Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nithys
nithys
Path Finder
Member since:
09-13-2023
10-27-2024
Community Statistics
| Posts | 53 |
| Solutions | 1 |
| Karma Given | 9 |
| Karma Received | 0 |
| Member Since | 09-13-2023 |
Activity Feed
- Posted Re: submit button based on env name/value on Dashboards & Visualizations. 10-27-2024 06:54 PM
- Posted Re: Add a submit button -fetch result only if submit is clicked on Dashboards & Visualizations. 10-24-2024 01:28 PM
- Posted submit button based on env name/value on Dashboards & Visualizations. 10-22-2024 03:04 PM
- Posted Re: Add a submit button -fetch result only if submit is clicked on Dashboards & Visualizations. 10-22-2024 02:58 PM
- Posted Extract json array to tabular format with their values on Dashboards & Visualizations. 10-17-2024 09:13 AM
- Karma Re: Add a submit button -fetch result only if submit is clicked for dural_yyz. 10-17-2024 08:15 AM
- Posted Re: Add a submit button -fetch result only if submit is clicked on Dashboards & Visualizations. 10-11-2024 09:49 AM
- Posted Re: Add a submit button -fetch result only if submit is clicked on Dashboards & Visualizations. 10-07-2024 02:48 PM
- Posted Re: Add a submit button -fetch result only if submit is clicked on Dashboards & Visualizations. 10-07-2024 02:05 PM
- Posted Add a submit button -fetch result only if submit is clicked on Dashboards & Visualizations. 10-07-2024 12:15 PM
- Posted Re: statuscode error on Dashboards & Visualizations. 12-19-2023 10:47 PM
- Karma Re: statuscode error for gcusello. 12-19-2023 09:11 PM
- Posted Re: statuscode error on Dashboards & Visualizations. 12-19-2023 12:11 AM
- Tagged Re: statuscode error on Dashboards & Visualizations. 12-19-2023 12:11 AM
- Posted Re: statuscode error on Dashboards & Visualizations. 12-18-2023 04:58 PM
- Karma Re: statuscode error for gcusello. 12-17-2023 09:56 AM
- Posted Re: statuscode error on Dashboards & Visualizations. 12-17-2023 09:51 AM
- Posted Re: statuscode error on Dashboards & Visualizations. 12-17-2023 09:35 AM
- Posted statuscode error on Dashboards & Visualizations. 12-16-2023 11:48 PM
- Posted Re: tuning the query on Splunk Search. 12-16-2023 11:01 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-27-2024
06:54 PM
Hi, If i add init getting below error Still on the background without submitting "submit" button it runs the query of the env and fetch the result
... View more
10-24-2024
01:28 PM
Currently without hitting the submit button,when i load the dashboard it get result of the below usage statistics of the selected test environment Query used first checks if env is selected "test" then use "index" as "np-ap" and set "stageToken" as "test" I want the submit button to work and get the result only after the env ,data entity and date is selected and hit the submit button index="np-ap" AND source="--a-test" <query>index=$indexToken$ AND source="-a-$stageToken$" <form version="1.1" theme="dark">
<label> stats</label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1">
<label>Environment</label>
<choice value="pd-ap,prod">PROD</choice>
<choice value="np-ap,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
</input>
<input type="dropdown" token="entityToken">
<label>Data Entity</label>
<choice value="aa">aa</choice>
<choice value="bb">bb</choice>
<choice value="cc">cc</choice>
<choice value="dd">dd</choice>
<choice value="ee">ee</choice>
<choice value="ff">ff</choice>
<default>aa</default>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique</title>
<search>
<query>index=$indexToken$ AND source="-a-$stageToken$"
| stats count </query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
