About jerinvarghese

ITWhisperer · ‎11-14-2024

Your by clause also include dv_priority which is why you are getting multiple results for an incident. Try something like this index=snow "INC783" | search dv_state="In Progress" OR dv_state="New" OR dv_state="On Hold" | stats max(_time) as Time latest(dv_state) as State latest(dv_priority) as Priority by number | fieldformat Time=strftime(Time,"%Y-%m-%d %H:%M:%S") | table number,Time, Priority, State

ITWhisperer · ‎11-15-2022

There are a couple of things you might want to change - you could use the max_match option to limit the number of matches, you could use the carat (^) to anchor the match to the beginning of the field, you could use \w instead of the double negative (^ in the square brackets means not, \W means not \w, so ^\W should be equivalent to \w) | rex max_match=1 "(?<SITE_NAME>^\w{3})"

richgalloway · ‎08-04-2022

I'm not sure why that didn't work. Let's try an alternative. index=opennms DESCRIPTION="QIT-LAG" | transaction nodelabel startswith=eval(Status="DOWN") endswith=eval(Status="UP") keepevicted=true ```Omit "blank" results``` | where closed_txn=1 | bin span=1d _time | stats values(DESCRIPTION) as DESCRIPTION, sum(downtime) as total_downtime by _time | eval pct_loss = (total_downtime * 100) / 86400 | rename _time as Time | fieldformat Time=strftime(Time,"%Y-%m-%d") | table DESCRIPTION, total_downtime, Time, pct_loss

ashvinpandey · ‎12-28-2021

@jerinvarghese Change your drilldown tag in the first panel as shown below: <drilldown> <set token="message_token">$row.cisco_mnemonic$</set> <set token="hostname_token">$row.hostname$</set> </drilldown> If this didn't work you must also try the solution given by @richgalloway Also if this reply helped you in solving your problem, an up-vote would be appreciated.

jerinvarghese · ‎12-17-2021

HI All, I have a DB querry, need a help in date filter. | dbxquery connection="ITDW" shortnames=true query="SELECT GETDATE() as 'CurrentTime', [Incident_Number], INC.[Company], [Customer], PPL.Region as 'Customer_Region', PPL.Site_Group as 'Customer_Site_Group', PPL.Site as 'Customer_Site', [Summary], [Notes], [Service], [CI], [Impact], [Urgency], [Priority], [Incident_Type], [Assigned_Support_Group], [Assigned_Support_Organization], [Status], [Assignee], [Status_Reason], [Resolution], [Reported_Date], [Responded_Date], [Closed_Date], [Last_Resolved_Date], [Submit_Date], [Last_Modified_Date], [Owner_Group] FROM [shared].[ITSM_INC_MAIN] INC LEFT OUTER JOIN [shared].[ITSM_CMDB_People_Main] PPL ON INC.Customer_ID = PPL.Person_ID WHERE (([Assigned_Support_Group] = 'Ops-WAN')) AND [Submit_Date] BETWEEN DATEADD(D,-700,GETDATE()) AND GETDATE()" I want some data which is old , filter only data that is of 2019, but when i search for more than 300 days. its not showing the accurate data. how can i add a specific year or between date in the code.

gcusello · ‎12-06-2021

Hi @jerinvarghese, what do you really intend with filter? do you want to extract the strinbgs between quotes in a field or don't display them? if you want to put in a field called "Event_Log", you could use a regex like this: | rex "\"(?<Event_Log>[^\"]+)\"" you can test the regex at https://regex101.com/r/hkPiCZ/1 ciao. Giuseppe

