Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About krishna1
krishna1
Explorer
Member since:
11-05-2023
11-04-2024
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-05-2023 |
Activity Feed
- Posted How to Capture Both Matched and Unmatched Events After a Lookup Filter on Splunk Search. 11-04-2024 07:33 PM
- Posted how to align values on X-axis on Splunk Dev. 02-07-2024 09:14 PM
- Posted Re: Iam getting different outputs for same query on Splunk Dev. 01-31-2024 03:58 AM
- Posted Re: Iam getting different outputs for same query on Splunk Dev. 01-31-2024 02:56 AM
- Posted Iam getting different outputs for same query on Splunk Dev. 01-31-2024 02:18 AM
- Posted Re: Owner group need to further split-up based on "Ageing Lookup" field. check reference table & suggest c on Splunk Dev. 11-09-2023 09:45 PM
- Posted Re: how to dedup "Owner group" without disturbing other fields in table on Splunk Dev. 11-09-2023 01:10 AM
- Posted Re: Owner group need to further split-up based on "Ageing Lookup" field. check reference table & suggest c on Splunk Dev. 11-08-2023 11:45 PM
- Posted how to dedup "Owner group" without disturbing other fields in table on Splunk Dev. 11-08-2023 11:43 PM
- Posted Re: Owner group need to further split-up based on "Ageing Lookup" field. check reference table & suggest c on Splunk Dev. 11-08-2023 04:25 AM
- Posted Re: Owner group need to further split-up based on "Ageing Lookup" field. check reference table & suggest c on Splunk Dev. 11-08-2023 04:17 AM
- Posted Owner group need to further split-up based on "Ageing Lookup" field. check reference table & suggest changes to query. on Splunk Dev. 11-08-2023 03:35 AM
- Posted Re: Iam trying to get data from "30-Oct-23" but its starting from "23-Oct-23".Could anyone please su on Splunk Dev. 11-08-2023 03:16 AM
- Posted Iam trying to get data from "30-Oct-23" but its starting from "23-Oct-23".Could anyone please suggest change in my query on Splunk Dev. 11-05-2023 10:47 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-04-2024
07:33 PM
I'm working with a query where I'm using a lookup to enrich events based on the work_queue field and then filtering to pass forward only those events with a matching entry in the lookup file. Here’s a simplified version of my query:
index="acn_ticket_summary"
| lookup Master.csv "AssignmentGroup" as work_queue outputnew Desk_Ind, cdl_gs, Support_Team
| where isnotnull(work_queue)
This filters the events, keeping only those that have a non-null work_queue after the lookup.
Requirement: I also need to capture the events that don’t match (i.e., those that result in isnull(work_queue)) for separate calculations. Is there a way to modify my query to keep both the matched and unmatched events?
Thank you in advance for your help!
... View more
Labels
- Labels:
-
lookup
02-07-2024
09:14 PM
Iam trying to align values on X-axis in this order : ">3 days" ">5 days" ">15 days" ">30 days" ">100 days" I have tried table command but its not giving me the expected output. query: |inputlookup acn_ticket_unresolved_dessertholdings_kv | eval age=((now() - epoc_time_submitted)/86400),total_age=round(age,2) |rangemap field=total_age ">3 days"=0-3.00 ">5 days"=3.01-15.00 ">15 days"=15.01-30.00 ">30 days"=30.01-100.00 ">100 days"=100.01-1000.00 | chart count as count1 over range by priority | rename priority as Priority
... View more
01-31-2024
02:56 AM
in table , _time is converted into month buckets but in chart, in X-axis its not getting showing monthly buckets
... View more
01-31-2024
02:18 AM
Iam getting different results for same query when checked in statistics and visualizations, Attaching both screenshots
... View more
11-09-2023
09:45 PM
how can I dedup "owner group" field without disturbing other fields in table. my query: | eval time_period= "01-Nov-23" | eval time_period_epoc=strptime(time_period,"%d-%b-%y") |where epoc_time_submitted <= time_period_epoc |join max=0 type=left current_ticket_state [|inputlookup monthly_status_state_mapping.csv|rename Status as current_ticket_state "Ageing Lookup" as state|table current_ticket_state state] |eval age= Final_TAT_days |eval total_age=round(age,2) |rangemap field=total_age "0-10days"=0-11 "11-20 Days"=11.01-20.00 "21-30 Days"=20.01-30 "31-40 Days"=30.01-40 "41-50 Days"=40.01-50 "51-60 Days"=50.01-60 "61-70 Days"=60.01-70 "71-80 Days"=70.01-80 "81-90 Days"=80.01-90 "91-100 Days"=90.01-100 ">100 Days"=100.01-1000 | stats count by work_queue state range | eval combined=work_queue."|".state | chart max(count) by combined range | eval work_queue=mvindex(split(combined,"|"),0) | eval state=mvindex(split(combined,"|"),1) | fields - combined |table work_queue state "11-20 Days" "21-30 Days" "31-40 Days" "41-50 Days" "51-60 Days" "61-70 Days" "71-80 Days" "81-90 Days" "91-100 Days" ">100 Days" |rename work_queue as "Owner Group" | fillnull value=0 |addtotals