10-22-2024
03:04 PM
Thanks for the solution which worked When i select the data entity and the time and hit the submit button with below query ...But without selecting the env test or prod the query get search based on the default dropdown applies to the query if it is test index as "np-ap" and sets stageToken as test. I want the submit button to work even for the env selection ...along with data entity and date index="np-ap" AND source="--a-test" <query>index=$indexToken$ AND source="-a-$stageToken$" <form version="1.1" theme="dark">
<label> stats</label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1">
<label>Environment</label>
<choice value="pd-ap,prod">PROD</choice>
<choice value="np-ap,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
<default>np-ap,test</default>
</input>
<input type="dropdown" token="entityToken">
<label>Data Entity</label>
<choice value="aa">aa</choice>
<choice value="bb">bb</choice>
<choice value="cc">cc</choice>
<choice value="dd">dd</choice>
<choice value="ee">ee</choice>
<choice value="ff">ff</choice>
<default>aa</default>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique</title>
<search>
<query>index=$indexToken$ AND source="-a-$stageToken$"
| stats count </query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
Classic dashboard
10-22-2024
02:58 PM
Thanks for the solution which worked When i select the data entity and the time and hit the submit button ...But without selecting the env test or prod the query get search based on the default dropdown applies to the query if it is test index as "np-ap" and sets stageToken as test. I want the submit button to work even for the env selection ...along with data entity and date index="np-ap" AND source="--a-test" <query>index=$indexToken$ AND source="-a-$stageToken$" <form version="1.1" theme="dark">
<label> stats</label>
<fieldset submitButton="true">
<input type="dropdown" token="indexToken1">
<label>Environment</label>
<choice value="pd-ap,prod">PROD</choice>
<choice value="np-ap,test">TEST</choice>
<change>
<eval token="stageToken">mvindex(split($value$,","),1)</eval>
<eval token="indexToken">mvindex(split($value$,","),0)</eval>
</change>
<default>np-ap,test</default>
</input>
<input type="dropdown" token="entityToken">
<label>Data Entity</label>
<choice value="aa">aa</choice>
<choice value="bb">bb</choice>
<choice value="cc">cc</choice>
<choice value="dd">dd</choice>
<choice value="ee">ee</choice>
<choice value="ff">ff</choice>
<default>aa</default>
</input>
<input type="time" token="timeToken" searchWhenChanged="false">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<html id="APIStats">
<style>
#user{
text-align:center;
color:#BFFF00;
}
</style>
<h2 id="user">API</h2>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Unique</title>
<search>
<query>index=$indexToken$ AND source="-a-$stageToken$"
| stats count </query>
<earliest>$timeToken.earliest$</earliest>
<latest>$timeToken.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
10-17-2024
09:13 AM
Hi I have an event which has prod and test based on env...if it is test it goes to nsps [{},{} ] object an check for the name say A,B,C,D an get their associate ReadOnlyConsumerNames in tabular format Output as: Name ReadOnlyConsumerNames A Application, Lst,data B Application, Lst C Lst D Lst,Gt,PT { [-]
prod: { []
}
test: { [-]
DistinctAdminConsumers: [ [-]
App
pd.
]
DistinctAdminUser: 2
DistinctReadConsumers: [ [-]
Application.
GT.
Technology.
data
]
DistinctReadUser: 4
TotalAdminUser: 20
TotalNSPCount: 10
TotalReadUsers: 13
nsps: [ [-]
{ [-]
AdminConsumerNames: [ [-]
App.
pd.
