Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Srubhi
Srubhi
Path Finder
Member since:
06-23-2022
10-18-2023
Community Statistics
| Posts | 13 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 06-23-2022 |
Activity Feed
- Posted Re: How to exclude a row with respect to certain timestamp using outlier on Splunk Search. 10-18-2023 03:04 AM
- Posted Re: How to exclude a row with respect to certain timestamp using outlier on Splunk Search. 10-18-2023 02:56 AM
- Posted Re: How to exclude a row with respect to certain timestamp using outlier on Splunk Search. 10-17-2023 10:56 PM
- Posted Re: How to exclude a row with respect to certain timestamp using outlier on Splunk Search. 10-17-2023 06:15 AM
- Posted How to exclude a row with respect to certain timestamp using outlier on Splunk Search. 10-13-2023 12:36 AM
- Tagged How to exclude a row with respect to certain timestamp using outlier on Splunk Search. 10-13-2023 12:36 AM
- Posted Is there a way to remove entire row from Kv Store lookup by running scheduled search?? on Splunk Search. 05-03-2023 09:39 AM
- Tagged Is there a way to remove entire row from Kv Store lookup by running scheduled search?? on Splunk Search. 05-03-2023 09:39 AM
- Posted Can we pause a scheduled search for 30 seconds?? on Splunk Search. 04-25-2023 01:07 AM
- Tagged Can we pause a scheduled search for 30 seconds?? on Splunk Search. 04-25-2023 01:07 AM
- Karma Re: How to add colour feature in dashboard which the value is in the time format for preotesoiu. 06-29-2022 10:45 PM
- Posted Re: How to add colour feature in dashboard which the value is in the time format on Splunk Enterprise. 06-29-2022 10:44 PM
- Posted How to add colour feature in dashboard which the value is in the time format on Splunk Enterprise. 06-28-2022 05:57 AM
- Tagged How to add colour feature in dashboard which the value is in the time format on Splunk Enterprise. 06-28-2022 05:57 AM
- Posted Re: How to add colour feature in dashboard. on Splunk Enterprise. 06-26-2022 10:47 PM
- Tagged Re: How to add colour feature in dashboard. on Splunk Enterprise. 06-26-2022 10:47 PM
- Posted How to add colour feature in dashboard. on Splunk Enterprise. 06-24-2022 03:44 AM
- Tagged How to add colour feature in dashboard. on Splunk Enterprise. 06-24-2022 03:44 AM
- Posted Re: How to convert time format to readable time format? on Splunk Enterprise. 06-24-2022 03:40 AM
- Karma Re: how to convert Convert time format to readable time format for richgalloway. 06-24-2022 03:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-18-2023
03:04 AM
Output _time Namespace Environment ServiceDenomination MetricName EntityName Count 2023-10-06 22:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 1 2023-10-07 22:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 2 2023-10-08 22:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 3 2023-10-09 09:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 4 2023-10-09 22:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 5 2023-10-10 09:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 6 2023-10-10 22:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 7 2023-10-11 22:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 8 2023-10-11 22:00 Entity Test TestBoundBatch TestMessageCount TestOrder.Supplier 9
... View more
10-18-2023
02:56 AM
Hi @ITWhisperer my expectation is, suppose everyday we have data at 22:00 we need to keep that data and ignore the rest other data. can outlier be the option to ignore the data coming with different timestamp? please note: it is not always 22:00 data it can we any time but we have to ignore the other timestamp data apart from the usual one. base search: | mstats sum(Entity.InMessageCount.count.Sum) as count span=1h where index=cloudwatch_metrics AND Namespace=Entity AND Environment=prod AND EntityName="Order.SupplierDepot" AND ServiceDenomination=OutboundBatcher by Namespace, Environment, ServiceDenomination, MetricName, EntityName
| where count > 0
... View more
10-17-2023
10:56 PM
Hello @ITWhisperer , Is the above data is sufficient to resolve this issue. could you please help me in this.
