Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About hogan24
hogan24
Path Finder
Member since:
11-08-2013
06-05-2020
Community Statistics
| Posts | 29 |
| Solutions | 4 |
| Karma Given | 3 |
| Karma Received | 17 |
| Member Since | 11-08-2013 |
Activity Feed
- Got Karma for Removing null columns from a table. 07-23-2021 02:56 PM
- Karma Re: How to enable caching of dashboard panels? for linu1988. 06-05-2020 12:47 AM
- Got Karma for Removing null columns from a table. 06-05-2020 12:47 AM
- Got Karma for Re: Why is splunkweb not starting after a new Splunk installation on Windows 8 64-bit?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is splunkweb not starting after a new Splunk installation on Windows 8 64-bit?. 06-05-2020 12:47 AM
- Got Karma for Re: Custom datetime.xml for x12 format. 06-05-2020 12:47 AM
- Got Karma for Custom datetime.xml for x12 format. 06-05-2020 12:47 AM
- Got Karma for Re: How to write regex or MV command to extract multiple values?. 06-05-2020 12:47 AM
- Got Karma for Re: How to write regex or MV command to extract multiple values?. 06-05-2020 12:47 AM
- Got Karma for Re: How to write regex or MV command to extract multiple values?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I remove a null field?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I remove a null field?. 06-05-2020 12:47 AM
- Got Karma for Re: How do I remove a null field?. 06-05-2020 12:47 AM
- Got Karma for Removing null columns from a table. 06-05-2020 12:47 AM
- Got Karma for Removing null columns from a table. 06-05-2020 12:47 AM
- Got Karma for Removing null columns from a table. 06-05-2020 12:47 AM
- Got Karma for Removing null columns from a table. 06-05-2020 12:47 AM
- Karma Form: one search inside a row with multiple panels for iKate. 06-05-2020 12:46 AM
- Got Karma for Multiple searchTemplate and searchPostProcess to populate Dashboard Panels. 06-05-2020 12:46 AM
- Karma events not deleting with | delete for tawollen. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 0 |
05-24-2016
01:00 PM
Yes I believe the checkpoint value is the issue b/c it's only going to look for events after that time. Assuming you have no events after the year 2023 already in your DB, then yes, that is the problem.
... View more
01-25-2016
09:37 AM
Using an Input to as a variable in another input....
<input type="dropdown" token="INPUT_4" searchWhenChanged="true">
<label>Input Variable:</label>
<search>
<query>index=indexName sourcetype=sourcetypeName | top limit=100 $INPUT_3$ | sort $INPUT_3$</query>
<earliest>-3d@d</earliest>
<latest>@d</latest>
</search>
<fieldForLabel>$INPUT_3$</fieldForLabel>
<fieldForValue>$INPUT_3$</fieldForValue>
</input>
Each time I reload the dashboard, I keep getting double dollar signs around my Label and Value fields. How can I prevent this from occurring? (Splunk Version 6.3.0)
<fieldForLabel>$$INPUT_3$$</fieldForLabel>
<fieldForValue>$$INPUT_3$$</fieldForValue>
... View more
08-03-2015
11:25 AM
3 Karma
Here's how you'd do it with a regex:
| rex field=_raw max_match=100 "(?:locateIds_\d{1,2}=)(?<fieldName>[^,\s]*)"
... View more
07-23-2015
01:08 PM
@woodcock's 2nd search below the text that reads "or even this" is by far the best/correct way to do it. I have searches running that way in my environment as well and that method does work.
I'm specifically referring to this part of passing the token into the query:
AND c.automaker=$automaker$"
... View more
07-23-2015
01:00 PM
Ack, just realized the date as to when this question was posted. Hopefully someone will still find this helpful. Cheers!!
... View more
07-23-2015
12:59 PM
Create a saved search and schedule it to run at approx every 30m (or whatever interval works for you).
This will cache the results of the query and make the results available for reference using the 'loadjob' command. If your saved search is called 'DBQuerySearch' you could do something like this:
| loadjob savedsearch="^searchOwner^:^appName^:DBQuerySearch"
Using this method, you can run the database query only once per your chosen interval, but serve up the results over and over to multiple users. Hope that helps. Thanks!
http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Loadjob
... View more
07-23-2015
08:19 AM
I dont fully understand your specific search but I have a suggestion in regards to what your asking for....
In your base search and sub-search, hard-code the time range (earliest=-24h latest=now) to guarantee you get the time range you're looking for. (The cron schedule controls when the search is performed. The earliest/latest fields control the range of data pulled within the search.)
