About Vani_26

Vani_26

original query: index=splunk-index |where message="start" |where NOT app IN("ddm", "wwe", "tygmk", "ujhy") |eval day= strftime(_time, "%A") |where _time >= relative_time(_time, "@d+4h") AND _time <= relative_time(_time, "@d+14h") |where NOT day IN("Tuesday", "Wednesday", "Thursday") To suppress my alert, i created a lookup file and added the alert name and holidays dates as shown below: Alert Holidays_Date App Relative Logs Data 8/12/2023 App Relative Logs Data 8/13/2023 App Relative Logs Data 8/14/2023 App Relative Logs Data 8/18/2023 Query with inputlookup holiday list: |inputlook HolidayList.csv |where like(Alert, "App Relative Logs Data") AND Holidays_Date=strftime(now(), "%m/%d/%y") |stats count |eval noholdy=case(count=1, null(), true(), 1) |search noholdy=1 |fields noholdy |appendcols [search index=splunk-index |where message="start" |where NOT app IN("ddm", "wwe", "tygmk", "ujhy") |eval day= strftime(_time, "%A") |where _time >= relative_time(_time, "@d+4h") AND _time <= relative_time(_time, "@d+14h") |where NOT day IN("Tuesday", "Wednesday", "Thursday")] When i used this query i am still receiving alert on the dates mentioned in the .csv file. But i don't want to receive the alerts. is there something wrong in my query, please help

Vani_26 · ‎05-30-2023

Original query: index=app-data sourcetype=clientapp-code |rex field=_raw "\Status\:(?<Code>.*?)\|" |eval Failed=if(Code!=0, "Failed", null()) |bucket _time span=1d |stats count(Failed) as Fail by _time OUTPUT: _time Fail 2022-01-22 6 2022-01-23 0 2022-01-24 8 2022-01-25 0 2022-01-26 0 2022-01-27 12 2022-01-28 0 2022-01-29 0 tstats query: |tstats count where index=app-data sourcetype=clientapp-code by PREFIX(status:) _time span=1d |rename status: as Code |eval Failed=if(Code!=0, "Failed", null()) |where Code!=0 |stats values(count) by _time OUTPUT: _time Fail 2022-01-22 6 2022-01-24 8 2022-01-27 12 I want to see original query output with tstats query but 0 data rows are not showing up in tstats command. How can i get the 0 data rows using tstats query???

Vani_26 · ‎05-26-2023

below is my tstats query, how to pass this token (prodct="$eppProduct$") OR site="$eppProduct$") in this query: i pasted original query also, in original query tokens are there but when i trying to pass in tstats its not working |tstats avg(duration) as Duration where index=epp-prd-clc TERM(variable) TERM("ap")TERM(virginal) TERM("ssc") TERM(deposit) TERM("calp") BY PREFIX(deposit:) _time |rename deposit: as Deposit |eval Deposit=upper(deposit) |timechart |eval Duration=round(Duration,2) orginal query: index=epp-prd-clc variable="ap" virginal="ssc" (prodct="$eppProduct$") OR site="$eppProduct$") deposit="calp" |eval Deposit=upper(deposit) |timechart avg(duration) as Duration |eval Duration=round(Duration,2)

