Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pp3295
pp3295
Explorer
Member since:
08-10-2022
01-14-2023
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 08-10-2022 |
Activity Feed
- Posted Re: splunk dashboard index auto refresh / resync issue on Splunk Search. 01-12-2023 03:40 AM
- Posted Re: splunk dashboard index auto refresh / resync issue on Splunk Search. 01-11-2023 09:15 PM
- Posted Re: splunk dashboard index auto refresh / resync issue on Splunk Search. 01-11-2023 04:40 AM
- Posted Can I resolve this splunk dashboard index auto refresh / resync issue? on Splunk Search. 01-10-2023 11:15 PM
- Tagged Can I resolve this splunk dashboard index auto refresh / resync issue? on Splunk Search. 01-10-2023 11:15 PM
- Tagged Can I resolve this splunk dashboard index auto refresh / resync issue? on Splunk Search. 01-10-2023 11:15 PM
- Tagged Can I resolve this splunk dashboard index auto refresh / resync issue? on Splunk Search. 01-10-2023 11:15 PM
- Posted Re: fix date format to extracted eval field on Getting Data In. 08-10-2022 04:48 AM
- Posted Re: fix date format to extracted eval field on Getting Data In. 08-10-2022 04:06 AM
- Posted Re: fix date format to extracted eval field on Getting Data In. 08-10-2022 03:18 AM
- Posted Re: fix date format to extracted eval field on Getting Data In. 08-10-2022 03:02 AM
- Posted How to fix date format to extracted eval field? on Getting Data In. 08-10-2022 02:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
01-12-2023
03:40 AM
thanks for your reply. Our F:\\Logshipping\\Export\\BAU\ or F:\\Logshipping\\Export\\BAU\ is local shared folder . we are copying files from other vm to this location and we are using admin user
... View more
01-11-2023
09:15 PM
Not using any forwarder, just single Splunk server installation to monitor Local file.
... View more
01-11-2023
04:40 AM
thanks for your reply. What is the difference between the configuration for the BAU file monitoring and the DR file monitoring? pp= actually we have added two local inputs under files and directories. as folder continuous monitor and created two different index as index_bau, index_dr for them and assigned to them. Are the new events available from the search and reporting app, just not in the dashboard table? pp= in search we are also not getting new events, for populate new events we have to delete existing index and re-create , then search and dashboard shows new events. Do you get the new events if you refresh the browser window? pp= after browser refresh , index not refreshed, we are using splunk on windows 10
... View more
01-10-2023
11:15 PM
hi all,
we are creating one dashboard having two tables , in that we have set different folder locations for monitoring.
BAU table 1 query = source="F:\\Logshipping\\Export\\BAU\\*" host="FinIQDB-DR" index="index_bau" EP_ER_QuoteRequestId= * EP_ER_QuoteRequestId != "EP_ER_QuoteRequestId"| dedup EP_ER_QuoteRequestId| table EP_ER_QuoteRequestId, orderStatus,EP_ExternalOrderId,ER_Created_At,ER_Created_By,EP_Order_Requested_At,EP_Order_Response_At,ER_Type,EP_ordertype,ER_UnderlyingCode,ER_LimitPrice1,ER_LimitPrice2,ER_LimitPrice3 ,source
DR table 2 query = source="F:\\Logshipping\\Export\\DR\\*" host="FinIQDB-DR" index="index_dr" EP_ER_QuoteRequestId= * EP_ER_QuoteRequestId != "EP_ER_QuoteRequestId"| dedup EP_ER_QuoteRequestId| table EP_ER_QuoteRequestId, orderStatus,EP_ExternalOrderId,ER_Created_At,ER_Created_By,EP_Order_Requested_At,EP_Order_Response_At,ER_Type,EP_ordertype,ER_UnderlyingCode,ER_LimitPrice1,ER_LimitPrice2,ER_LimitPrice3 ,source
** Screenshot
1. We are getting updated records in BAU table ,whenever file is updated into folder
2. We are not able to get updated records in DR table , when file is updated, in that case we have to
delete an index and re-create it . then new records are populated in the grid.
thanks.
... View more
Labels
- Labels:
-
other
08-10-2022
04:48 AM
thanks bhai ( bro ), its working. showing values I am new to splunk, learning from this forum and youtube. do you know any good channels for splunk learning.
... View more
08-10-2022
04:06 AM
thanks for your reply. i think problem is when i individually use table sent_date , i found blank rows. because of this solution is not working. can we omit blank rows .
... View more
08-10-2022
03:18 AM
index="indnewwrapper" | search rfq_id: | join [ search index="indnewwrapper" | search rfq_id: | eval validateEmailMessagecomplete=if(like(_raw,"%validateEmailMessage()%"), sent_date,"1980-01-01 12:00:00.000") ] | eval validateEmailMessagecomplete1=strptime(validateEmailMessagecomplete,"%A %B %d %Y %I:%M:%S %p %Z") | table pRFQ_Id,validateEmailMessagecomplete,validateEmailMessagecomplete1
... View more
08-10-2022
03:02 AM
checked by your way. still now luck. But thanks for your support.
... View more
08-10-2022
02:18 AM
index="indnewwrapper" | search rfq_id:
| join [ search index="indnewwrapper" | search rfq_id:
| eval validateEmailMessagecomplete=if(like(_raw,"%validateEmailMessage()%"), sent_date,"1900-01-01 12:00:00.000") ]
| eval validateEmailMessagecomplete1=strftime(strftime(validateEmailMessagecomplete,"%A %B %d %Y %I:%M:%S %p %Z"),"%Y-%m-%d %H:%M:%S")
| table pRFQ_Id,validateEmailMessagecomplete,validateEmailMessagecomplete1
I am finding a string in a search and extracting a validateEmailMessagecomplete date. using like function.
i am getting desired output but i am not able to change to datetime format validateEmailMessagecomplete1 it shows blank value
i searched various post on the forum. but did not found desired solution.
... View more
Labels
- Labels:
-
field extraction
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-14-2023
05:44 AM
|