]
AdminUserCount: 2
Name: A
ReadOnlyConsumerNames: [ [-]
Application
Lst
data
]
ReadonlyUserCount: 3
}
{ [-]
AdminConsumerNames: [ [-]
App
Data
]
AdminUserCount: 2
Name: B
ReadOnlyConsumerNames: [ [-]
Application
Lst
]
ReadonlyUserCount: 3
}
{ [-]
AdminConsumerNames: [ [-]
preprod
pd
]
AdminUserCount: 2
Name: C
ReadOnlyConsumerNames: [ [-]
Lst
]
ReadonlyUserCount: 1
}
{ [-]
AdminConsumerNames: [ [+]
]
AdminUserCount: 2
Name: D
ReadOnlyConsumerNames: [ [-]
Lst
Gt
PT
]
ReadonlyUserCount: 1
}
]
}
}
... View more
Labels
- Labels:
-
Classic dashboard
10-11-2024
09:49 AM
waiting for reply
... View more
10-07-2024
02:48 PM
<row>
<panel>
<title> VIEW BY ENTITY</title>
<input type="dropdown" token="tokEnvironment" searchWhenChanged="true">
<label>Domain</label>
<choice value="Costing">Costing</choice>
<change>
<set token="inputToken">""</set>
<set token="outputToken">""</set>
<set token="inputToken2">""</set>
<set token="outputToken2">""</set>
<unset token="tokSystem"></unset>
<unset token="form.tokSystem"></unset>
</change>
<default>Cost</default>
<initialValue>Cost</initialValue>
</input>
<input type="dropdown" token="tokSystem" searchWhenChanged="false">
<label>Data Entity</label>
<fieldForLabel>$tokEnvironment$</fieldForLabel>
<fieldForValue>$tokEnvironment$</fieldForValue>
<search>
<!--<progress>-->
<!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
<!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
<!-- <condition match="'job.resultCount'== 0">-->
<!-- <set token="show_html">true</set>-->
<!-- </condition>-->
<!-- <condition>-->
<!-- <unset token="show_html"/>-->
<!-- </condition>-->
<!-- </progress>-->
<query>| makeresults
| fields - _time
| eval Costing="GetQuoteByCBD,bolHeader,bolLineItems,laborProcess,costSheetCalc,FOB"
| fields $tokEnvironment$
| makemv $tokEnvironment$ delim=","
| mvexpand $tokEnvironment$</query>
</search>
<change>
<condition match="$label$=="get"">
<set token="inputToken">get</set>
<set token="outputToken">get</set>
<set token="inputToken2">b</set>
<set token="outputToken2">b</set>
<set token="inputToken3">c</set>
<set token="outputToken3">c</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken5">e</set>
<set token="outputToken5">e</set>
<set token="inputToken4">d</set>
<set token="outputToken4">d</set>
<set token="inputToken3">3</set>
<set token="outputToken3">3</set>
<set token="apiToken">d</set>
<set token="entityToken">get</set>
</condition>
<condition match="$label$=="batch"">
<set token="inputToken">batch</set>
<set token="outputToken">batch</set>
<set token="inputToken2">c</set>
<set token="outputToken2">c</set>
<set token="inputToken">b</set>
<set token="outputToken4">b</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">b</set>
<set token="inputToken5">f</set>
<set token="outputToken5">f</set>
<set token="entityToken">batch</set>
</condition>
</condition>
<condition match="$label$=="Calc"">
<set token="inputToken">Calc</set>
<set token="outputToken">Calc</set>
<set token="inputToken2">init</set>
<set token="outputToken2">init</set>
<set token="inputToken">Calc</set>
<set token="outputToken4">Calc</set>
<set token="inputToken3">d</set>
<set token="outputToken3">d</set>
<set token="apiToken">Calc</set>
<set token="entityToken">Calc</set>
</condition>
</change>
<default>get</default>
</input>
<input type="time" token="time_picker" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<html>
<u1> </u1>
</html>
</panel>
</row>
<row>
<panel>
<title>Init Lambda</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:info:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Duplicate</title>
<table>
<search>
<query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:warning:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Init Lambda - Error</title>
<table>
<search>
<query>index=""source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:error:*" | stats count by msg</query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
... View more
10-07-2024
02:05 PM