... View more
11-09-2023
01:10 AM
| eval time_period= "01-Nov-23"
| eval time_period_epoc=strptime(time_period,"%d-%b-%y")
|where epoc_time_submitted <= time_period_epoc
|join max=0 type=left current_ticket_state [|inputlookup monthly_status_state_mapping.csv|rename Status as current_ticket_state "Ageing Lookup" as state|table current_ticket_state state]
|eval age= Final_TAT_days
|eval total_age=round(age,2)
|rangemap field=total_age "0-10days"=0-11 "11-20 Days"=11.01-20.00 "21-30 Days"=20.01-30 "31-40 Days"=30.01-40 "41-50 Days"=40.01-50 "51-60 Days"=50.01-60 "61-70 Days"=60.01-70 "71-80 Days"=70.01-80 "81-90 Days"=80.01-90 "91-100 Days"=90.01-100 ">100 Days"=100.01-1000
| stats count by work_queue state range
| eval combined=work_queue."|".state
| chart max(count) by combined range
| eval work_queue=mvindex(split(combined,"|"),0)
| eval state=mvindex(split(combined,"|"),1)
| fields - combined
|table work_queue state "11-20 Days" "21-30 Days" "31-40 Days" "41-50 Days" "51-60 Days" "61-70 Days" "71-80 Days" "81-90 Days" "91-100 Days" ">100 Days" |rename work_queue as "Owner Group" | fillnull value=0 |addtotals
... View more
11-08-2023
11:45 PM
thanks this one helps
... View more
11-08-2023
04:25 AM
Iam trying to replicate reference table attached previously My "work_queue" field contains (BROKERPORTAL_L2SUPPORT, CONSUMERPORTAL_L2SUPPORT, EMPLOYERPORTAL_L2SUPPORT, MARKETINGCLOUD_L2SUPPORT, MEMBERPORTAL_L2SUPPORT, PROVIDERPORTAL_L2SUPPORT, SALESCLOUD_L2SUPPORT, SERVICECLOUD_L2SUPPORT). "Ageing Lookup" field contains (In Progress,Resolved,Awaiting Resolution Confirmation,Awaiting User Information,Dependent System,Awaiting Change,Cancelled,Reopen) I want to divide every work_queue field value further based on "Ageing lookup".
... View more
11-08-2023
04:17 AM
Iam trying to replicate reference table attached previously My "work_queue" field contains (BROKERPORTAL_L2SUPPORT, CONSUMERPORTAL_L2SUPPORT, EMPLOYERPORTAL_L2SUPPORT, MARKETINGCLOUD_L2SUPPORT, MEMBERPORTAL_L2SUPPORT, PROVIDERPORTAL_L2SUPPORT, SALESCLOUD_L2SUPPORT, SERVICECLOUD_L2SUPPORT). "Ageing Lookup" field contains (In Progress,Resolved,Awaiting Resolution Confirmation,Awaiting User Information,Dependent System,Awaiting Change,Cancelled,Reopen) I want to divide work_queue field values further based on "Ageing lookup".
... View more
11-08-2023
03:35 AM
reference table: My query: | eval time_period= "01-Nov-23" | eval time_period_epoc=strptime(time_period,"%d-%b-%y") |where epoc_time_submitted <= time_period_epoc |join max=0 type=left current_ticket_state [|inputlookup monthly_status_state_mapping.csv|rename Status as current_ticket_state|table current_ticket_state "Ageing Lookup"] |eval age= Final_TAT_days |eval total_age=round(age,2) |rangemap field=total_age "0-10days"=0-11 "11-20 Days"=11.01-20.00 "21-30 Days"=20.01-30 "31-40 Days"=30.01-40 "41-50 Days"=40.01-50 "51-60 Days"=50.01-60 "61-70 Days"=60.01-70 "71-80 Days"=70.01-80 "81-90 Days"=80.01-90 "91-100 Days"=90.01-100 ">100 Days"=100.01-1000 |chart count as count1 over work_queue by range |rename work_queue as "Owner Group" |table "Owner Group" "11-20 Days" "21-30 Days" "31-40 Days" "41-50 Days" "51-60 Days" "61-70 Days" "71-80 Days" "81-90 Days" "91-100 Days" ">100 Days" |addtotals|addcoltotals |fillnull value="Grand Total" my result:
... View more
11-08-2023
03:16 AM
Thanks, Its working
... View more
11-05-2023
10:47 PM
| eval lastmodifiedWeek=strftime(epoc_last_modified,"%Y-%V") |eval timeline="30-Oct-23" | eval timeline_date=strptime(timeline,"%d-%b-%y") |eval new_timeline=strftime(timeline_date,"%Y-%V") |where lastmodifiedWeek<=new_timeline |join max=0 type=left current_ticket_state [|inputlookup weekly_status_state_mapping.csv|rename Status as current_ticket_state|table current_ticket_state Lookup] | stats count by Lookup lastmodifiedWeek | eval timeline1 = strptime(lastmodifiedWeek." 1", "%Y-%U %w") | eval timeline2=relative_time(timeline1,"-1w@w1") | eval timeline = strftime(timeline2, "%Y-%m-%d") | table timeline , Lookup count |chart values(count) as count over timeline by Lookup |fillnull value=0 |tail 4 |reverse
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-04-2024
11:04 PM
|
