Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About nicksrulz
nicksrulz
Explorer
Member since:
03-08-2023
07-12-2023
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 03-08-2023 |
Activity Feed
- Posted Need help in displaying results in column on Splunk Search. 07-12-2023 03:27 AM
- Posted How to display data? on Splunk Cloud Platform. 07-12-2023 01:50 AM
- Posted Re: query to get difference of data from current month and previous month on Getting Data In. 03-14-2023 09:43 PM
- Karma Re: query to get difference of data from current month and previous month for ITWhisperer. 03-14-2023 09:32 PM
- Karma Re: query to get difference of data from current month and previous month for bowesmana. 03-14-2023 02:34 AM
- Karma Re: query to get difference of data from current month and previous month for ITWhisperer. 03-14-2023 02:34 AM
- Posted Re: query to get difference of data from current month and previous month on Getting Data In. 03-14-2023 02:33 AM
- Karma Re: query to get difference of data from current month and previous month for ITWhisperer. 03-14-2023 02:33 AM
- Posted Re: query to get difference of data from current month and previous month on Getting Data In. 03-12-2023 11:12 PM
- Posted Search to get difference of data from current month and previous month? on Getting Data In. 03-08-2023 11:05 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-12-2023
03:27 AM
Hi Legends, Need help in displaying start time, when error occurred and end time when it got resolved , in separate column. Currently they are getting displayed in same column like below : status Date Time REASON_CODE FAILED 25/04/2023 25/04/2023 20:33 Z910 FAILED 25/04/2023 25/04/2023 20:11 Z910 FAILED 25/04/2023 25/04/2023 3:38 Z911 FAILED 25/04/2023 25/04/2023 3:37 Z911 FAILED 25/04/2023 25/04/2023 3:37 Z911 FAILED 25/04/2023 25/04/2023 3:36 Z911 Please let me know how can i modify my query to display results like below: Status Date Start Time End Time REASON_CODE Count FAILED 25/04/2023 25/04/2023 20:11 25/04/2023 20:33 Z910 2 FAILED 25/04/2023 25/04/2023 3:36 25/04/2023 3:38 Z911 4 My Query : index=test sourcetype="*" STATUS_REASON_CODE IN (U220, U902, U904, U905, Z704, Z900, Z902, Z903, Z904, Z910, Z911, Z912, Z913, Z914, Z920, Z922, Z923, Z924) STATE = FAILED | fields STATE _time STATUS_REASON_CODE | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS Time | convert timeformat="%Y-%m-%d" ctime(_time) AS TimeDay | eval FailTime=case(field_name="Failure Time", _time) | eval ReasonCode=case(field_name="Reason Code", STATUS_REASON_CODE) | eval State=case(field_name="State", STATE) | eval minTime = (min(Time)) | rename STATUS_REASON_CODE as REASON_CODE | sort - Time | table STATE TimeDay minTime REASON_CODE
... View more
07-12-2023
01:50 AM
Hi Experts,
Need help in displaying data , Currently i am able to display search data as
Status Date Date & Time REASON_CODE FAILED 25/04/2023 25/04/2023 20:33 Z910 FAILED 25/04/2023 25/04/2023 20:11 Z910 FAILED 25/04/2023 25/04/2023 3:38 Z911 FAILED 25/04/2023 25/04/2023 3:37 Z911 FAILED 25/04/2023 25/04/2023 3:37 Z911 FAILED 25/04/2023 25/04/2023 3:36 Z911
using below query : ============================================ index=test sourcetype="*" STATUS_REASON_CODE IN (U220, U902, U904, U905, Z704, Z900, Z902, Z903, Z904, Z910, Z911, Z912, Z913, Z914, Z920, Z922, Z923, Z924) STATE = FAILED | fields STATE _time STATUS_REASON_CODE | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS Time | convert timeformat="%Y-%m-%d" ctime(_time) AS TimeDay | eval FailTime=case(field_name="Failure Time", _time) | eval ReasonCode=case(field_name="Reason Code", STATUS_REASON_CODE) | eval State=case(field_name="State", STATE) | eval minTime = (min(Time)) | rename STATUS_REASON_CODE as REASON_CODE | sort - Time | table STATE TimeDay minTime REASON_CODE ==================================================
Need help in displaying data as :
Status Date Start Time End Time REASON_CODE Count FAILED 25/04/2023 25/04/2023 20:11 25/04/2023 20:33 Z910 2 FAILED 25/04/2023 25/04/2023 3:36 25/04/2023 3:38 Z911 4
Please help in modifying my query.
... View more
- Tags:
- splunk search
Labels
- Labels:
-
using Splunk Cloud
03-14-2023
09:43 PM
@ITWhisperer Thanks for your continuous support , i tried your query and got below output : index="indexName" AND apiName!="" AND apiName=apiName[| makeresults | fields - _time | addinfo | eval row=mvrange(0,2) | mvexpand row | eval earliest=relative_time(info_min_time, "-".row."mon") | eval latest=relative_time(info_max_time, "-".row."mon") | fields earliest latest] | bin _time span=1d | search responseCode!=NULL | stats count as Hits by _time apiName | xyseries apiName _time Hits | rename apiName as "API Name" | foreach 1* [| eval newname=strftime(Hits,"%F") | eval oldname='Hits' | fields - oldname newname] API Name 1676379600 1678798800 apiName 23302 22722 How can i set column names in human readable Variable , instead of numbers ?
... View more
03-14-2023
02:33 AM
@ITWhisperer Wow!!! this is exactly what i needed. Need one more help , both days count are getting store in one variable i.e. Hits, _time and in apiName like below : _time apiName Hits 2023-02-14 apiName 15416 2023-03-14 apiName 16441 How can i segregate in two separate variables? So that i can able to calculate %age increase in Hits. I know i am asking a lot , since i am very new in Splunk. Please help me out .
... View more
03-12-2023
11:12 PM
@ITWhisperer Thanks for your response, I tried your query its giving me earliest and latest time frame. The Ask over here is that I need data i.e. Count of my request on these time frame, for e.g. below query give me total hits of my API : index="index_name" AND apiName!="" AND apiName=API_NAME | search responseCode!=NULL | stats count as Hits by apiName | rename apiName as "API Name" | table Hits Now from time picker if i select 4Hrs , then I want a query which will pull 2 types of data, a.) it will pull the data of last 4 hours from current time i.e. 13/03/2023 11:30 AM to 13/03/2023 03:30 PM b.) it should also pull last month's data for similar timeframe i.e. 13/02/2023 11:30 AM to 13/02/2023 03:30 PM.
... View more
03-08-2023
11:05 PM
Hi Legends,
I want to know is this type of splunk query possible to create?
We want a query which will pull 2 types of data, for ex. I ran a query by selecting time-picker as last 4 hours, so it will pull the data of last 4 hours from current time i.e. 09/03/2023 11:30 AM to 09/03/2023 03:30 PM now along with this data it should also pull last month's data for similar timeframe i.e. 09/02/2023 11:30 AM to 09/02/2023 03:30 PM.
The purpose of this query is to see the Month on Month growth .
... View more
Labels
- Labels:
-
data
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-12-2023
05:21 AM
|
