Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About AjayTakur
AjayTakur
Loves-to-Learn Everything
Member since:
04-19-2023
05-04-2023
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-19-2023 |
Activity Feed
- Posted Re: How to trigger an custom alert condition of multiples from the basic search of Splunk? on Splunk Search. 05-04-2023 04:30 AM
- Posted Re: How to trigger an custom alert condition of multiples from the basic search of Splunk? on Splunk Search. 05-04-2023 03:59 AM
- Posted Re: How to trigger an custom alert condition of multiples from the basic search of Splunk? on Splunk Search. 05-04-2023 02:58 AM
- Posted Re: How to trigger an custom alert condition of multiples from the basic search of Splunk? on Splunk Search. 05-04-2023 01:02 AM
- Posted How to trigger an custom alert condition of multiples from the basic search of Splunk? on Splunk Search. 05-03-2023 08:53 AM
- Posted How to separate out basic search of Splunk in two different columns? on Splunk Search. 04-26-2023 12:34 PM
- Posted How to fetch transactions that do not have a completed events? on Splunk Search. 04-24-2023 11:19 AM
- Posted Re: Finding events immediately following/preceding another event on Splunk Search. 04-20-2023 10:20 AM
- Posted How to find events immediately following/preceding another event? on Splunk Search. 04-19-2023 11:27 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-04-2023
04:30 AM
Could you provide me with the query using option 2..
... View more
05-04-2023
03:59 AM
The trigger condition is DCOEtransfercount=1 AND NDNCopycount=1 Search query is ...
| append [search index="pd" "successful" "notif/output/"
| stats count as DtransferCount by _raw
| fields DtransferCount
| rename _raw as Dtransfer]
| append [search index="pd" "SBID=nr" "DM" "PAM=sende" "notif/archive/"
| stats count as DMCopyCount by _raw
| fields DMCopyCount
| rename _raw as DMCopy] Results are:
... View more
05-04-2023
02:58 AM
By putting the trigger criteria in the search <<your search>> | where (DCOEtransfercount=1 AND NDNCopycount=1) is also getting events irrespective of whether the value is 1/2/3 for both the DCOEtransfercount AND NDNCopycount. It seems that the where a condition is not working.
... View more
05-04-2023
01:02 AM
By changing "and" to "AND" in the trigger condition does not work. since I assume the table has multiple rows each for DCOEtransfercount & NDNCopycount. hence it is not working. how do those two conditions together make it work with different rows?
... View more
05-03-2023
08:53 AM
I am new to Splunk and facing an issue while setting up the custom alert. The results as shown in Table 1. I have tried the one which is highlighted in red color below is not working. How do I configure for both of the values ie., DCOEtransfercount and NDMCopycount? Note: Ignore the DCOEtransfercount and NDMCopycount labels in both of the tables.
... View more
04-26-2023
12:34 PM
I am new to Splunk and facing an issue in separating out the two columns of the query. I tried with the below query and found the results as shown below in table1
...|
append [search index="pd" "successful" "notif/output/" | stats count by _raw |fields count | rename _raw as Dtransfer] |
append [search index="pd" "SBID=nr" "DM" "PAM=sende" "notif/archive/" | stats count by _raw |fields count | rename _raw as DMCopy]
How do I achieve the expected result shown in Table 2? I need to display two separate columns DtransferCount and DMCopyCount
... View more
04-24-2023
11:19 AM
How should I fetch those events "started" that are present in the Splunk log and those events "completed" will be not available?
... | transaction build_number,type startswith="started" ..... what needs to be wrote here
... View more
Labels
- Labels:
-
field extraction
-
fields
-
join
-
lookup
-
metadata
-
stats
-
transaction
04-20-2023
10:20 AM
for two different events ie., started and successful the successful might not be an event happening after started then, in this case, is this search criteria correct? index=a source=b | transaction startswith=MIT="Local Step started." endswith=MIT="Copy step successful." keepevicted=true | search closed_txn=0
... View more
04-19-2023
11:27 AM
I have to search for events
I have one event let's say MIT=" step started" and another event says MIT=" step completed"
Now I have to ensure that both events have been included in my search criteria in such a way that
Case 1:The first event is started the second event will get completed.
Case 2: If the first event is not started then the second event will also not be complete. Considering these conditions I need search criteria.
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-04-2023
12:54 PM
|
