About Deprasad

Deprasad · ‎10-07-2022

I have a query which displays top 10 consumed sourcetype. I would like to enable drilldown to achieve the below task. When user clicks on a particular row, it should open a new tab and a new query should get executed for each row . Right now, I have enabled Drilldown ->On Click-> Link to Search->Custom->Search String->Apply. In this way I can have the same query gets executed on selection of any rows. But I would like to define different queries for different rows based on the selection. Is this possible with Drilldown?

Deprasad · ‎08-30-2022

Thanks for this query @richgalloway ! It worked. Further I added the below piece of query to get the percentage. | eval Error_Percentage=round(100*count/Total_Transaction,2)."%" | table Error_Message,count, Error_Percentage

Deprasad · ‎08-30-2022

I've 2 queries, 1 will give the the total no of events and the other will give the counts by error type. I'm trying to join the two queries so that I can get the percentage of each error type. Query 1: index=app "ResponseLoggingFilter" "Operation" | stats count as Total_Transaction Query 2: index=app "ResponseLoggingFilter" "Operation" NOT "OK" NOT "1041" | rex "(?:.+message\"\:\")(?<Error_Message>.+)(?:\"\,)" | stats count by Error_Message

Deprasad · ‎06-09-2021

I would like to have my dashboard delivered in CSV format rater than PDF. Is it possible in Splunk? I have a total of 90 panels so can't rely on Reports. Please clarify

Deprasad · ‎01-08-2021

Thanks!! The payload you used in the regex101 is not same as the provided. Though it worked in Regex101, still faced the same issue with Splunk. Tried the solution suggested by @ITWhisperer and it worked.

Deprasad · ‎01-08-2021

Thanks!! that's worked. 🙂

Deprasad · ‎01-08-2021

Trying to Pick domainType and domainName from below log using the below regex: It works in regex101 but not in Splunk, it gives a blank column. domainName - rex"(?:domainName\\\"\:\\\")(?<domainName>([a-zA-Z0-9-\.]+))" domainType - rex"(?:domainType\\\"\:\\\")(?<domainType>\w)" "payload":"{\"domainType\":\"L\",\"modifiedBy\":\"\",\"relayHost\":\"\",\"rewriteDomain\":\"\",\"wildcardAccount\":\"\",\"domainName\":\"xxx.yyyyy.com\"}"},"encoding":null,"contentType":"application/json","responseCode":null}

Deprasad · ‎02-17-2020

strptime(Date, "%m/%d") gave a blank result for Date. Gone through Splunk documentation and found for epoch time conversion the command is strftime(x,y). Thanks for the help..!!

Deprasad · ‎02-17-2020

Thanks..! This is working, however the date field is in epoch format.

Deprasad · ‎02-17-2020

I have a query which extracts counts for last 30 days. But the dates are not in proper order in result. index = *** "search phrase" | stats count by date_mday | rename date_mday as Date If i make a search today for last 30 days, the result should be in the below order . 01/18, 19, 20 .......... 02/16,02/17.

Deprasad · ‎01-09-2020

Thanks @groktrev !! It worked with max_match command.

Deprasad · ‎01-09-2020

Thanks @to4kawa !! It worked with max_match command.

Deprasad · ‎01-09-2020

Thanks for the suggestion @niketnilay !!

Deprasad · ‎01-09-2020

@aberkow - Thanks a lot..!! It worked like a charm.

Deprasad · ‎01-03-2020

Log looks like this. {...\"Key_name\":\"Value\",....}, {...\"Key_name\":\"Value\",....}, {...\"Key_name\":\"Value\",....}, {...\"Key_name\":\"Value\",....}, My query now extracting the first field alone. I've created a query which extracts all 4 value using append search with subsequent string from each row but the search takes lots of time since it involves 4 append search. All i need now is to fetch all 4 value into the column key_name in a single query.

Deprasad · ‎01-02-2020

I have a report generated with following fields, Field 1 , Field 2, Field 3. I have to create an alert based on the Field 1(it's a phone number field which consists 0-9 , - , +, *) value satisfying below condition. • Number starts with 101 and is greater than 5 digits • Number starts with *xy101 and is greater than 8 digits • Number starts with *xy011 and is greater than 8 digits

Posts	16
Solutions	1
Karma Given	2
Karma Received	2
Member Since	‎01-02-2020

Online Status	Offline
Date Last Visited	‎10-07-2022 08:12 AM

Using Drilldown feature: How to define different q...

Query to get Percentage using two Queries?

Schedule CSV of Splunk Dashboard

Regex not working

How to extract the dates in order in a dashboard

How to pick multiple value which has same key name

How to pattern match with the extracted field

Using Drilldown feature: How to define different q...

Re: Query to get Percentage using two Queries.

Query to get Percentage using two Queries?

Schedule CSV of Splunk Dashboard

Re: Regex not working

Re: Regex not working

Regex not working

Re: How to extract the dates in order in a dashboa...

Re: How to extract the dates in order in a dashboa...

How to extract the dates in order in a dashboard

Re: How to pick multiple value which has same key ...

Re: How to pick multiple value which has same key ...

Re: How to pick multiple value which has same key ...

Re: How to pick multiple value which has same key ...

How to pick multiple value which has same key name

How to pattern match with the extracted field