Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About venugoski
venugoski
Explorer
Member since:
11-14-2022
01-24-2024
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 11-14-2022 |
Activity Feed
- Posted Re: how to see the data in table command which is showing empty cells on Splunk Search. 01-24-2024 01:36 PM
- Posted how to see the data in table command which is showing empty cells on Splunk Search. 01-11-2024 02:54 PM
- Tagged how to see the data in table command which is showing empty cells on Splunk Search. 01-11-2024 02:54 PM
- Posted Re: How to use the REST API to just run a search and stream the results back? on Splunk Search. 10-25-2023 11:30 AM
- Posted Re: How to use the REST API to just run a search and stream the results back? on Splunk Search. 10-25-2023 11:28 AM
- Posted Re: How to use the REST API to just run a search and stream the results back? on Splunk Search. 10-18-2023 12:05 PM
- Posted modify the saved splunk Alert using api on Security. 10-16-2023 05:35 PM
- Tagged modify the saved splunk Alert using api on Security. 10-16-2023 05:35 PM
- Posted Re: SPlunk queries not returning anything in table on Splunk Search. 09-13-2023 01:16 PM
- Karma Re: SPlunk queries not returning anything in table for richgalloway. 09-13-2023 01:16 PM
- Posted Why are Splunk queries not returning anything in table? on Splunk Search. 09-13-2023 09:44 AM
- Tagged Why are Splunk queries not returning anything in table? on Splunk Search. 09-13-2023 09:44 AM
- Karma Re: What is the difference between rb bucket and db bucket? for richgalloway. 08-18-2023 12:22 PM
- Posted how to get the total each indexer volume size utilization in the indexer cluster of 10 on Monitoring Splunk. 08-09-2023 12:20 PM
- Posted Re: Splunk Indexer Clustering Issues on Installation. 11-28-2022 11:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-24-2024
01:36 PM
hi @inventsekar Thank you , you are right, some events not have that particular "log_processed.message". when i put | spath input=_raw i am seeing the events in table format but also seeing the duplicate events. can we avoid that. index="sample" "log_processed.app"=mercury "log_processed.traceId"=dc57c0b7f0e8cfdee5002b62873f5de7 | spath input=_raw | table _time, log_processed.message
... View more
01-11-2024
02:54 PM
i see the splunk query index="sample" "log_processed.env"=prod "log_processed.app"=sample "log_processed.traceId"=90cf115a05ebb87b2 | table _time, log_processed.message this is displaying the empty messages in a table cell . i could the event in the raw format. do i have any limit to see the whole message in table box .
... View more
- Tags:
- table
Labels
- Labels:
-
table
10-25-2023
11:30 AM
Need help in the splunk api curl query, i am seeing the below error. curl -k -u apiuser:password "https://10.236.141.0:8089/services/search/jobs/export" -d search="search index=address-validation earliest=-15m latest=now source=\"eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;\" | stats dc(kubernetes.pod_name) as pod_count" <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Unbalanced quotes.</msg> </messages> </response> sometimes i dont see the result either: curl -k -u user:password https://10.236.141.0:8089/services/search/jobs/export -d search="search index=address-validation earliest=-15m latest=now source=eventhub://sams-jupiter-prod-wus-logs-premium-1.servicebus.windows.net/address-validation; | stats dc(kubernetes.pod_name) as pod_count" <?xml version='1.0' encoding='UTF-8'?> <results preview='0'> <meta> <fieldOrder /> </meta> <messages> <msg type="INFO">Your timerange was substituted based on your search string</msg> </messages> </results>
... View more
10-25-2023
11:28 AM
Need help in the splunk api curl query, i am seeing the below error.
curl -k -u apiuser:password "https://10.236.141.0:8089/services/search/jobs/export" -d search="search index=address-validation earliest=-15m latest=now source=\"eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;\" | stats dc(kubernetes.pod_name) as pod_count"
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Unbalanced quotes.</msg>
</messages>
</response>
sometimes i dont see the result either:
curl -k -u user:password https://10.236.141.0:8089/services/search/jobs/export -d search="search index=address-validation earliest=-15m latest=now source=eventhub://sams-jupiter-prod-wus-logs-premium-1.servicebus.windows.net/address-validation; | stats dc(kubernetes.pod_name) as pod_count"
"<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
<messages>
<msg type="INFO">Your timerange was substituted based on your search string</msg>
</messages>
</results>"
... View more
10-18-2023
12:05 PM
i am running the below query
curl -k -u user:password https://10.236.142.0:8089/services/search/jobs/export -d search="search index=list-service source="eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;" "kubernetes.namespace_name"="list-service" | stats dc(kubernetes.pod_name) as pod_count"
<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder />
</meta>
</results>
zsh: command not found: kubernetes.namespace_name=list-service | stats dc(kubernetes.pod_name) as pod_count
... View more
10-16-2023
05:35 PM
looking for help in editing the saved Alert query using the api/curl . i would like to change the pod_count 9 to 12 . how can i do that using api/curl alertname = test_goski-list alert query = index=list-service source="eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;" "kubernetes.namespace_name"="list-service" | stats dc(kubernetes.pod_name) as pod_count | where pod_count < 9 i am trying to run the below curl to connect to the search head IP and getting the error response. curl -k -u admin:changeme -X POST https://10.236.140.2:8089/servicesNS/admin/search/alerts/test_goski-list -d "search=index=list-service" <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Not Found</msg> </messages> </response>
... View more
- Tags:
- other
Labels
- Labels:
-
other
09-13-2023
01:16 PM
i dont see the stats coming here with stats command as well index=address-validation RESP_MARKER | rex field=log "\"operationPath\"\:\"(?<path>\w+).*\"operationType\"\:\"(?<type>\w+).*\"region\"\:\"(?<reg>\w+).*" | stats count by path, type, reg
... View more
09-13-2023
09:44 AM
Splunk queries not returning anything in table. I see events matching for these queries but nothing under 'Statistics' section.
1.
index=address-validation RESP_MARKER | rex field=log "\"operationPath\"\:\"(?<path>\w+).*\"operationType\"\:\"(?<type>\w+).*\"region\"\:\"(?<reg>\w+).*" | table path, type, reg
2. index=club-finder RESP_MARKER | rex field=log "\"operationPath\"\:\"\/(?<path>\w+).*\"operationType\"\:\"(?<type>\w+).*\"region\"\:\"(?<reg>\w+).*\"totalTime\"\:(?<timeTaken>\w+)" | table type, path, timeTaken, reg
... View more
- Tags:
- splunk search
- table
08-09-2023
12:20 PM
how to get the total each indexer volume size utilization in the indexer cluster of 10. i have the cluster manager with 10 indexers and like to know is there a way to query from the CM or the dashboard view the volume utilization of each indexer. we don't have the distribution monitoring console setup yet. we have 1 SH cluster with 5 SH 1CM 10 indexers 1 deployer to manage SH cluster
... View more
Labels
- Labels:
-
indexer clustering
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-24-2024
06:51 PM
|