My Dasboard runs the result of each row pannel even without the submit button is clicked....Trie giving the autoRun= false,searchwhenchanged=false.and submit button tag is added so search is only triggered when select dropdown & time is selected and they press submit button
... View more
10-07-2024
12:15 PM
Hi I have a drop down based on domain ,entity so when i select domain , entity and date selected it fetch result of initlambda,init duplicate,init error...I want to have a extra submit button ,once i hit submit then only run the result for initlambda,init duplicate,init error otherwise dont fetch anything <row> <panel> <title> VIEW BY ENTITY</title> <input type="dropdown" token="tokEnvironment" searchWhenChanged="true"> <label>Domain</label> <choice value="Costing">Costing</choice> <change> <set token="inputToken">""</set> <set token="outputToken">""</set> <set token="inputToken2">""</set> <set token="outputToken2">""</set> <unset token="tokSystem"></unset> <unset token="form.tokSystem"></unset> </change> <default>Cost</default> <initialValue>Cost</initialValue> </input> <input type="dropdown" token="tokSystem" searchWhenChanged="false"> <label>Data Entity</label> <fieldForLabel>$tokEnvironment$</fieldForLabel> <fieldForValue>$tokEnvironment$</fieldForValue> <search> <!--<progress>--> <!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) --> <!-- logic: if resultCount is 0, then show a static html element, and hide the chart element --> <!-- <condition match="'job.resultCount'== 0">--> <!-- <set token="show_html">true</set>--> <!-- </condition>--> <!-- <condition>--> <!-- <unset token="show_html"/>--> <!-- </condition>--> <!-- </progress>--> <query>| makeresults | fields - _time | eval Costing="GetQuoteByCBD,bolHeader,bolLineItems,laborProcess,costSheetCalc,FOB" | fields $tokEnvironment$ | makemv $tokEnvironment$ delim="," | mvexpand $tokEnvironment$</query> </search> <change> <condition match="$label$=="get""> <set token="inputToken">get</set> <set token="outputToken">get</set> <set token="inputToken2">b</set> <set token="outputToken2">b</set> <set token="inputToken3">c</set> <set token="outputToken3">c</set> <set token="inputToken4">d</set> <set token="outputToken4">d</set> <set token="inputToken5">e</set> <set token="outputToken5">e</set> <set token="inputToken4">d</set> <set token="outputToken4">d</set> <set token="inputToken3">3</set> <set token="outputToken3">3</set> <set token="apiToken">d</set> <set token="entityToken">get</set> </condition> <condition match="$label$=="batch""> <set token="inputToken">batch</set> <set token="outputToken">batch</set> <set token="inputToken2">c</set> <set token="outputToken2">c</set> <set token="inputToken">b</set> <set token="outputToken4">b</set> <set token="inputToken3">d</set> <set token="outputToken3">d</set> <set token="apiToken">b</set> <set token="inputToken5">f</set> <set token="outputToken5">f</set> <set token="entityToken">batch</set> </condition> </condition> <condition match="$label$=="Calc""> <set token="inputToken">Calc</set> <set token="outputToken">Calc</set> <set token="inputToken2">init</set> <set token="outputToken2">init</set> <set token="inputToken">Calc</set> <set token="outputToken4">Calc</set> <set token="inputToken3">d</set> <set token="outputToken3">d</set> <set token="apiToken">Calc</set> <set token="entityToken">Calc</set> </condition> </change> <default>get</default> </input> <input type="time" token="time_picker" searchWhenChanged="true"> <label>Time</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <html> <u1> </u1> </html> </panel> </row> <row> <panel> <title>Init Lambda</title> <table> <search> <query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:info:*" | stats count by msg</query> <earliest>$time_picker.earliest$</earliest> <latest>$time_picker.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <title>Init Lambda - Duplicate</title> <table> <search> <query>index="" source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:warning:*" | stats count by msg</query> <earliest>$time_picker.earliest$</earliest> <latest>$time_picker.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <title>Init Lambda - Error</title> <table> <search> <query>index=""source IN ("/aws/lambda/aa-$outputToken$-$stageToken$-$outputToken2$") | spath msg | search msg="gemini:streaming:error:*" | stats count by msg</query> <earliest>$time_picker.earliest$</earliest> <latest>$time_picker.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row>
