Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About devsru
devsru
Explorer
Member since:
08-03-2023
2 weeks ago
Community Statistics
| Posts | 34 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-03-2023 |
Activity Feed
- Posted Re: How to send hard coded message as an email from Splunk on Splunk Search. a month ago
- Posted How to send hard coded message as an email from Splunk on Splunk Search. a month ago
- Posted How to pass multiple fields in Case or IF commands on Splunk Search. 09-04-2024 06:45 PM
- Tagged How to pass multiple fields in Case or IF commands on Splunk Search. 09-04-2024 06:45 PM
- Tagged How to pass multiple fields in Case or IF commands on Splunk Search. 09-04-2024 06:45 PM
- Posted Re: Setup an alerts with events from Timestamp format on Splunk Search. 07-01-2024 07:37 AM
- Posted Setup an alerts with events from Timestamp format on Splunk Search. 07-01-2024 06:34 AM
- Posted Splunk OTEL Collector throwing Timeout and Authentication error. on Getting Data In. 09-26-2023 07:54 AM
- Tagged Splunk OTEL Collector throwing Timeout and Authentication error. on Getting Data In. 09-26-2023 07:54 AM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-10-2023 06:05 AM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-10-2023 12:55 AM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-09-2023 11:54 PM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-09-2023 11:13 PM
- Karma Re: How to change color of a Panel based on String for ITWhisperer. 08-09-2023 08:10 AM
- Posted Re: How to add two Splunk queries output in Single Panel on Splunk Search. 08-09-2023 08:09 AM
- Posted Re: How to add two Splunk queries output in Single Panel on Splunk Search. 08-09-2023 07:48 AM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-09-2023 07:45 AM
- Posted Re: How to add two Splunk queries output in Single Panel on Splunk Search. 08-09-2023 07:43 AM
- Posted Re: How to change color of a Panel based on String on Splunk Search. 08-09-2023 07:31 AM
- Posted Re: How to add two Splunk queries output in Single Panel on Splunk Search. 08-09-2023 07:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
a month ago
Thanks for the query. I need to send an alert a day before daylight savings in europe i.e Sun, Mar 30, 2025 – Sun, Oct 26, 2025 Could you please tell me how to update this query. Lets say run at 2 PM the day before with the message.
... View more
a month ago
Hi Everyone, I need to send a hard coded message to the users just before every daylight savings of the year saying "Daylight savings is scheduled tomorrow, please be alerted " and i don't want to use any index for the that but just hard coded message. Is it possible to create an alert based on the requirement.
... View more
09-04-2024
06:45 PM
Hi Everyone,
I have some events with the field Private_MBytes and host = vmt/vmu/vmd/vmp
I want to create a case when host is either vmt/vmu/vmd and Private_MBytes > 20000 OR when host is vmp and Private_MBytes > 40000 then it should display the events with severity_id 4. Example
eval severity_id=if(Private_MBytes >= "20000" AND host IN [vmd*,vmt*,vmu*],4,2)
eval severity_id=if(Private_MBytes >= "40000" AND host ==vmp*,4,2)
Note : if Private_MBytes > 40000, and then if there is any vmd/vmu/vmt it should display severity_id 4 only and for vmp also.
... View more
07-01-2024
07:37 AM
Thanks for your answer but in my case _time may only appear once in 2 days when we have a new update and incident resolve state change to true. Can we do something that my startDateTime checks with the latest time of the scheduled alert and raise an alarm if it is more than 4 hours ?
