Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About pradeepk50
pradeepk50
Loves-to-Learn
Member since:
01-07-2020
05-18-2024
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-07-2020 |
Activity Feed
- Posted Re: Need to run the below query for a month on Splunk Search. 05-13-2020 10:28 PM
- Posted Re: Need to run the below query for a month on Splunk Search. 05-13-2020 10:05 AM
- Posted Re: Need to run the below query for a month on Splunk Search. 05-13-2020 09:11 AM
- Posted Need to run the below query for a month on Splunk Search. 05-13-2020 08:21 AM
- Tagged Need to run the below query for a month on Splunk Search. 05-13-2020 08:21 AM
- Tagged Need to run the below query for a month on Splunk Search. 05-13-2020 08:21 AM
- Posted Re: How do I display the date in my report with the the data ? on Splunk Search. 03-12-2020 10:15 PM
- Posted Re: How do I display the date in my report with the the data ? on Splunk Search. 03-12-2020 10:09 PM
- Posted Re: How do I display the date in my report with the the data ? on Splunk Search. 03-12-2020 08:55 AM
- Posted Re: How do I display the date in my report with the the data ? on Splunk Search. 03-12-2020 08:25 AM
- Posted Re: How do I display the date in my report with the the data ? on Splunk Search. 03-12-2020 08:23 AM
- Posted How do I display the date in my report with the the data ? on Splunk Search. 03-12-2020 03:20 AM
- Tagged How do I display the date in my report with the the data ? on Splunk Search. 03-12-2020 03:20 AM
- Tagged How do I display the date in my report with the the data ? on Splunk Search. 03-12-2020 03:20 AM
- Posted Re: dedup problem on Splunk Search. 03-12-2020 02:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-13-2020
10:05 AM
now hte AvgCount shwing value but its not correct.
as if run the query for one day the AVGCount will give as 10-14
but here i can see the number above 1k.
example:
_time AvgCount
2020-04-01 782757
2020-04-02 849822
... View more
05-13-2020
09:11 AM
Thank you , but the AvgCount is not displayed after using the provided query.
Only _time havintg the dates . under AvgCount its blank
... View more
05-13-2020
08:21 AM
Need to run the below query for a month
If i run the below query i will get results for the yesterday AVG count.
sourcetype="X"| bin _time span=1s | stats count by logtime | stats avg(count) | eval date=strftime(now()-86400, "%d-%m-%Y") | table date avg(count) | eval 'avg(count)'=round('avg(count)',0) | fields - avg(count)
Output:
date 'avg(count)'
12-05-2020 11
But i want to get the AVG count for a month or 6 months.
Please suggest me to update this query to get the results as expected for 6 months , each day AVG count i would need.
Thanks
Pradeep
... View more
03-12-2020
10:15 PM
Yeah, this is working as expected.
... View more
03-12-2020
10:09 PM
By the above query i am getting the date filed in the results but its getting today's date, but the report is running for yesterday's data. So we need to display yesterday's date.
... View more
03-12-2020
08:55 AM
Its like
logtime
for todays date and time --> the count will get displayed.
Like below
logtime count
2020-03-11 19:38:42 34
2020-03-11 17:30:53 29
2020-03-11 19:17:02 29
2020-03-11 17:17:36 28
... View more
03-12-2020
08:25 AM
by this i am getting count for that interval. Actually i am looking for complete day Max count with the date incorporated in that.
... View more
03-12-2020
08:23 AM
Perfect 🙂
so to get the date field this is the syntax " | eval Date = strftime(now(), "%F")" right ?
... View more
03-12-2020
03:20 AM
I am trying get the max count for the yesterday's but along with this i need to display the date in the report for yesterdays date?
Kindly help me to get the date in the results along with the existing results.
Query: sourcetype="x" name = "any" | bin _time span=1s | stats count by logtime | stats max(count)
Output for the above query is :
max(count)
34
Thanks In Advance
... View more
03-12-2020
02:59 AM
Hi ,
Try to use dedup before the 6th step.
index=juniper_vpn (ID=AUT22673 OR ID=AUT24803) ......67
| eval src_user=upper(src_user)
| join type=left user [| _accounts.csv |search domaine="intra"| eval user=matricule ]
| join type=left ua [|_dirigeant.csv | eval ua=UA ]
| dedup user
| rename user as Matricule, cn as Nom, ua as UA
Let me know if that works 🙂
Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-18-2024
12:51 PM
|