Vani_26 · ‎05-26-2023

Below is my original xml code for dashboard. from the panel of EPP TimeZone , i have modified the query using tstats, query is working fine, but when i compare with original xml code query i am not able to pass tokens ((prodct="$eppProduct$") OR site="$eppProduct$")) in my tstats query. can anyone please help on this. <form> <label>EPP Mode Dashboard</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="eppProduct" searchWhenChanged="true"> <label>Product</label> <fieldForLabel>all_product</fieldForLabel> <fieldForValue>all_product</fieldForValue> <search> <query> |tstats count where index=epp-prd-clc by site host host_ip |eval prodct= case(like(host, "%prod%"), "PROD", like(host, "%pat%"), "PAT", like(host, "%sit%"), "SIT", like(host, "%dev%"), "DEV") |stats count by site prodct |eval all_product=if(like(prodct, "PROD"), site, prodct)</query> <earliest> -4h@h </earliest> <latest>now</latest> </search> <default>*</default> <intialValue>*</intialValue> <choice value="*"> ALL </choice> </input> <input type="time" token "eppTime" searchWhenChanged="true" <label>Time</label> <default> <earliest> -60m@m </earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>EPP TimeZone</title> <chart> <title> Average Response Time</title> <search> <query> index=epp-prd-clc variable="ap" virginal="ssc" (prodct="$eppProduct$") OR site="$eppProduct$") deposit="calp" |eval Deposit=upper(deposit) |timechart avg(duration) as Duration |eval Duration=round(Duration,2)</query> <earliest> $eppTime.earliest$ </earliest> <latest>$eppTime.latest$</latest> </search> <option nmae="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle </option> <option nmae="charting.axisLabelsX.majorLabelStyle.rotation">0 </option> <option nmae="charting.chart"> line </option> <option nmae="charting.chart.nullValueMode"> zero </option> <option nmae="charting.chart.showDataLabels">minmax </option> <option nmae="charting.drilldown>all </option> <option nmae="charting.layout.splitSeries"> 1 </option> <option nmae="referesh.display"> none </option> </chart> </panel> </row> </form> below is the modified xml dashboard code using tstats. <form> <label>EPP Mode Dashboard</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="eppProduct" searchWhenChanged="true"> <label>Product</label> <fieldForLabel>all_product</fieldForLabel> <fieldForValue>all_product</fieldForValue> <search> <query> |tstats count where index=epp-prd-clc by site host host_ip |eval prodct= case(like(host, "%prod%"), "PROD", like(host, "%pat%"), "PAT", like(host, "%sit%"), "SIT", like(host, "%dev%"), "DEV") |stats count by site prodct |eval all_product=if(like(prodct, "PROD"), site, prodct)</query> <earliest> -4h@h </earliest> <latest>now</latest> </search> <default>*</default> <intialValue>*</intialValue> <choice value="*"> ALL </choice> </input> <input type="time" token "eppTime" searchWhenChanged="true" <label>Time</label> <default> <earliest> -60m@m </earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>EPP TimeZone</title> <chart> <title> Average Response Time</title> <search> <query> |tstats avg(duration) as Duration where index=epp-prd-clc TERM(variable) TERM("ap")TERM(virginal) TERM("ssc") TERM(deposit) TERM("calp") BY PREFIX(deposit:) _time |rename deposit: as Deposit |eval Deposit=upper(deposit) |timechart |eval Duration=round(Duration,2)</query> <earliest> $eppTime.earliest$ </earliest> <latest>$eppTime.latest$</latest> </search> <option nmae="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle </option> <option nmae="charting.axisLabelsX.majorLabelStyle.rotation">0 </option> <option nmae="charting.chart"> line </option> <option nmae="charting.chart.nullValueMode"> zero </option> <option nmae="charting.chart.showDataLabels">minmax </option> <option nmae="charting.drilldown>all </option> <option nmae="charting.layout.splitSeries"> 1 </option> <option nmae="referesh.display"> none </option> </chart> </panel> </row> </form>

Vani_26 · ‎03-15-2023

Hi @PickleRick i tried sum(count) but its not coming. no values are displaying under count

Vani_26 · ‎03-15-2023

Query: index=xxx application_code=mobile NOT feature |stats count by code message |sort -count |eval message-substr(message, 1, 40) output: code message count mobile-job-115 application error occured 100 mobile-app-180 application is stable 240 app-job-800 information good 34 project-job-100 system error occured 10 project-job-100 system error occured 20 project-job-100 system error occured 34 project-job-100 system error occured 23 project-job-100 system error occured 50 expected output: code message count mobile-job-115 application error occured 100 mobile-app-180 application is stable 240 app-job-800 information good 34 project-job-100 system error occured 137 i want to get my table display count as one value for similar messages like for example(system error occured) as shown above.

Vani_26 · ‎03-06-2023

Hi @bowesmana, i have created the query, and i have created a new summary index in indexs.conf Now what i should create a report and now how i can send the send data to summary index, Do i need to add like collect at the end of my query?? Do i need to create a 2 reports one for daily and that daily data need to be added in summary index?? I am completely new to this part, not sure how to make the connection between my query and summaryindex.

