Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About Rao_KGY
Rao_KGY
Loves-to-Learn
Member since:
01-16-2024
06-21-2024
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-16-2024 |
Activity Feed
- Posted Log events are being dropped when applying a condition on Splunk Search. 06-21-2024 02:26 AM
- Posted Re: No Result Found while adding panel to a dashboard on Dashboards & Visualizations. 02-25-2024 11:05 PM
- Posted Re: No Result Found while adding panel to a dashboard on Dashboards & Visualizations. 02-25-2024 09:18 AM
- Posted Re: No Result Found while adding panel to a dashboard on Dashboards & Visualizations. 02-25-2024 03:24 AM
- Posted Re: No Result Found while adding panel to a dashboard on Dashboards & Visualizations. 02-24-2024 07:01 PM
- Posted No Result Found while adding panel to a dashboard on Dashboards & Visualizations. 02-23-2024 10:26 AM
- Tagged No Result Found while adding panel to a dashboard on Dashboards & Visualizations. 02-23-2024 10:26 AM
- Posted How to create a query that follow trend (line chart) of another query. on Splunk Search. 01-16-2024 10:13 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
06-21-2024
02:26 AM
Hello Everyone, I have built a Splunk query (shared below) recently & I noticed that when apply search condition App_Name IN (*) its actually drop number of event scanned. Like if I execute following query it has 2515 events (not to confused with statistics)...
index=msad_hcv NOT ("forwarded") | spath output=role_name path=auth.metadata.role_name
| mvexpand role_name
| rex field=role_name "(\w+-(?P<App_Name>[^\"]+))"
| search Environment=* type=* request.path=* App_Name IN (*)
| stats count
But in case I comment App_Name IN (*) condition in line no. 4 then it produced 4547 events.
index=msad_hcv NOT ("forwarded") | spath output=role_name path=auth.metadata.role_name
| mvexpand role_name
| rex field=role_name "(\w+-(?P<App_Name>[^\"]+))"
| search Environment=* type=* request.path=* ```App_Name IN (*)```
| stats count
My question is how can I save the log events from getting dropped when App_Name IN (*) is in force ? Please note that events which are being dropped, are the ones who don't have "App_Name" in their events.
... View more
Labels
- Labels:
-
field extraction
02-25-2024
11:05 PM
Hey @gcusello seems like there is some confusion. My issue is still stand UNRESOLVED & trying to get resolution. Thanks
... View more
02-25-2024
09:18 AM
That space is not the issue @gcusello . Mistake happened since I took pic of source code, then extracted text from those pics via open source website & later pasted here so during this process only that mistake occurred. Thanks
... View more
02-25-2024
03:24 AM
@gcusello even timechart command also not working for me. JFYI I did try to create new dashboard by adding these queries to panel but I was getting same error. I have created multiple dashboard before but never faced such issue. Following is the source code of errored dashboard.
<dashboard version="1.1" theme="light">
<label>CSC Impacted Services Health</label>
<row>
<panel>
<title>Build Profile Failures-CIAM Service Impact</title>
<chart>
<search>
<query>index=app_pl Appid-APP-3515 Environment="PROD" "com.thehartford.pl.model.exception.CscServiceException: null
at com.thehartford.pl.rest.UserProfileController.builduserProfile"
| timechart count As Failure span=1h</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">column</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<link target="_self">search?q=index%3Dapp_p1%20Appid%3DAPP-3515%20Environment%3D%22PROD%22%20%22com.thehartford.pl.mo
.rest.UserProfileController.buildUserProfile%22%0A%7Crex%20%22CIAMSESSION%20%3A%20(%3F%3Cciamsession%3E%5B%5Cw%5Cs%
(%3F%3Cuserid%3E%5B%5C%5C%40%5C.%5D%2B) %22%0A%7C%20bin%20span%3D1h%20_time%20%0A%60%60%60%7C%20table%20ciamsession
me& earliest-$field1.earliest$& latest-$field1.latest$</link>
</drilldown>
</chart>
</panel>
<panel>
<title>Build Profile Failures- CIAM Service Impact</title>
<table>
<search>
<query>index=app_pl Appid=APP-3515 Environment="PROD" "com.thehartford.pl.model.exception.CscService Exception: null
at com.thehartford.pl.rest.UserProfileController.buildUserProfile"
| bin span=1h _time
l stats count as Failure by _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</row>
</dashboard>
</search>
<option name="count">50</option>
<option name="dataoverlayMode">none</option>
<option name="drilldown">none</option>.
<option name="percentages Row">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
... View more
02-24-2024
07:01 PM
Hey @gcusello @ITWhisperer Thanks for the information. JFYI I'm using same timeframe (i.e. 24Hrs ) for both the panel & span is also same 1hr. @gcusello as per your suggestion I tried "timechart" but again same issue, "NO Result Found". But same query is working fine while putting it in separate search. And you're right I shouldn't use "table" command but since nothing was working so just for workaround I tried to use it.
... View more
02-23-2024
10:26 AM
Hello Everyone, Recently I have come across a very strange issue while adding a panel query to a dashboard. Following query working very fine in search but as soon as I add it to dashboard it says "No results found". Not sure why ? index=app_pl "com. thehartford.pl.model.exception. Csc ServiceException: null at com.thehartford.pl. rest.UserProfileController.buildUserProfile" | bin span=1h _time I table * I stats count as Failure by _time
... View more
- Tags:
- no result found
Labels
- Labels:
-
Classic dashboard
01-16-2024
10:13 AM
I have a panel in a dashboard that plot a trend line for last 24 Hrs. Now I wanna create a new alert query that should follow the trendline of panel. If the output of alert query doesn't match (not exactly but to an extent) the pattern of panel query then it should trigger an alert.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-21-2024
02:47 PM
|