... View more
07-01-2024
06:34 AM
Dear All, I want to setup an alert in an event. The event contains three timestamps, New Event time, Last update, and startDate time. So these are the logs coming from MS365. I want the Alert if one of the field "Incident Resolved = False" is satisfied even after 4 hours of startDate time. So we receive first event at startDate but we don't want an alert until 4 hours of startDate . startDateTime: 2024-07-01T09:00:00Z
... View more
Labels
- Labels:
-
eval
-
field extraction
-
regex
-
stats
09-26-2023
07:54 AM
We are seeing some Timeout and Authentication error while collecting data from OTEL kubernetes collector through HEC, Could anyone please let me know if there is a need to change limits in config files. Below are the errors 2023-09-26T14:47:17.613Z info exporterhelper/queued_retry.go:433 Exporting failed. Will retry the request after interval. {"kind": "exporter", "data_type": "metrics", "name": "splunk_hec/platform_metrics", "error": "Post \"https://xyz:8088/services/collector\": net/http: request canceled (Client.Timeout exceeded while awaiting headers)", "interval": "2.769200676s"} 2023-09-26T14:47:11.590Z error exporterhelper/queued_retry.go:401 Exporting failed. The error is not retryable. Dropping data. {"kind": "exporter", "data_type": "metrics", "name": "splunk_hec/platform_metrics", "error": "Permanent error: \"HTTP/1.1 401 Unauthorized\\r\\nContent-Length: 148\\r\\nCache-Control: private\\r\\nConnection: Keep-Alive\\r\\nContent-Type: text/xml; charset=UTF-8\\r\\nDate: Tue, 26 Sep 2023 14:47:11 GMT\\r\\nServer: Splunkd\\r\\nVary: Authorization\\r\\nX-Content-Type-Options: nosniff\\r\\nX-Frame-Options: SAMEORIGIN\\r\\n\\r\\n<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?>\\n<response>\\n <messages>\\n <msg type=\\\"WARN\\\">call not properly authenticated</msg>\\n </messages>\\n</response>\\n\"", "dropped_items": 31}
... View more
- Tags:
- hec
Labels
- Labels:
-
data
-
HTTP Event Collector
-
indexer
-
JSON
08-10-2023
06:05 AM
@ITWhisperer That’s exactly what I want to achieve. I need separate panels for each host, then later I can merge them in 2-3 rows accordingly. this is exactly the situation right now in my dashboard but presently I am getting numbers(counts) for each server whereas I just want to display server name. I know it is a small SPL change but I am not able to fix it 😞
... View more
08-10-2023
12:55 AM
@ITWhisperer The requirement is attached. Right now we are displaying count of the Severity (Critical,OK,Medium) of the hosts but requirement is to display servernames. Requirement Present condition
... View more
08-09-2023
11:54 PM
@ITWhisperer This is the final code. There is a base search at top and the panel search query that we have modified together. There will be 20 servers but in the example I am showing only one panel with host = XYZ*. Right now it is displaying correct color but count of total "Severities". I want the same criteria to evaluate the colors but show "server name" instead of "Count" <dashboard version="1.1" theme="dark">
<search id="base_search">
<query>| inputlookup kv_cmdb_as_entity_kpi_lookup WHERE NOT kpi="*~~*" AND host IN (X,Y)
[
search index="itsi_grouped_alerts" kpi=* severity=* entity_name=* earliest=-60m@m
| stats latest(_time) as time latest(severity) as severity by entity_name kpi
| eval host=lower(mvindex(split(entity_name, "."), 0))
| table host kpi severity time
]
| eval severity=coalesce(severity, 2), n=now(), time=coalesce(time, n), time=strftime(time, "%Y-%m-%d %H:%M:%S")
| fields - n _key _timediff
| sort - severity host kpi
| eval severity=case(severity == 2, "OK", severity == 4, "MEDIUM", severity == 6, "CRITICAL")
| fields host kpi severity
| rename host as Host, kpi as KPI, severity as Severity
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<label>Application Dashboard</label>
<row>
<panel depends="$alwaysHide$">
<html>
<style>
#single_prd text {
fill: $single_text_colour$ !important;
}
</style>
</html>
</panel>
<panel>
<title>PRD</title>
<single id="single_prd">
<title>Server Name</title>
<search base="base_search">
<query>| search Host=xyz* Severity=*
| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "red")
<done>
<set token="single_text_colour">$result._colour$</set>
</done>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
</dashboard>
... View more
08-09-2023
11:13 PM
Hi @ITWhisperer I have received a final change in requirement. Instead of Numbers to be colored , we need the server name to be colored. We are not interested in the count. Can you assist me how to display only colored server names based on SEVERITY. <query>| search Host=xyz* Severity=*
| stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium
| eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "red")
... View more
08-09-2023
08:09 AM
@ITWhisperer If you can see the SPL's, I am passing a single token $host$ so If I am clicking on either OS, it automatically check which SPL it belongs to. This seems to be working except the Windows token where we are seeing additional fields apart from the correct data.
... View more
08-09-2023
07:48 AM
@ITWhisperer There are two SPL queries combined. I am passing a token from another dashboard. When it is Linux server token, I want to see first SPL results, when it is Windows server Token , I want to see second SPL result but I want to retain one panel only and no combination of fields from these two searches which are appended.