Get the specific hour of each transaction (including day/month/year in integer format so you can select the max to get the most recent hour)
| eval hour=strftime(_time,"%Y%m%d%H")
Get the previous hour as well...
(this assumes the alerts is run hourly on the hour and therefore looks at the previous hour. ie: Running the search at 10am will look at the 9am hour of data.)
| eval previousHour=tonumber(strftime(now(),"%Y%m%d%H"))-1
Then add both of these to your stats so you have a row for each hour...
| stats ........ by hour previousHour
Use eventstats to summarize/total everything if needed for the grand total over the previous 24 hours.
Then filter down to get only 1 hours worth of data in your final results and alert on that...
| where hour = previousHour
Hope that's helpful. Thanks.
... View more
06-24-2015
12:07 PM
splunkweb is no longer included in 6.2. It's all rolled into splunkd. So there's no need to worry about splunkweb not starting. That is by design. Thanks.
... View more
06-18-2015
10:34 PM
try adding something like this after your stats command:
| eval awol = max(timestamp)
| table awol
That will show you what awol is calculating to and you can then adjust accordingly.
... View more
06-18-2015
08:09 PM
have you tried running something simple from the search screen like this:
| dbquery dbConnectionName "select sysdate from dual"
This would return something immediately and validate if the connection to your db is actually in tact.
... View more
06-18-2015
02:43 PM
Not sure if I completely understand the question b/c you say there are 3 different patterns but then you give the format you're trying to capture. But give this a shot....
Try using a props/transforms combo like this:
props.conf
[sourcetypeName]
REPORT-getData = getLogData
transforms.conf
[getLogData]
DELIMS = "|"
FIELDS = MsgID, DateTime, MessageType, Icon, Message, ObjectType, ObjectID, ObjectID2, IPAddress, Caption, BackColor, Acknowledged, ActiveNetObject, NetObjectPrefix
You can then search by each name in the 'FIELDS' section and I believe you'll be good-to-go.
... View more
06-18-2015
02:35 PM
1 Karma
I figured this one out...I was trying to do my prefix in the regex which I believe was causing an issue. So I removed the everything in the regex up to the actual timestamp itself and put the prefix regex stanza in the TIME_PREFIX var leaving my props.conf to look like this:
[x12:270]
TRUNCATE = 0
DATETIME_CONFIG = /etc/apps/x12/local/datetime.xml
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_PREFIX = ~GS\*(?:.*?\*){3}
Here is what datetime.xml ended up looking like:
<datetime>
<define name="_year" extract="year">
<text><![CDATA[(20\d\d|19\d\d|[901]\d(?!\d))]]></text>
</define>
<define name="_month" extract="month">
<text><![CDATA[(0?[1-9]|1[012])(?!:)]]></text>
</define>
<define name="_day" extract="day">
<text><![CDATA[(0?[1-9]|[12]\d|3[01])]]></text>
</define>
<define name="_hour" extract="hour">
<text><![CDATA[([01]?[1-9]|[012][0-3])(?!\d)]]></text>
</define>
<define name="_minute" extract="minute">
<text><![CDATA[([0-6]\d)(?!\d)]]></text>
</define>
<define name="_second" extract="second">
<text><![CDATA[([0-6]\d)(?!\d)]]></text>
</define>
<define name="_x12date1" extract="year, month, day, hour, minute, second">
<text><![CDATA[(19\d\d|20\d\d)(0?[1-9]|1[012])(0[1-9]|[12]\d|3[01])\*(\d{2})(\d{2})(\d{2})]]></text>
</define>
<define name="_x12date2" extract="year, month, day, hour, minute">
<text><![CDATA[(19\d\d|20\d\d)(0?[1-9]|1[012])(0[1-9]|[12]\d|3[01])\*(\d{2})(\d{2})]]></text>
</define>
<timePatterns>
<use name="_x12date1"/>
<use name="_x12date2"/>
</timePatterns>
<datePatterns>
<use name="_x12date1"/>
<use name="_x12date2"/>
</datePatterns>
</datetime>
... View more
06-18-2015
06:45 AM
Which version of Splunk did you install?
... View more
06-17-2015
01:26 PM
2 Karma
In splunk 6.2...the splunkweb service has been incorporated into the splunkd service.
http://docs.splunk.com/Documentation/Splunk/6.2.3/Installation/Aboutupgradingto6.2READTHISFIRST
... View more
06-17-2015
12:10 PM
1 Karma
Trying to get datetime.xml configured to recognize a timestamp in x12 file format with no success...