... View more
10-17-2023
06:15 AM
Hi @ITWhisperer Sorry for the delay. my expectation is, suppose everyday we have data at 22:00 we need to keep that data and ignore the rest other data. can outlier be the option to ignore the data coming with different timestamp? please note: it is not always 22:00 data it can we any time but we have to ignore the other timestamp data apart from the usual one. base search:
| mstats sum(Entity.InMessageCount.count.Sum) as count span=1h where index=cloudwatch_metrics AND Namespace=Entity AND Environment=prod AND EntityName="Order.SupplierDepot" AND ServiceDenomination=OutboundBatcher by Namespace, Environment, ServiceDenomination, MetricName, EntityName
| where count > 0
Output:
_time
Namespace
Environment
ServiceDenomination
MetricName
EntityName
Count
2023-10-06 22:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
1
2023-10-07 22:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
2
2023-10-08 22:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
3
2023-10-09 09:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
4
2023-10-09 22:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
5
2023-10-10 09:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
6
2023-10-10 22:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
7
2023-10-11 22:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
8
2023-10-11 22:00
Entity
Test
TestBoundBatch
TestMessageCount
TestOrder.Supplier
9
... View more
10-13-2023
12:36 AM
Hi, i have the below table data where i have timecharted for 1hr time span i want to remove the row which is in red colour as it is coming with different time when compare to other data. can i be using outlier command to perform this operation and how i can achieve this requirement. Thank you in advance, _time B C D E F 2023-10-06 22:00 2023-10-07 22:00 2023-10-08 22:00 2023-10-09 09:00 2023-10-09 22:00 2023-10-10 09:00 2023-10-10 22:00 2023-10-11 22:00
... View more
- Tags:
- outlier
Labels
- Labels:
-
other
05-03-2023
09:39 AM
we have a search which is feeding data to kv store lookup let say lookup name 'sample_test'. now i want to run a weekly scheduled search that will compare the index source data and the data in 'sample_test' and remove the entire row from the kv store lookup which are not in index source data. Example: KV store data ('sample_test') X Y Z a A 1 b B 2 c C 3 d D 4 e E 5 Index Source Data X Y Z a A 1 b B 2 c C 3 d D 4 So ideally, when compare to above 2 tables last row in the kv store lookup in not present my source data i need to run a weekly scheduled search to remove that last row from the KV store. It would be more helpful if anyone can help me to resolve this issue. Happy Splunking!!
... View more
- Tags:
- kv store lookup
Labels
- Labels:
-
lookup
04-25-2023
01:07 AM
I need to know how we can pause the search for 30 seconds and then run the saved search for example, i have a search scheduled at 9:30:00 my requirement is that the search should pause for 30 seconds and run at 9:30:30 seconds. It would be more helpful if anyone help me in resolving this!! happy Splunking!!
... View more
- Tags:
- scheduled search
Labels
- Labels:
-
search job inspector
06-29-2022
10:44 PM
thank you @preotesoiu it worked for me!!
... View more
06-28-2022
05:57 AM
I did not received the expected result on the below query, could anyone please check. https://community.splunk.com/t5/Splunk-Enterprise/How-to-add-colour-feature-in-dashboard/m-p/603148#M12979 In the below dashboard table, I need to set colour condition of 2 columns that is is expected difference and sla_difference. if expected_difference Is negative it should show in red colour if it is positive it should show in green colour. same as for sla_difference if it is negative it should be orange if it is positive it should show in green.
... View more
- Tags:
- dashboard
Labels
- Labels:
-
troubleshooting
06-26-2022
10:47 PM
hi @efavreau Thank you for your response. the value which i have in the column is in time format how to specify it in range??
... View more
- Tags:
- dashboard
06-24-2022
03:44 AM
In the below dashboard table, I need to set colour condition of 2 columns that is is expected difference and sla_difference. if expected_difference Is negative it should show in red colour if it is positive it should show in green colour. same as for sla_difference if it is negative it should be orange if it is positive it should show in green.
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-24-2022
03:40 AM
Thanks @richgalloway it worked!
... View more
06-23-2022
03:56 AM
We have data fields in the format, for example, 12Jun22 I need to format like 12-06-2022 as shown in the below table:
date
expected format
12Jun22
12-06-20222
13Jun22
13-06-2022
... View more
Labels
- Labels:
-
using Splunk Enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-18-2023
06:50 AM
|
