Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About iamarkaprabha
iamarkaprabha
Contributor
Member since:
03-09-2017
11-18-2020
Community Statistics
| Posts | 85 |
| Solutions | 18 |
| Karma Given | 2 |
| Karma Received | 109 |
| Member Since | 03-09-2017 |
Activity Feed
- Karma Re: how to create pie chart in dashboard using REST API URI? for niketn. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me display values from a CSV file in a report?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me display values from a CSV file in a report?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me display values from a CSV file in a report?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me display values from a CSV file in a report?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me display values from a CSV file in a report?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me display values from a CSV file in a report?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I take fundamentals 1 again after completion?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I take fundamentals 1 again after completion?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I take fundamentals 1 again after completion?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I take fundamentals 1 again after completion?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I take fundamentals 1 again after completion?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I take fundamentals 1 again after completion?. 06-05-2020 12:50 AM
- Got Karma for Re: How can I take fundamentals 1 again after completion?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I pull a log file directly in as a metric?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I pull a log file directly in as a metric?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I pull a log file directly in as a metric?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I pull a log file directly in as a metric?. 06-05-2020 12:50 AM
- Got Karma for Re: How do I pull a log file directly in as a metric?. 06-05-2020 12:50 AM
- Got Karma for Re: Without have access to the universal forwarder, can I check whether it is sending data to the heavy forwarder?. 06-05-2020 12:50 AM
Topics I've Started
12-26-2018
03:07 AM
Hi Isaac.Hailperin@lcsystems.ch ,
Did the issue resolve ?
I am facing same kind of issue
... View more
10-31-2018
09:08 AM
are you talking about https://splunkbase.splunk.com/app/3411/
... View more
10-30-2018
08:53 PM
Does the macro has permission level to the same app where the dashboard was created?
... View more
10-30-2018
12:24 PM
Oh sorry . For next 6 month's , you have to use machine learning. There is a app called ML toolkit. By which you are write various regression techniques and show future data. Or there is a command called predict , you can use that also
... View more
10-30-2018
12:03 PM
You can use earliest and latest command to isolate the data of 6 month's
... View more
10-30-2018
08:39 AM
use this
**index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1d limit=0 | appendpipe [stats avg(*) as *]**
... View more
10-30-2018
03:48 AM
Hi,
Can you try it like this
your search here
| rex field=source "/[^/]+(?<date>\d{8})[^/]+$"
It will extract the date out of your file_name
then you can compare
... View more
10-30-2018
01:29 AM
1 Karma
Hi ,
This happened maybe the file got indexed at that particular day,
You can add tz=UTC in props.conf for this one
It will be like this
[source::\\\\SERVERNAME\\prod-iislogs\...\...\\C*.log]
TZ = GMT
... View more
10-30-2018
01:19 AM
2 Karma
Hi ,
This usually happens when a forwarder cannot send something to an indexer. Is splunk running on your indexer? Is the input's port open? Can the forwarder connect to the input's port?
... View more
10-30-2018
12:54 AM
1 Karma
Hi ,
can you use this
**index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | timechart sum(GB) as "total" by series span=1mon limit=0 | appendpipe [stats avg(*) as *]**
and set the time frame on your search for last six months
... View more
10-29-2018
11:05 PM
2 Karma
Hi ,
Can you use timechart instead of stats and use span of 1month over there
... View more
10-29-2018
10:16 PM
can you share the splunkd.log
... View more
10-29-2018
10:14 PM
3 Karma
Hi ,
Why don't you try case statements for this one. If the cpu went up to 85% and more then it will store the data in one field and vice versa
using eval - eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")
http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#case.28X.2C.22Y.22.2C....29
... View more
10-29-2018
10:08 PM
Hi,
Can you share me how much amount of data you are talking about.
... View more
10-29-2018
10:02 PM
1 Karma
Hi ,
here is the solution I found out . It uses a dropdown menu, rather than a button
<label>Run query</label>
<choice value="1">No</choice>
<choice value="2">Yes</choice>
<default>1</default>
<change>
<condition value="1">
<unset token="run_consolidations"></unset>
</condition>
<condition value="2">
<set token="run_consolidations">dbxquery</set>
</condition>
</change>
<search>
<query>| $run_consolidations$ connection=......
The run_consolidations token initially hides the chart and stops the query from running. When set by the dropdown, the chart is shown and query is run.
... View more
10-29-2018
10:00 PM
Hi ,
I have not tried this one yet , but i got some answers for this same issue
You can't set a time retention on hot or warm buckets. Only by size in MB. This is one of my huge gripes in Splunk.
You can use the Monitoring Console to gain some insight into how much data is in your hot/warm directories (x amount of days, for instance). The only time retention I've found is based on moving data from cold into frozen
Link to the original answer : https://answers.splunk.com/answers/501003/could-i-set-the-the-time-limit-on-hotwarm-buckets.html
... View more
10-28-2018
11:48 PM
1 Karma
Hi ,
Can you check on your job scheduler if today's run of that job has been completed or not.
The error you are getting maybe because of that . It can be possible that the job gets completed and returned 0 results.
or The job gets skipped for todays run
... View more
10-28-2018
10:55 PM
Hi ,
Please create the alert based on this
index=_audit "action=search" search=*delete*
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-18-2020
12:05 PM
|