Vani_26 · ‎02-27-2023

I have a dashboard which contains 5 panels in table format. Query for panel1: index=xxxx sourcetype=xxxxx stroage_name=CompleteTransactions |table Description application _time count streamstats current=f window=1 values( Description) as desp values(application) as app values(_time) as totaltime values (count) as totalcount |eval siml=if(application == app AND Description == desp, count - totalcount,0) |where siml > 0 |stats sum(siml) as totalrequest by application output: Description application _time count ampt.gc.com ampt-portal 2023-01-16 14:00:56.456 100 ampt.gc.com ampt-login 2023-01-16 12:00:56.400 20 ampt.gc.com ampt-clientid 2023-01-16 11:00:36.406 50 Similar to panel 1 query we have other 4 panels with different field names. The task is i need to get the output of 5 panels into a summary index. Retention period to 60 days query need to run for every 24 hours So need to create a report for everyday for last 24 hours and need to create report to collect everydata into summary index. so that if they search for last 60 days data should display. how can i do this

Vani_26 · ‎02-27-2023

@bowesmana , Excellent!!!! It worked, thank you

Vani_26 · ‎02-26-2023

Need a dropdown and when i select one option only that related panels should display rest all panels should not display. i have 7 panels(panel1, panel2.......panel7), i need to have one dropdown with 3 options(appID, appname, appdetails) options in it. if i select appID from the dropdown, 3 panels should display(panel1, panel2 and panel3) if i select appname from the dropdown, 2 panels should display(panel4, panel5) if i select appdetails from the dropdown, 2 panels should display(panel6, panel7) Please help me on this.

Vani_26 · ‎02-22-2023

i have jira issue collector app in splunk and inputs also added we can see logs as well. here it was with only one project with index=jirarequest Now i modified the JQL query in the inputs to get data from 2 projects, the JQL query i used is: project%20in(MMAAS%2CBBAT)%20AND%20updated%3E-2h But now after updating the JQL query with 2 projects i am not able to see the data from second project i.e CBBAT. Do i need to modify or update anywhere else, i am not sure.

Vani_26 · ‎02-08-2023

Hi, I have 10 hosts, from this only 3 hosts are reporting to DS and 7 are not reporting. when i searched with _internal i could see only 3 hosts logs are coming in. How to troubleshoot further on this issue??

Vani_26 · ‎02-01-2023

Thank you @richgalloway it worked

Vani_26 · ‎01-31-2023

hi @richgalloway 1. What does the current query give you? Is the offer field indexed? No offrer field is not an index field. 2. When i tried to use the below query i am getting the output as: |tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by host_ip host_ip count 11.56.67.12 45 11.56.67.14 56 But i am not expecting this output.

Vani_26 · ‎01-31-2023

Query: |tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) i want to get the count of each source by host_ip as shown below. output: source 11.56.67.12 11.56.67.15 11.56.67.18 11.56.67.19 /app/clts/shift.logs 987 67 67 89 /apps/lts/server.logs 45 45 67 43 /app/mts/catlog.logs 89 89 65 56 /var/http/show.logs 12 87 43 65

Vani_26 · ‎01-28-2023

@yuanliu What you said is correct, but when i use tstats i am getting avg of plantime but not matching the count with original query. As per my knowledge, when i run a tstats query if the field is not an index time field it will throw error and not show any results. But here i am getting the results but avg of plantime is not matching. if i am getting results means the plantime is indextime field right?

Vani_26 · ‎01-25-2023

Hi all when i run my original query i am getting one result and when i execute the same query using tstats i am getting different output. AVG IS NOT MATCHING. how to modify the query to match the count. my original query: index=apl-cly-sap sourcetype=cly:app:sap |search processName="applicationstatus" |stats avg(plantime) output: 1233.43223454 tstats query: |tstats count where index=apl-cly-sap sourcetype=cly:app:sap TERM(processName=applicationstatus) by PREFIX(plantime=) |rename plantime= as Time |stats avg(Time) output: 1345.7658755

