Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Sekhar
Sekhar
Explorer
Member since:
04-13-2023
2 weeks ago
Community Statistics
| Posts | 33 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-13-2023 |
Activity Feed
- Posted Re: Give space in dashboard query on Splunk Search. 2 weeks ago
- Posted How to give space in dashboard query? on Splunk Search. 2 weeks ago
- Posted Re: SLA calculating on Splunk Search. 3 weeks ago
- Posted How to calculate SLA? on Splunk Search. 3 weeks ago
- Posted How to schedule daily 2pm my dashboard pdf report to email? on Splunk Search. 4 weeks ago
- Posted Re: How to create root search and base serach in dashboard on Splunk Search. 05-04-2023 10:56 PM
- Posted How to create root search and base search in dashboard? on Splunk Search. 05-04-2023 10:39 PM
- Posted Re: How to merge two different index and calculate time for start event and event end? on Splunk Search. 04-20-2023 06:02 AM
- Posted Re: How to merge two different index and calculate time for start event and event end? on Splunk Search. 04-20-2023 04:55 AM
- Posted Re: How to remove double quotes from extracted field values on Splunk Search. 04-20-2023 03:45 AM
- Posted How to remove double quotes from extracted field values on Splunk Search. 04-20-2023 03:23 AM
- Posted Matching field from two different index and source on Splunk Search. 04-20-2023 03:02 AM
- Posted How get _time vaules same format? on Getting Data In. 04-19-2023 01:24 AM
- Posted Re: How to extract matched data from different index and different source based on the fields on Splunk Search. 04-17-2023 11:50 PM
- Posted How to extract matched data from different index and different source based on the fields? on Splunk Search. 04-17-2023 11:20 PM
- Posted Re: Calculate the SLA percentage from start event query and end event query on Splunk Search. 04-17-2023 07:25 PM
- Posted Re: Calculate the SLA percentage from start event query and end event query on Splunk Search. 04-17-2023 07:25 PM
- Posted Re: Extracted common fields from two different events and calculate the diff between the start and end event group my m on Splunk Search. 04-17-2023 08:06 AM
- Posted How to common fields from two different events and calculate the diff between the start and end event group my main? on Splunk Search. 04-17-2023 07:36 AM
- Posted Re: List of manid breaching Authorization SLA on Splunk Search. 04-16-2023 10:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
<input type= drop-down token =field1> <Lable > Env</Lable> < Choice value="_nontest " source="testing source"> TEST</choice> <Choice value=" source="prodsource" >Prod</choice> </Input> My query is like index=abc$field1$ | stats count which testing working fine when I select prod not getting any our and query also i below Index=abcsource="prodsource" | stats count How to give space between index and source while selecting prod .
... View more
2 weeks ago
Have drop down vaules like below
Extual vaul
Index =abc source = abc source
Drop down values like prod lable
Value source =abc source
In query getting like error index=abc source=abc source i required logic for space between index and source
... View more
Labels
- Labels:
-
other
3 weeks ago
my query below
(Index=x source=xtype valid) or (index=y source= ytype passed) | eval which=if(match(_raw, " valid"),"valid", "passed") | stats values( which) as msg by manid | stats count(eval(msg=" valid")) as total_ count count(eval(msg= "passed"))
getting out like total count 54 respons count 58
But i want check this condition too
Eval msgconur = mvcount(msg) | where >1
Need to check duration time > 30 count duration time <30 count
... View more
Labels
- Labels:
-
stats
4 weeks ago
I have created my dashboard . I need to created pdf report of dashboard sent to my email daily 2pm ist.
... View more
Labels
- Labels:
-
other
05-04-2023
10:56 PM
<search ID=" start event"> <Query> index=x source= xtype application=xapps<\quer> I am using base query in plannel Panael Serach base=" start event" Query | status count working fine for panel We have multiple base query index ,source, application same so i need to create one root search for comman search.
... View more
05-04-2023
10:39 PM
We have created base serach query but I required to created root search base on that .