... View more
Labels
- Labels:
-
Classic dashboard
12-19-2023
10:47 PM
Hi @gcusello With the provided query i am able to get a column chart which shows total no of request,200 statuscode,400 statuscode,500 statuscode.But how can i show 200 as green ,400 as orange,500 as red... Tried below option inside the source but unable to get the colors in column chart... <option name="charting.chart">column</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.drilldown">all</option> <option name="charting.fieldColors">{"200":0xFF0000,201:0x33ff00,204:0x66ff00,303:0xffaa00,304:0xffff00,404:0xff0000}</option> <option name="charting.legend.placement">right</option>
... View more
12-19-2023
12:11 AM
index="1**" source="2***"
| rex "(?ms)statusCode: (?<status_code>\d+)"
| stats count by statusCode
| appendcols [ search
index="1**" source="2**" "republish event"
| stats dc(event.body) AS totalrequest ] Hi @gcusello With the above query i get only statuscode count either 200 or 400....but the append search totalrequest is not mapped to a color
... View more
- Tags:
- stats
12-18-2023
04:58 PM
Hi @gcusello I am able to get different status code in a pie chart ,if i also want to append an another query count to get the "totalrequest" ....its not adding to pie chart How can i add below in pie chart...lets say the total request count say 3 success 200-2(green color) 400 error-1(pink color) 500 error-1(red color) index="1**" source="2***" | rex "(?ms)statusCode: (?<status_code>\d+)" | stats count by statusCode | appendcols [search index="1**" source="2**" "republish event"| stats count by event.body | stats count | rename count as totalrequest]
... View more
12-17-2023
09:51 AM
Thanks @gcusello Below query matches the correct count of all the statuscode " rex "(?ms)statusCode: (?<status_code>\d+)" | stats count by statusCode | table statusCode,count"
... View more
12-17-2023
09:35 AM
Hi @gcusello I tried below query but its not fetching the correct counts of each statuscode...If i want to capture other statuscode greater than 400 ,>500 how should i include it index="**" source="****" | rex "\"statusCode\":(?<statusCode>[\d]*)" | stats count by statusCode | eval statusCode =case(statusCode="200","success",statusCode="500","Internal Server Error",statusCode="400","Bad Request") | table statusCode,count
... View more
12-16-2023
11:48 PM
Hi Team, I have below three logs events which gets the statuscode of 200,400,500 in different logs. Need help to find the status code error rate for all the diiferent status code with the respective time Event 1:400 error { [-] body: { [-] message: [ [-] { [-] errorMessage: must have required property 'objectIds' field: objectIds } { [-] errorMessage: must be equal to one of the allowed values : [object1,object2] field: objectType } statusCode: 400 type: BAD_REQUEST_ERROR } headers: { [-] Access-Control-Allow-Origin: * Content-Type: application/json } hostname: level: 50 msg: republish error response statusCode: 400 time: **** } Event 2:500 Error { [-] awsRequestId: body: { [-] message: Unexpected token “ in JSON at position 98 } headers: { [-] Access-Control-Allow-Origin: * Content-Type: application/json } msg: reprocess error response statusCode: 500 time: *** } Event 3:Success { [-] awsRequestId: body: { [-] message: republish request has been submitted for [1] ids } headers: { [-] Access-Control-Allow-Origin: * Content-Type: application/json } } headers: { [+] } msg: republish success response statusCode: 200 time: *** }
... View more
