Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Siri9996
Siri9996
Engager
Member since:
04-24-2023
10-05-2023
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-24-2023 |
Activity Feed
- Posted Re: To pick dynamic Date value and add as filter in query on Splunk Search. 05-18-2023 03:59 AM
- Posted Re: To pick dynamic Date value and add as filter in query on Splunk Search. 05-17-2023 05:34 PM
- Posted Re: To pick dynamic Date value and add as filter in query on Splunk Search. 05-17-2023 05:30 PM
- Posted Re: To pick dynamic Date value and add as filter in query on Splunk Search. 05-17-2023 12:35 AM
- Posted Re: To pick dynamic Date value and add as filter in query on Splunk Search. 05-16-2023 09:46 PM
- Posted How to pick dynamic date value and add as filter in query? on Splunk Search. 05-16-2023 09:00 PM
- Posted Calling Splunk API to run a query and generate a report 3 hours after it is called? on Other Usage. 04-24-2023 07:43 AM
- Tagged Calling Splunk API to run a query and generate a report 3 hours after it is called? on Other Usage. 04-24-2023 07:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-18-2023
03:59 AM
Hi @yuanliu Missed this reply of yours. Thanks a lot. i have extracted the field and gave the value that i want.
... View more
05-17-2023
05:34 PM
Hi @yuanliu Hope I am clear. Any leads would be of great help here. I have mentioned about the other way I tried. I am fine with either ways if its working.
... View more
05-17-2023
05:30 PM
Hi All, Any leads will be of great help
... View more
05-17-2023
12:35 AM
hey, thanks for your response. So this sourcetype scrapes data from our AWS console. AWS console displays data for last 10 days and this data is pused to splunk as is. When i make use of this source i get details of all resources that were present for past 10 days along with its creation date. I dont want anything except yesterdays date and if i want to manually load up and put 2023-05-17 i will only get results of that particular day because date is also part of the log thats getting pushed. Now i have to automate it and i need dynamic value to be printed as a search filter like mentioned above. Thanks, Siri
... View more
05-16-2023
09:46 PM
OR I tried another way. When i created dashboard and called the $date$ value in my query it worked. So, I changed it to report and called the field in the query that is part of ref="EMR-test report". I just added $date$ in the query that is part of report. But somehow its not picking. please let me know if I am missing anything here. <form version="1.1"> <search> <query>| makeresults| eval today = strftime(relative_time(now(), "-1d@d"), "%Y-%m-%d")|fields - relative_time</query> <done> <set token="defaut_time">$result.today$</set> </done> </search> <fieldset submitButton="false" autoRun="true"> <input type="text" token="date"> <label>date</label> <default>$defaut_time$</default> </input> </fieldset> <row> <panel> <table> <search ref="EMR-test report"></search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>
... View more
05-16-2023
09:00 PM
HI Team,
I am posting only part of the query to avoid confusion. the sourcetype logs data for past 10 days everyday I search for it because thats how its designed and I am fine with it. However, I want to filter only for yesterdays date for another purpose and want to use the same source. If I simply put 2023-05-16 as a filter in my search query I can get the data but I want to automate it to fetch results everyday and every day I run, it should by default take yesterdays value. I simple want to print the value of result.yesterday in my search query like how i can mention 2023-05-16. Could you please let me know how I can achieve this?
| makeresults | eval yesterday = strftime(relative_time(now(), "-1d@d"), "%Y-%m-%d")|fields - relative_time $result.yesterday$ search index=infra source=*emr* sourcetype="aws:description" source="*emr_clusters" account_id="a0087" | dedup Id | rename Name as cluster_name, Id as JobFlowId Status.Timeline.CreationDateTime as cluster_creation_on, Status.Timeline.ReadyDateTime as cluster_ready_on, Status.Timeline.EndDateTime as cluster_terminate_on
Thanks in advance
... View more
Labels
- Labels:
-
field extraction
04-24-2023
07:43 AM
Hi All, There is a requirement where a temporary cluster has to trigger Splunk API to run a command and generate a report. This cluster will have to trigger Splunk API right before it gets terminated. However, the Splunk API after called should only run 3 hours after its triggered and once the report is generated, the report should be sent via email and the process should be ended(Only once and not recurring every 3 hours). This is because there is one log as part of that command which gets pushed 3 hours after the temporary cluster is terminated.(The data is not real-time). I only have this option to automate because the call should be made by a cluster which is ready for termination only. So how can I schedule a search to run 3 hours after its triggered to generate an report as an email? Please let me know if there are any better options to achieve this. Much awaiting for the suggestions. Thanks in Advance.
... View more
Labels
- Labels:
-
Other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-05-2023
12:02 PM
|