... View more
Labels
- Labels:
-
search job inspector
04-20-2023
06:02 AM
I tried below query index=x source type=xx "saved msg") OR (index=y source type=y " recived msg") | stats values(_time) as time values(actionid) as actionid values(batchid) as batchid by manid | eval duration = max(time) - min(time) | stats count count(eval(duration > 30)) as exceeded Getting result count saved msg and received msg both I required main I'd have multiple saved msg request but We required bothr saved msg and received msg by manid
... View more
04-20-2023
04:55 AM
index= non prod source=test.log "recived msg") OR (index =non-agent source=test1log "acknowledgement msg") | eval which=if(match(_raw, "received msg"), "received", "acknowledged") | stats vaules (_time) as start time as max(_time) as Endtime values(which) as msg by batch Id Getting below result Batchid msg Bid123. Received msg Bid23345. Received msg acknowledged I required the only which batchid having recived msg and acknowledged those count duration> 30 sec
... View more
04-20-2023
03:45 AM
Sample data format {\"studenrinformation\" : \"student577474\", }
... View more
04-20-2023
03:23 AM
Filed extracted like rex field = msg " student information\" : (?<studentname>.*?)," Student name getting like below "Stdent570" "55555sdeend" I want data with our double quotes
... View more
Labels
- Labels:
-
rex
04-20-2023
03:02 AM
I have two event start event having extracted fields from log managerid ,branch I'd,empname using index = emp source = empsource " offer letters" End event having extracted field empid,branch id index= manager source= manager source " relieving letters" I want to get empid who's is taken offer letter and relieving later and duration.
... View more
Labels
- Labels:
-
join
04-19-2023
01:24 AM
My query index= nonjVs source = nonjavs | stats vaules(_time ) as start time values(_time) as endtime by empid
Displayed below formate but I want to see my stat time and end time "%m-%d-%y %H:%M:@%S"
Starttime 165575758474.67768
End time 16777894894.67788
... View more
- Tags:
- splunk-search
Labels
- Labels:
-
time
04-17-2023
11:50 PM
When I excute the start event getting 40 statistics and end event result 43 statistics But when I used append and stats getting 75 statistics. My requirement is matching the mandid for both the events . Then I will calculate the duration from end event to start event . How can I validate by data or query getting correct results
... View more
04-17-2023
11:20 PM
Below two events
Start event
Index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | Rex field =log " manid=(?<mandid>.*?)", | Rex field=log "bid=(?<bid>.*" | Rex field= log " state=(?<state>.*" | Table _time bid,mandid,actionid,state
End event
Index=y sourcetype=yytype source=y "VALIDATION SUCESS" " msg got" | Rex field =msg " manid\:(?<mandid>.*?)", | Rex field=msg "actionid"\:(?<actionid>.*" | Table _time manid actionid
... View more
Labels
- Labels:
-
stats
04-17-2023
08:06 AM
start event | join [ end event] | stats min(_time) as start_time max(_time) as end_time values(actionid) as actionid values(batchid) as batchid by manid | eval duration = (end_time - start_time) | eval excessive = if(duration > 30, duration, null()) | stats count(excessive) as excess_count avg(excessive) as excess_avg by manid But sure about result getting correct or not
... View more
04-17-2023
07:36 AM
We have two events
Start event
Index= x source= xtype | spath application | search application= x app " saved note" RCVD | rex field=" actionid"=(?<actionid>.*)", | Rex field =log " manid=(?<mandid>.*?)", | Rex field=log "bid=(?<bid>.*" | Rex field= log " state=(?<state>.*" | Table _time bid,mandid,actionid,state
End event
Index=y sourcetype=yytype source=y "VALIDATION SUCESS" " msg got" | Rex field =msg " manid\:(?<mandid>.*?)", | Rex field=msg "actionid"\:(?<actionid>.*" | Table _time manid actionid
Calculate different between start event and end event group by manid and count mandates exceeding different above 30sec
... View more
Labels
- Labels:
-
stats
04-16-2023
10:17 PM
Above query i add table but not displayed any thing | Table start_time duration mandid
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