... View more
08-09-2023
07:45 AM
@ITWhisperer I am not checking the query before replying 😞 I set it to red now. | eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "red")
... View more
08-09-2023
07:43 AM
@ITWhisperer The problem is If I remove the fields after append then it will delete these fields for the first SPL which used these fields. Tricky
... View more
08-09-2023
07:31 AM
@ITWhisperer Thanks for pointing it out as i am new in SPL 😞 Is this alright ? | eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green",_critical>0 AND _medium=0, "yellow")
... View more
08-09-2023
07:19 AM
@ITWhisperer | mstats latest(df_metric.Used_KB) as "Used_KB", latest(df_metric.Avail_KB) as "Avail_KB", latest(df_metric.UsePct) as "UsePct", WHERE (`itsi_entity_type_ta_nix_metrics_indexes`) AND host=$host$ (earliest="-5m" latest="now") by Filesystem, MountedOn, Type | eval UsePct=round(UsePct,2), Used_KB=round(Used_KB), Avail_KB=round(Avail_KB) |append [ | mstats min("LogicalDisk.%_Free_Space") prestats=true WHERE (`itsi_entity_type_windows_metrics_indexes`) AND host=$host$ span=1m AND NOT "instance"="_Total" by instance | timechart span=1m min("LogicalDisk.%_Free_Space") as val by instance | eval val=100-val | fields - Filesystem, MountedOn, Type | head 1]
... View more
08-09-2023
07:17 AM
@ITWhisperer Indeed it was a typo 🙂 | stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium | eval _colour=case(_critical>0 AND _medium>0,"red",_critical=0 AND _medium>0,"yellow","_critical=0 AND _medium=0,"green")
... View more
08-09-2023
07:07 AM
@ITWhisperer @yuanliu Below attached is the final result with append command. I want to ignore the fields with no data. How can it be done as fields - is not working.
... View more
08-09-2023
07:00 AM
@ITWhisperer I managed to do this with below query. Thanks for all your help | stats count count(eval(Severity=="CRITICAL")) as _critical count(eval(Severity=="OK")) as _ok count(eval(Severity=="MEDIUM")) as _medium | eval _colour=case(_critical>0 AND _medium>0,"red","green",_critical=0 AND _medium>0,"yellow","green",_critical=0 AND _medium=0,"green","red")
... View more
08-09-2023
06:36 AM
@ITWhisperer Can you tell me the correct quere based on the case mentioned in my previous reply. | stats count count(eval(Severity=="CRITICAL")) as _critical
| eval _colour=if(_critical>0,"red","green")</query>
... View more
08-09-2023
06:18 AM
@ITWhisperer so how can we ignore the fields ? They are not looking nice in the dashboard. I can’t remove before append because some searches are producing data using that SPL
... View more
08-09-2023
12:46 AM
@ITWhisperer The requirement is if we have atleast one Severity count as "CRITICAL" change the color to Red. No matter if we have "MEDIUM" or "OK" events. If "MEDIUM" and "OK" but no "CRITICAL" then AMBER if "OK" only then green
... View more
08-08-2023
11:35 PM
Hi @ITWhisperer Wonderful. The solution seems to be working. I have a small modification in requirement. If the Severity is "Critical" then it should display Red, If "OK" then green , if "Amber" then yellow. Can you please help me with that.
... View more
08-08-2023
11:13 PM
@ITWhisperer That's what fields - command not working with append. I am getting the same result as in screenshot after using fields - command. Strange | mstats latest(df_metric.Used_KB) as "Used_KB", latest(df_metric.Avail_KB) as "Avail_KB", latest(df_metric.UsePct) as "UsePct", WHERE (`itsi_entity_type_ta_nix_metrics_indexes`) AND host=VMP-STATA-01 (earliest="-5m" latest="now") by Filesystem, MountedOn, Type | eval UsePct=round(UsePct,2), Used_KB=round(Used_KB), Avail_KB=round(Avail_KB) | append [ | mstats min("LogicalDisk.%_Free_Space") prestats=true WHERE (`itsi_entity_type_windows_metrics_indexes`) AND host=VMP-STATA-01 span=1m AND NOT "instance"="_Total" by instance | timechart span=1m min("LogicalDisk.%_Free_Space") as val by instance | eval val=100-val | fields - Filesystem, MountedOn, Type | head 1]
... View more
08-08-2023
11:04 PM
Hi @ITWhisperer How can we ignore these fields as fields - command is not working.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