ITWhisperer · ‎04-25-2021

Add fillnull after the join | inputlookup ONMS_nodes.csv | table nodelabel | join type=outer nodelabel [ search index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | table nodelabel Status ] | fillnull value="Down" Status | table nodelabel Status

tscroggins · ‎04-24-2021

@jerinvarghese In SPL, you can count rows and columns and add xyseries to reformat by row/column: | inputlookup ONMS_nodes.csv | table nodelabel | streamstats reset_after="rows==10" count as rows | streamstats count as columns | eval columns=floor((columns-1)/10) | xyseries rows columns nodelabel | sort rows | fields - rows In this example, the columns (fields) are labeled 0, 1, 2, ..., 9. You can't give multiple fields the same label, but you can prefix them with "nodelabel" to make them a little more descriptive: | inputlookup ONMS_nodes.csv | table nodelabel | streamstats reset_after="rows==10" count as rows | streamstats count as columns | eval columns=floor((columns-1)/10) | xyseries rows columns nodelabel | sort rows | fields - rows | foreach * [ rename <<FIELD>> as nodelabel_<<FIELD>> ]

tscroggins · ‎04-24-2021

jerinvarghese · ‎04-07-2021

Hi Team, I am having few devices located across the globe and want to monitor only during their Business hour timings only. index=opennms | fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S") | table DEVICE,ALERT,SITECODE,COUNTRY,REGION,TIME_ZONE Output : DEVICE ALERT SITECODE COUNTRY REGION TIME_ZONE FRNDG DEVICE DOWN NDG France Europe +01:00 FRNDG INTERFACE DOWN NDG France Europe +01:00 SGACB BGP DOWN ACB Singapore Asia Pacific +08:00 NGERH INTERFACE UTILIZATION ERH Nigeria Middle East / Africa +01:00 USBMT ISIS FLAP BMT United States North America -06:00 USBTN BGP DOWN BTN United States North America -06:00 SGSNG INTERFACE DOWN SNG Singapore Asia Pacific +08:00 USEMC DEVICE DOWN EMC United States North America -06:00 CAKRL INTERFACE DOWN KRL Canada North America -07:00 FRFOS BGP DOWN FOS France Europe +01:00 only during the 9AM to 5PM of that business hour of that country Splunk should search for alerts or generate alerts and rest all time it should disable the alerting, is that possible.

richgalloway · ‎03-06-2021

Try this (index=opennms "Cisco-WLC-AP-DOWN/AP*") OR index=moogsoft_e2e | stats values(*) as * by AP_NAME, downtime | table AP_NAME, Time,Ticket_ID, downtime

jerinvarghese · ‎02-23-2021

related doubt on the main program, If i want to add a sparkline to that that, how can i get it.

renjith_nair · ‎01-25-2021

alright, Try index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | lookup ONMS_nodes.csv nodelabel OUTPUT sitecode | table sitecode, nodelabel, Status,Time | eventstats values(eval(if(match(nodelabel,"WANRTC|LANCCO|WLNWLC|APNINT"),1,null()))) as isPresent by app | where isPresent == 1

manjunathmeti · ‎01-20-2021

I've updated my answer please check it.

bowesmana · ‎01-12-2021

@jerinvarghese Note that in principle, @scelikok reply will not put <single> visualisations on top of each other inside a single panel. Generally <single> entries will be tiles horizontally within a panel, whereas other visualisations in that panel will be stacked vertically. However, you can change that simply by adding the following empty html visualisation between singles so that it will then force them to stack vertically, so add <single> ... </single> <html/> <single> ... </single> Naturally within that html you can do anything to adjust spacing between the other visualisations and the height of an individual visualisation can be adjusted with the <option name="height">214</option> to whatever height you want.

scelikok · ‎12-09-2020

@jerinvarghese , you should filter the Downtime values before formatting like below; index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify" | rex field=eventuei "ciscoLwappApIf(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | where Status="DownNotify" | fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S") | eval Downtime = now() - Time | where Downtime > 3600 | eval Downtime = tostring(Downtime, "duration") | rex field=Downtime "(?P<Downtime>[^.]+)" | table nodelabel, Status, Downtime, Time

richgalloway · ‎10-20-2020

Have you tried this? <format type="color" field="nodelabel"> <colorPalette type="expression"> if (like(value,"%WANRT%") OR like(value, "DCNDC%"),"#FF5733","#FFFFFF")</colorPalette> </format>

gcusello · ‎10-20-2020

Hi @jerinvarghese, your solution is like mine, but beware if the second search could have more than 50,000 results, because there's this limit in subsearches. then beware to use the same field name for count. Ciao. Giuseppe

