Ghyu. Thu. 3455 Gfhbv. Uyhgt. 4556 Any suggestions

Santosh2 · ‎07-26-2022

sorry for the late reply.... Yes as you said the buckets contains old and new data, i checked my props.conf, everthing looks good and no warnings are seen in spunkd logs as well, linebreaking is happening correctly, but still i am able to see 2 years old data. I tried to change the forzentimeperiod to 3 days as well, but still i can see the old data.

Posts	30
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎05-13-2022

Online Status	Offline
Date Last Visited	3 weeks ago

Custom table

Not all fields showing up

Need help to sum up the field values

Custom query

Corn job

Customised search

Health Check issue- How to fix this error?

Why are we receiving error from _internal index f...

Field values from look up to query?

Why am I still seeing old data?

Re: Custom table

Custom table

Re: Not all fields showing up

Re: Not all fields showing up

Not all fields showing up

Re: Need help to sum up the field values

Need help to sum up the field values

Re: Custom query

Custom query

Re: Corn job

Re: Corn job

Re: Corn job

Corn job

Re: Customised search

Re: Customised search

Re: Customised search

Re: Customised search

Customised search

Health Check issue- How to fix this error?

Re: Why are we receiving error from _internal inde...

Re: Why are we receiving error from _internal inde...

Why are we receiving error from _internal index f...

Re: Field values from look up to query

Field values from look up to query?

Re: Why am I still seeing old data?