Here are the possibilities of what the data could look like within the file:
[~GS*HS*123456*ASDF*20150519*0642896109*X*005010X279~
[~GS*HS*123456*ASDF20150519*064201896109*X*005010X279~
[~GS*HS*123456*ASDF20150519*06420123*896109*X*005010X279~
<datetime>
<define name="_x12date" extract="year, month, day">
<text><![CDATA[(?:~GS\*(?:.*?\*){3})(19\d\d|20\d\d)(0?[1-9]|1[012])(0[1-9]|[12]\d|3[01])(?:\*)]]></text>
</define>
<define name="_x12time1" extract="hour, minute, second, subsecond">
<text><![CDATA[(?:~GS\*(?:.*?\*){4})(\d{2})(\d{2})(\d{2})(\d{2})(?:\*)]]></text>
</define>
<define name="_x12time2" extract="hour, minute, second">
<text><![CDATA[(?:~GS\*(?:.*?\*){4})(\d{2})(\d{2})(\d{2})(?:\*)]]></text>
</define>
<define name="_x12time3" extract="hour, minute">
<text><![CDATA[(?:~GS\*(?:.*?\*){4})(\d{2})(\d{2})(?:\*)]]></text>
</define>
<timePatterns>
<use name="_x12time1"/>
<use name="_x12time2"/>
<use name="_x12time3"/>
</timePatterns>
<datePatterns>
<use name="_x12date"/>
</datePatterns>
</datetime>
props.conf looks like this:
[x12:270]
TRUNCATE = 0
DATETIME_CONFIG = /etc/apps/x12/local/datetime.xml
Any help would be appreciated as to why the timestamp is not being picked up. Thanks.
... View more
- Tags:
- datetime.xml
06-04-2015
12:57 PM
Here's another way that I think may be more what you're looking for:
| eval SubTotal1 = if(columnName=="SubTotal1", countColumnName, null)
| eval SubTotal2 = if(columnName=="SubTotal2", countColumnName, null)
| eval SubTotal3 = if(columnName=="SubTotal3", countColumnName, null)
| table SubTotal1 SubTotal2 SubTotal3
| stats sum(SubTotal1) as SubTotal1 sum(SubTotal2) as SubTotal2 sum(SubTotal3) as SubTotal3
| eval GrandTotal = SubTotal1+SubTotal2+SubTotal3
... View more
06-04-2015
12:49 PM
Ahh, I think I see what you're saying. You're getting multiple rows and you want to have 1 row with multiple columns, is that correct? If so, try piping the results to 'transpose' (| tranpose) and see if that puts you in the right direction.
... View more
06-04-2015
12:19 PM
If I'm understanding your question correctly, I believe something like this should work:
| eval GrandTotal = SubTotal1+SubTotal2+SubTotal3
| table Place SubTotal1 SubTotal2 SubTotal3 GrandTotal
... View more
06-04-2015
09:32 AM
@jeffland, this is a comment, not an answer. can you delete this as an answer?
"...how do you think it would work?" That's what i'm asking.
I want to include it in the table b/c it may have data. I want to include all columns that may have data. Then remove the column if it does not have data.
... View more
06-04-2015
08:21 AM
Correct. This is for a dashboard view that I will be turning over to users so I want to simplify the view if a column does not have data.
... View more
06-04-2015
07:44 AM
6 Karma
I've found some previous posts with similar questions but the results dont seem to be correct so I'm hoping someone can help with this one...
I have something like this:
mysearch | table column1 column2 column3
With results like this:
column1 --- column2 --- column 3
asdfasdf --- 123456
bsdfasdf --- 234567
csdfasdf --- 345678
Sometimes column3 will have data, sometimes it wont. How (after piping to table) can I remove column3 if it has no data (and preferably keep the columns in order as well)? Thanks.
... View more
05-29-2015
07:50 AM
3 Karma
I had a similar issue where I was trying to display the data in a 2 column/multi-row format so I did this:
| table datafield1 datafield2 datafield3 datafield4 datafield5 ...
| transpose
| rename column as Data "row 1" as Value
| where Value NOT NULL
This gives me the ability to put in as many fields as I want (which visually is very wide), flip it (| transpose) to only give me 2 columns, and remove every row with no data (| where). Hope this helps. Thanks.
... View more
07-08-2014
07:07 AM
Are there any updates to this? I followed the steps above and deleted the mentioned files under "C:/Program Files/Splunk/var/lib/splunk/defaultdb/db" and restarted splunk. Then reran the |delete command and my delete is still hanging. Any additional help would be appreciated. Thanks.
... View more
04-16-2014
01:09 PM
I am receiving the same error in Splunk 6.0.3. Is there a resolution to this yet?
... View more