ITWhisperer · ‎09-16-2020

jerinvarghese · ‎09-14-2020

HI, My order is coming as below. how can i make it on order. I tried above qury and that provides me output, but all the order is in alphabetical order not in the month wise order. its not useful data. Please help me get it in month wise order Class Aug-20 Jul-20 Sep-20 NODEDOWN 200 200 20

ITWhisperer · ‎09-04-2020

I haven't used dbxquery but I suspect Submit_Date is coming back as a string, so you need to parse the string into a time value ... | eval Time=strptime(Submit_Date, "<whatever time format the query is returning") ... You can then add the 10.5 hours to this ... | eval Time=Time+(10.5*3600) ... (you might be able to put the addition at the end of the previous eval) Then, to change the way it is displayed, use fieldformat ... | fieldformat Time=strftime(Time,"%Y-%m-%d %H:%M:%S") ...

jerinvarghese · ‎08-25-2020

Thanks for the reply, got that worked with Eval before this solution. Seems Eval is simpler than other methods. Sorry to others too. I got the answer worked with eval statement. | eval Time=strftime(_time,"%Y-%m-%d %l:%M:%S %p")

isoutamo · ‎08-20-2020

Hi please try to add one more \ to your regexp | rex field=_raw "Class:\s(?<Class_Type>[^\\\]+)" And for second case add max_match=0 after field=_raw r. Ismo

gcusello · ‎08-07-2020

Hi @jerinvarghese, as I said, I don't like join so I prefer the second solution that I hint to explore and use: you are using a DB approach, but Splunk isn't a DB! About your problem, did you tried to invert the two searches? Ciao. Giuseppe P.s.: Karma Points are appreciated 😉

richgalloway · ‎08-05-2020

OK. I thought that might be the case, but it wasn't stated. The clauses you tried won't work because they're comparing strings to integers. You must compare numbers to numbers. index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S %p") | sort- Time | eval Downtime = now() - Time | where Downtime > 900 | fieldformat Downtime = tostring(Downtime, "duration") | rex field=Downtime "(?P<Downtime>[^.]+)" | table Hostname Status Classification "Site Code", sitename, Time Downtime

Posts	85
Solutions	0
Karma Given	9
Karma Received	2
Member Since	‎12-18-2019

Online Status	Offline
Date Last Visited	‎11-14-2024 11:32 AM

Stats command with latest values listing

Help with regex search?

How would I prepare this availability calculator?

Click Selection not working.

DBxquery help

Need help on Rex filter

Combining 2 outputs together to form a single outp...

Split Single columns in equal multiple columns

Highest value selection from table

Time based Monitoring

Re: Stats command with latest values listing

Re: regex query

Re: Need help in a availability calculator

Re: Click Selection not working.

DBxquery help

Re: Need help on Rex filter

Re: Combining 2 outputs together to form a single ...

Re: Split Single columns in equal multiple columns

Re: Highest value selection from table

Time based Monitoring

Re: COmpare or join 2 fields to 3rd output

Re: Code to prepare a Comparison Result table.

Re: IF Statement customized EVAL

Re: Need help in 2 stats operator

Re: splitting panels into half

Re: Duration Filter help

Re: Specific keyword based colour

Re: Multi Index combination

Re: monthly Chronology order.

Re: Splunk search for each month

Re: Time conversion in dbxquery

Re: Time based counting.

Re: Regex field help

Re: Join index's together.

Re: Time duration filter