Vani_26 · ‎01-17-2023

Hi@yeahnah Actually data was coming correctly using tstats byt the issue was with prefix .the data is displaying by prefix. now i corrected it by using your suggested query. thank you for your help. |tstats count where index=app-clietapp host=ahnbghjk OR host=ncsjnjsnjn sourcetype=app-clientapp source=/opt/splunk/var/clientapp/application.log by PREFIX(status:) |rename status: as App_Status |where isnotnull(App_Status) | eval Success=if(App_Status=0, count, Success), Error=if(App_Status!=0, count, Error) |filldown |stats count by Success, Error |eval Total_Count= Success+Error |fields Success Error Total_Count |eval SuccessPer=( Success/Total_Count) * 100 |eval SuccessPercentage=round(SuccessPer,2) |table SuccessPercentage

Vani_26 · ‎01-16-2023

Hi @yeahnah let me tell you the original one: my orginal query: index=app-clietapp host=ahnbghjk OR host=ncsjnjsnjn sourcetype=app-clientapp source=/opt/splunk/var/clientapp/application.log by PREFIX(status:) |rename status: as App_Status |where isnotnull(App_Status) |eval Sucess=if(App_Status="0" OR App_Status="", "Succ", null()) |eval Error=if(App_Status!="0", "Error", null()) |stats count(Sucess) as Sucess_Count count(Error) as Error_Count count(App_Status) as Total_Count |eval SuccessPer=( Sucess_Count/Total_Count) * 100 |eval SuccessPercentage=round(SuccessPer,2) |table SuccessPercentage OUTPUT: SuccessPercentage 100.00 tstats query: |tstats count where index=app-clietapp host=ahnbghjk OR host=ncsjnjsnjn sourcetype=app-clientapp source=/opt/splunk/var/clientapp/application.log by PREFIX(status:) |rename status: as App_Status |where isnotnull(App_Status) |eval Sucess=if(App_Status="0" OR App_Status="", "Succ", null()) |eval Error=if(App_Status!="0", "Error", null()) |stats count(Sucess) as Sucess_Count count(Error) as Error_Count count(App_Status) as Total_Count |eval SuccessPer=( Sucess_Count/Total_Count) * 100 |eval SuccessPercentage=round(SuccessPer,2) |table SuccessPercentage OUTPUT: SuccessPercentage 50.00 When i use orginal query i am gettting output as 100%, but when i use tstats query i am getting 50% as output. can you please help on this.

Vani_26 · ‎01-16-2023

Hi, My query: |tstats count where index=app-clietapp host=ahnbghjk OR host=ncsjnjsnjn sourcetype=app-clientapp source=/opt/splunk/var/clientapp/application.log by PREFIX(status:) |rename status: as App_Status |where isnotnull(App_Status) |eval Sucess=if(App_Status="0" OR App_Status="", "Succ", null()) |eval Error=if(App_Status!="0", "Error", null()) output: App_Status count Error Sucess 0 767890 Succ 6789 65 Error But i want the output as shown below: App_Status Error Sucess 6789 65 767890 please let me know how to modify the query so that i can get the required output.

Posts	68
Solutions	0
Karma Given	13
Karma Received	2
Member Since	‎07-29-2022

Online Status	Offline
Date Last Visited	yesterday

how to suppress alerts during holidays

How to get the 0 data rows using tstats query?

How to pass token in dashbaord

Search to Consolidate similar messages into one?

How to create summary index?

Need a dropdown and when i select one option only ...

Jira Issue Collector app in splunk- Do I need to u...

Why is UF not reporting to DS?

How to get count of each source by IP ?

How to use tstats in search?

how to suppress alerts during holidays

How to get the 0 data rows using tstats query?

Re: How to pass token in dashbaord

How to pass token in dashbaord

Re: Query to Consolidate similar messages into one

Search to Consolidate similar messages into one?

Re: Need to create summary index

How to create summary index?

Re: dashboard drop down

Need a dropdown and when i select one option only ...

Jira Issue Collector app in splunk- Do I need to u...

Why is UF not reporting to DS?

Re: How to get count of each source by IP ?

Re: How to get count of each source by IP ?

How to get count of each source by IP ?

Re: Help with using tstats in search

How to use tstats in search?

Re: Need a table format data

Re: Need a table format data

How to table format data?