About DarshanBK

a_kearney · ‎11-10-2023

We had a similar finding from Splunk with high I/O wait time on Search Heads. I have used the folllowing search to monitor index=_introspection sourcetype=splunk_resource_usage component=IOStats | eval avg_wait_ms = 'data.avg_total_ms' | search data.mount_point="/apps/splunk" | eval sla=10 | timechart limit=30 minspan=60s partial=f avg(data.avg_total_ms) as avg_wait_ms max(sla) AS sla by host Use a trellis format (split by host) timechart to dispaly. The sla=10 field is to show the 10ms Splunk recommended limit. I haven't been able to work out why we have high I/O on the Search Heads though, indexer cluster seems to perform OK. The Search Head Captain has notably higher I/O wait compared to others. There has also been issues with KV Store so wondering if that is related. Note: I/O wait time is not a configuration that can be set. It is the result of the operations being carried out on the disk

DarshanBK · ‎08-10-2023

Hi All, I am trying to create a single value panel like below and add tooltip which displays values dynamically. But when i implemented this, the single value panel is disappeared and the output of the mouseover tooltip query is displaying as a panel in splunk as shown below. Below is the source Code. <label>Finance Job Status Clone</label> <row> <panel id="panel1"> <title>Functional Area</title> <search> <query>| makeresults | eval FA="HR and Finance ACN"</query> <earliest>-15m</earliest> <latest>now</latest> </search> <html id="htmlToolTip1" depends="$tokToolTipShow1$">  <style> #htmlToolTip1{ margin:auto !important; width: 20% !important; } </style> <div class="tooltip fade top in"> <div class="tooltip-arrow"/> <div class="tooltip-inner">$tokToolTipText1$</div> </div> </html> <table> <search> <query>*Search query*</query> <earliest>1691485200</earliest> <latest>1691658000</latest> <done> <set token="tokToolTipText1">$result.Job$</set> </done> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard> In the above sourcecode, the output of the striked over query should appear as a dashboard panel(first screenshot) and the out put of the second search query should be appeared when we hover over that panel. Could someone please suggest whats wrong in the above code.?

sathwik067 · ‎05-23-2023

Hi @DarshanBK, if you are running Linux, your Linux team can make this change, there is nothing you can do on the Splunk end. To see the MTU value you can run "ifconfig" command and it will give you the output of this MTU value along with some other information about the server and the mounts it has.

gcusello · ‎04-04-2023

Hi @DarshanBK, when you say ten rows are you meaning ten rows of each event or only ten events? if the event's I'm not sure that's possible. If you mean ten rows of each event, you can configurate the TRUNCATE parameter in props.conf to take only the first X chard of each event. if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 Ciao. Giuseppe

PickleRick · ‎11-30-2022

You can use spath to "pick out" separate parts of the main json. This way you can do a multivalued field with the "subjsons". Something akin to this (run anywhere example): | makeresults | eval json="{\"a\":[{\"b\":\"c\"},{\"b\":\"e\"}]}" | spath input=json path="a{}" output=a | mvexpand a | spath input=a This is of course a very simple json but you can similarily "untangle" much more complicated structures so you get each substructure into a separate event.

johnhuang · ‎11-16-2022

| eval Count=LOWER(Count) | fillnull value="0m" Count | eval {Year}=Quarter." ".Count | stats max(20*) AS 20* BY Quarter | sort -Quarter | table 20* With test data: | makeresults | eval data="2021,Q4,2m;2021,Q3,1m;2021,Q2,2m;2021,Q1,;2022,Q4,5m;2022,Q3,7m;2022,Q2,8m;2022,Q1,5m" | eval data=split(data, ";") | mvexpand data | rex field=data "(?<Year>\d+)\,(?<Quarter>\w+)\,(?<Count>\w+)?" | table Year Quarter Count | eval Count=LOWER(Count) | fillnull value="0m" Count | eval {Year}=Quarter." ".Count | stats max(20*) AS 20* BY Quarter | sort -Quarter | table 20*

richgalloway · ‎11-08-2022

When something is not working correctly, turning it off and on again often is the fix. Try restarting one indexer to see if it then starts reporting the right diskspace.

Posts	12
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎11-07-2022

Online Status	Offline
Date Last Visited	‎08-10-2023 11:02 AM

How to add a dynamic tooltip to a panel on a mouse...

How to configure wait time on search heads and ind...

Why isn't my Transforms.conf working as expected?

How to merge and map two splunk multi value fields...

How to split single column into muliple columns an...

Splunk indexers diskpace mismatch in monitoring co...

Re: How to configure wait time on search heads and...

How to add a dynamic tooltip to a panel on a mouse...

Re: We are building a new indexer cluster and gett...

Re: Transforms.conf not working as expected

Re: How to merge and map two splunk multi value fi...

Re: How to split single column into muliple column...

Re: Splunk indexers diskpace mismatch in monitorin...