Labels
- Labels:
-
timechart
12-16-2023
11:01 PM
Hi @gcusello 1.With below query i am trying to fetch three fields from three different event logs which match all 3 condition CASE is used get the extact uppercase/lowercase match of "latest,material" from first log event "id,material" from second log event "dynamoDB data retrieved for ids,dataNotFoundIdsCount,material" from third log event from third event log CASE("latest") AND "id" AND "dynamoDB data retrieved for ids" AND "material" Based on above condition PST_TIME4 objectType version republishType publish nspConsumerList snsPublishedCount dataNotFoundIdsCount 2023-20-11 02:55:12 material latest id NSP ALL 3 1 2023-16-11 09:18:14 material latest id NSP ALL 3 1 2023-12-12 05:03:37 material latest id ALL ALL 1 2 2.CASE("latest") AND "id" AND "sns published count" AND "material" Appendcols is used to fetch sns published count,publish,version,republishInput along with other filter condition latest,id,material
... View more
12-13-2023
11:20 PM
PST_TIME4 objectType version republishType publish nspConsumerList snsPublishedCount dataNotFoundIdsCount 2023-17-11 01:50:35 material latest id NSP ALL 3 1 2023-20-11 02:55:12 material latest id NSP ALL 3 1 2023-16-11 09:18:14 material latest id NSP ALL 3 1 2023-12-12 05:03:37 material latest id ALL ALL 1 2
... View more
12-13-2023
11:20 PM
Hi Team,I am using a query which has same index and source but fetch two results based on the search and combine to a single table..now i want to display the result along with the timestamp it appears in ascending order index=index1 source=source1 CASE("latest") AND "id" AND "dynamoDB data retrieved for ids" AND "material"| eval PST=_time-28800 | eval PST_TIME3=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=dataNotFoundIdsCount path=dataNotFoundIdsCount | stats values(*) as * by _raw | table dataNotFoundIdsCount, PST_TIME3 | sort- PST_TIME3| appendcols [search index=index1 source=source1 CASE("latest") AND "id" AND "sns published count" AND "material"| eval PST=_time-28800 | eval PST_TIME4=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath snsPublishedCount output=snsPublishedCount |spath output=republishType path=republishType| spath output=version path=republishInput.version| spath output=publish path=republishInput.publish| spath output=nspConsumerList path=republishInput.nspConsumerList{} | spath output=objectType path=republishInput.objectType | stats values(*) as * by _raw | table snsPublishedCount,republishType,version,publish, nspConsumerList,objectType,PST_TIME4 | sort- PST_TIME4 ] |table PST_TIME4 objectType version republishType publish nspConsumerList snsPublishedCount dataNotFoundIdsCount
... View more
Labels
- Labels:
-
stats
12-11-2023
08:45 PM
Hi All, I need some help in searching, I have 1 index but it has multiple sources, Index = Index1 Source = source 1 Source = source 2 Source = source 3 Source = source 4 Source = source 5 Source = source 6 Source = source 7 Now i have a requirement to create an alert search with only first 4 source and exclude the remaining three source 5,6,7 I tried using below query Index = Index1 source IN ("source 1","source 2","source 3","source 4") when i tried to exclude 4,5,6 source,getting error.Can you help on this? Index = Index1 source IN ("source 1","source 2","source 3","source 4") source NOT IN ("source 4","source 5","source 3","source 6") or Index = Index1 source ! IN ("source 4","source 5","source 6") source IN ("source 1","source 2","source 3","source 4") source ! IN ("source 4","source 5","source 3","source 6")
... View more
Labels
- Labels:
-
stats
11-21-2023
03:19 PM
Hi @ITWhisperer Added a log to all the event to that it can be picked up commonly,which resolved it
... View more
11-15-2023
06:36 AM
Hi @ITWhisperer Based on the below the raw events....I need to filter based on the attribute "suppliedMaterial" and "version"- get the result of row and then add the columns of sqsSentCount and dataNotFoundIdsCount similar to below objectType version dataNotFoundIdsCount sqsSentCount suppliedMaterial all 1 8 suppliedMaterial latest 3 9 Material all 3 11 Material latest 6 10 supplied material
