Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Arun_N_007
Arun_N_007
Communicator
Member since:
11-18-2013
06-05-2020
Community Statistics
| Posts | 68 |
| Solutions | 3 |
| Karma Given | 8 |
| Karma Received | 13 |
| Member Since | 11-18-2013 |
Activity Feed
- Karma Re: stats and eventstats for SanthoshSreshta. 06-05-2020 12:47 AM
- Karma Re: How to use the Sankey diagram from the Splunk Web Framework Toolkit? for vganjare. 06-05-2020 12:47 AM
- Karma Re: Bundle Replication in Splunk for woodcock. 06-05-2020 12:47 AM
- Karma Re: Can I index select events but store all raw events in Splunk? for acharlieh. 06-05-2020 12:47 AM
- Karma Re: exclude asterisk character from a search for woodcock. 06-05-2020 12:47 AM
- Karma Re: What are the definitions of Tag and Eventtype and what are the differences between the two? for woodcock. 06-05-2020 12:47 AM
- Karma Re: Internal Mapreduce in Splunk for aweitzman. 06-05-2020 12:47 AM
- Got Karma for Re: custom X-axis value. 06-05-2020 12:47 AM
- Got Karma for Re: can we give colors in Geostats based on ranges of some value?. 06-05-2020 12:47 AM
- Got Karma for Re: stats and eventstats. 06-05-2020 12:47 AM
- Got Karma for Re: stats and eventstats. 06-05-2020 12:47 AM
- Got Karma for Re: Search failing to show last formula. 06-05-2020 12:47 AM
- Got Karma for Re: Search failing to show last formula. 06-05-2020 12:47 AM
- Got Karma for Re: Search failing to show last formula. 06-05-2020 12:47 AM
- Got Karma for Re: Can I index select events but store all raw events in Splunk?. 06-05-2020 12:47 AM
- Got Karma for Re: exclude asterisk character from a search. 06-05-2020 12:47 AM
- Got Karma for Re: How to search when an event was indexed?. 06-05-2020 12:47 AM
- Got Karma for Re: How to search when an event was indexed?. 06-05-2020 12:47 AM
- Got Karma for Re: Is there a way to view the contents of saved csv on a lookup table from Splunk Web?. 06-05-2020 12:47 AM
- Got Karma for Re: Using lookups against multiple sources (with differing field names for the same value). 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-22-2018
03:16 AM
Yes i did the same but no luck 🙂
... View more
01-22-2018
02:54 AM
But it will put a lot of load on the DB. We thought of fetching all rows at once.
... View more
01-16-2018
07:47 AM
I did this also. Not working 🙂
... View more
01-16-2018
07:47 AM
Yes, Indexes blr,chn,del are already created. We need to use separate indexes to avoid people from accessing other's data.
... View more
01-16-2018
01:11 AM
Yes, Am using the single instance of Splunk.
... View more
01-16-2018
12:56 AM
Hi @harsmarvania57,
I pushed above but not working 😞
Yes data will be in Computer="BLR0057" Application="Calculator" Duration="30" format only.
Regards,
Arun N
... View more
01-15-2018
10:44 PM
Hi,
I have below table in my database.
Computer Application Duration
BLR0057 Calculator 30
CHN0056 MS-Word 43
DEL0078 MS-Excel 55
But I need to forward each row to different index based on Computer name.
Tried to use,
props.conf
[sourcetype::application_usage_data]
TRANSFORMS-index_extraction = index_extraction
transforms.conf
[index_extraction]
SOURCE_KEY = _raw
REGEX = .Computer="(P?\w{3}?).".*
DEST_KEY = _MetaData:Index
FORMAT = $1
WRITE_META = true
Here index names are blr, chn, del. But data is getting indexed in index name from db-inputs.conf 😞
How to achieve data routing to different indexes in DB Connect?
Regards,
Arun N
... View more
01-06-2017
12:10 AM
|stats count|eval _raw="Application photobuf message : dhfksdhkfhksdhfk hdfkshfskhfk dfhkshdfkshfhs"|append [|stats count|eval _raw="Application Data loaded successfully for Photo No - 123456789 ; OrderIPlaceno - 987654321"]| eval delim = if(like(_raw,"%:%"),":","for")|eval _raw=split(_raw,delim)|eval split1=mvindex(_raw,0)|eval split2=mvindex(_raw,1)
... View more
01-05-2017
03:10 AM
Use match or like inside if condition to find message type based on that set the delim.
..| eval delim = if(like(_raw,"%:%"),":","for")
... View more
01-05-2017
02:12 AM
Here am not using AD... I need authentication done by system specific to our product and Splunk should let me in.
Can we use external scripts to achieve this? And here we want to pass only username and Web session id here... Which can be validated in script to let me in Splunk.
... View more
01-05-2017
02:07 AM
Try to convert loadAvgIni to number using
..|eval loadAvgIni=tonum(loadAvgIni)|timechart avg(loadAvgIni)
And then do timechart it should work...
Or
You can check loadAvgIni is extracted or not using
index=os host=PC2 sourcetype=vmstat loadAvgIni=*
If it is not returning any data you must extract the field first.
Use multikv to extract values.
index=os host=PC2 sourcetype=vmstat|multikv|timechart avg(loadAvgIni)
Regards,
Arun N
... View more
01-05-2017
02:01 AM
No embed report got some limitations like...
No real time search
Report should be
pre populated and should be loaded
with saved searches.
I need to show my
Splunk dashboard UI in an iframe.
... View more
01-05-2017
01:22 AM
Hi,
I would like to embed Splunk as an iframe in my we application. Here we need to load Splunk dashboard on load of the page bypassing its authentication.
Here Authentication will be done for that user in third party system while logging in to my web app.
Here am not talking about the insecure login which passes password in the header. Can i use HTTP POST for insecure login? If yes then how?
Regards,
Arun
... View more
08-15-2016
11:33 PM
Hi,
Please correct me if am wrong,
You need a total count in the same panel of a pie chart?
It can be done using single value and pie chart in the same panel, here you need to use post process search picking total for single value and other values for pie chart.
Ex:-
Base search
..|eventstats sum(count) as Total|table Source,count,Total
Dependent Search 1 (For Pie chart)
table Source,count
Dependent Search 2 (For Single Value)
stats values(Total) as Total|table Total
If you don't want you use single value.
Use Java Script to find a total and set a token to display in the html tag inside a panel.
... View more
05-31-2015
10:03 PM
Could you please give some sample data and let me know.
In what format it is and in what format you need?
Its better you provide some raw data.
Arun
... View more
05-31-2015
08:40 PM
Thank you Aweitzman.
Could you please have a look into my below posts :). Its been 2 weeks i didnt got any answers yet :(...
http://answers.splunk.com/answers/239222/when-to-use-django-approach-in-splunk-apps.html
http://answers.splunk.com/answers/237073/is-dynamic-query-construction-possble-in-splunk-wi-1.html
... View more
05-29-2015
04:10 AM
@aweitzman,
Yes i went though this doc but here they mentioned something like unparallelizable command.
If i find unparallelizable command as second command in search with 100 commands then will all other 98 commands will be converted into reduce processes?
What is pretimechart (Intermediate command for timechart??)????
... View more
05-28-2015
03:29 AM
Hi,
I need to know how map functions and reduce functions are constructed using search string?
In one of the white paper i came across finding first reduce command (Which cannot be parallelized)...
How it happens in Splunk internally? Where the intermediate data will be shown?
What is pretimechart (Intermediate command for timechart??)????
Arun
... View more
05-27-2015
12:37 AM
Hi,
Could you please have a look into the table which generated this graph?
Check whether the values are in sync??
... View more
05-26-2015
09:52 PM
You cant alter macros.conf without using SDKs.
But you can save the query in a lookup instead of macro and modify it as per lookup changes. And in using map command (But it can return only 10K records) invoke the modified query.
... View more
05-26-2015
08:39 PM
Hi Woodcock,
Any other way to achieve this use case other than using map..
Any equivalent to map without 10K limit???
... View more
05-26-2015
04:36 AM
Thank you woodcock,
For showing unknown approach 🙂
But still map got limit of 10K (due to Sub Search limit) :)..
I know that if am using SDKs I can accomplish inside commands but I don't have SDK.
... View more
05-24-2015
11:05 PM
Hi,
Use case is like,
I need to calculate the average completion time of Jobs.
Period is configurable.
I have list of Jobs in Lookup for which i need to caluclate averages.
In that list i have different type of Jobs for which calculation Logic (Due to time format and all...) differs.
Since Splunk got limit on transformation commands like stats,eventstats(50K) i need to make sure that scaling should be done based on limit.
I should be able to design buckets dynamically using queries. And Average query should run for each buckets without any manual intervention.
... View more
05-23-2015
12:24 PM
Thank you woodcock. Can you provide the link which explains better in Splunk docs???
... View more
05-23-2015
12:22 PM
Hmm I tried that you cant return a macro name with parameters using return statement.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