1st event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"event":{"resource":"/v1/reprocess/id","path":"/support/v1/reprocess/id","httpMethod":"POST","pathParameters":null,"queryStringParameters":null,"body":"{\n \"objectType\": \"suppliedMaterial\",\n \"objectIds\": [\n \"569683\",\n \"564373er\",\n \"569129\"\n ],\n \"version\": \"all\"\n}","requestContext":{"requestId":"","authorizer":{"principalId":"","integrationLatency":0},"domainName":""}},"msg":"reprocess event","time":"2023-11-15T05:47:59.318Z","v":0}
2nd event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","dataNotFoundIds":["564373er"],"dataNotFoundIdsCount":1,"msg":"data not found for Ids","time":"2023-11-15T05:47:59.329Z","v":0}
3rd event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","sqsSentCount":8,"msg":"sqs sent count","time":"2023-11-15T05:47:59.364Z","v":0}
4th event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"eventBody":{"objectType":"suppliedMaterial","objectIds":["569683","564373er","669179"],"version":"all"},"msg":"request body","time":"2023-11-15T05:47:59.318Z","v":0}
5 event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"event":{"resource":"/v1/reprocess/id","path":"/support/v1/reprocess/id","httpMethod":"POST","pathParameters":null,"queryStringParameters":null,"body":"{\n \"objectType\": \"suppliedMaterial\",\n \"objectIds\": [\n \"569683\",\n \"564373er\",\n \"669179\"\n ],\n \"version\": \"latest\"\n}","requestContext":{"requestId":"","authorizer":{"principalId":"","integrationLatency":0},"domainName":""}},"msg":"reprocess event","time":"2023-11-15T05:47:59.318Z","v":0}
6 event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","dataNotFoundIds":["564373er"],"dataNotFoundIdsCount":3,"msg":"data not found for Ids","time":"2023-11-15T05:47:59.329Z","v":0}
7 event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","sqsSentCount":9,"msg":"sqs sent count","time":"2023-11-15T05:47:59.364Z","v":0}
8 event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"eventBody":{"objectType":"suppliedMaterial","objectIds":["569683","564373er","569129"],"version":"latest"},"msg":"request body","time":"2023-11-15T05:47:59.318Z","v":0}
material
1st event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"event":{"resource":"/v1/reprocess/id","path":"/support/v1/reprocess/id","httpMethod":"POST","pathParameters":null,"queryStringParameters":null,"body":"{\n \"objectType\": \"material\",\n \"objectIds\": [\n \"569683\",\n \"564373er\",\n \"469196\"\n ],\n \"version\": \"all\"\n}","requestContext":{"requestId":"","authorizer":{"principalId":"","integrationLatency":0},"domainName":""}},"msg":"reprocess event","time":"2023-11-15T05:47:59.318Z","v":0}
2nd event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"material","dataNotFoundIds":["564373er"],"dataNotFoundIdsCount":3,"msg":"data not found for Ids","time":"2023-11-15T05:47:59.329Z","v":0}
3rd event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"material","sqsSentCount":11,"msg":"sqs sent count","time":"2023-11-15T05:47:59.364Z","v":0}
4th event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"eventBody":{"objectType":"material","objectIds":["569683","564373er","569129"],"version":"all"},"msg":"request body","time":"2023-11-15T05:47:59.318Z","v":0}
5 event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"event":{"resource":"/v1/reprocess/id","path":"/support/v1/reprocess/id","httpMethod":"POST","pathParameters":null,"queryStringParameters":null,"body":"{\n \"objectType\": \"suppliedMaterial\",\n \"objectIds\": [\n \"569683\",\n \"564373er\",\n \"569129\"\n ],\n \"version\": \"latest\"\n}","requestContext":{"requestId":"","authorizer":{"principalId":"","integrationLatency":0},"domainName":""}},"msg":"reprocess event","time":"2023-11-15T05:47:59.318Z","v":0}
6 event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","dataNotFoundIds":["564373er"],"dataNotFoundIdsCount":6,"msg":"data not found for Ids","time":"2023-11-15T05:47:59.329Z","v":0}
7 event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"supportType":"reprocess","entity":"suppliedMaterial","sqsSentCount":10,"msg":"sqs sent count","time":"2023-11-15T05:47:59.364Z","v":0}
8event-
{"name":"","awsRequestId":"1","hostname":","pid":8,"level":30,"eventBody":{"objectType":"suppliedMaterial","objectIds":["569683","564373er","569129"],"version":"latest"},"msg":"request body","time":"2023-11-15T05:47:59.318Z","v":0}
... View more
- Tags:
- stats
11-14-2023
11:20 PM
I am appending results from below query,which will display difererent objectype suppliedMaterial:
index="" source="" "suppliedMaterial" AND "reprocess event" |stats count | rename count as ReProcessAPICall
| appendcols "" "suppliedMaterial" AND "data not found for Ids"| eval PST=_time-28800 | eval PST_TIME3=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=dataNotFoundIds path=dataNotFoundIds{}| stats values(*) as * by _raw | table dataNotFoundIds{},dataNotFoundIdsCount, PST_TIME3 | sort- PST_TIME3 ]
| appendcols [search index="" source="*" "suppliedMaterial" AND "sqs sent count" | eval PST=_time-28800 | eval PST_TIME4=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath sqsSentCount output=sqsSentCount | stats values(*) as * by _raw | table sqsSentCount PST_TIME4 | sort- PST_TIME4 ]
| appendcols [search index="" source="" "suppliedMaterial" AND "request body" | eval PST=_time-28800 | eval PST_TIME4=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=version path=eventBody.version | spath output=objectType path=eventBody.objectType | stats values(*) as * by _raw | table version, objectType ] | table objectType version dataNotFoundIdsCount sqsSentCount ReProcessAPICall
For Material
index="" source="" material" AND "reprocess event" |stats count | rename count as ReProcessAPICall
| appendcols*" "material" AND "data not found for Ids"| eval PST=_time-28800 | eval PST_TIME3=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=dataNotFoundIds path=dataNotFoundIds{}| stats values(*) as * by _raw | table dataNotFoundIds{},dataNotFoundIdsCount, PST_TIME3 | sort- PST_TIME3 ]
| appendcols [search index="" source="*" "material" AND "sqs sent count" | eval PST=_time-28800 | eval PST_TIME4=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath sqsSentCount output=sqsSentCount | stats values(*) as * by _raw | table sqsSentCount PST_TIME4 | sort- PST_TIME4 ]
| appendcols [search index="" source="" "material" AND "request body" | eval PST=_time-28800 | eval PST_TIME4=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=version path=eventBody.version | spath output=objectType path=eventBody.objectType | stats values(*) as * by _raw | table version, objectType ] | table objectType version dataNotFoundIdsCount sqsSentCount ReProcessAPICall
My actual is :
objectType
version
dataNotFoundIdsCount
sqsSentCount
ReProcessApiCall
suppliedMaterial
all
4
15
12
suppliedMaterial
latest
2
19
suppliedMaterial
all
3
11
Material
latest
6
10
Material
latest
5
4
Material
all
4
1
Material
all
2
3
My Expected is : Basically I needed to count the two fields (dataNotFoundIdsCount & ssqsSentCount based on what version whether 'all' or 'latest') from the previous queries . I am thinking to use the version as dynamic values , and bring conditional check in those queries to add the field values for each version and name it as dataNotFoundIdsCount_all ,dataNotFoundIdsCount_latest. Finally in the last query again check the version and show the sum Please advise if there's a easy way of doing this ..
objectType
version
dataNotFoundIdsCount
sqsSentCount
ReProcessApiCall
suppliedMaterial
all
4
15
12
suppliedMaterial
latest
2
19
Material
all
3
11
Material
latest
6
10
... View more
11-10-2023
12:38 AM
thank you @ITWhisperer Above solution worked
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-27-2024
08:16 PM
|
