Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sambit_kabi
sambit_kabi
Path Finder
Member since:
02-11-2020
06-30-2020
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 02-11-2020 |
Activity Feed
- Posted Re: How to skip the weekends in the timechart or a chart? on Dashboards & Visualizations. 06-30-2020 01:48 AM
- Posted Re: How can we send an email alert with a colored table in the result set? on Dashboards & Visualizations. 06-30-2020 01:43 AM
- Posted Re: How do you completely remove Saturdays and Sundays from displaying on a timechart? on Splunk Search. 06-29-2020 12:43 AM
- Karma Re: How do you completely remove Saturdays and Sundays from displaying on a timechart? for ashajambagi. 06-29-2020 12:30 AM
- Posted How to skip the weekends in the timechart or a chart? on Dashboards & Visualizations. 06-29-2020 12:05 AM
- Got Karma for How to specify midnight time in EST time using time modifier in a search query. 06-05-2020 12:51 AM
- Posted How to save search query in a file in Splunk Dashboard on Splunk Search. 05-18-2020 02:48 AM
- Tagged How to save search query in a file in Splunk Dashboard on Splunk Search. 05-18-2020 02:48 AM
- Tagged How to save search query in a file in Splunk Dashboard on Splunk Search. 05-18-2020 02:48 AM
- Tagged How to save search query in a file in Splunk Dashboard on Splunk Search. 05-18-2020 02:48 AM
- Posted Re: How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-09-2020 04:25 AM
- Posted Re: How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-09-2020 04:22 AM
- Posted Re: How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-08-2020 11:58 PM
- Posted How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-04-2020 12:13 AM
- Tagged How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-04-2020 12:13 AM
- Tagged How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-04-2020 12:13 AM
- Tagged How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-04-2020 12:13 AM
- Tagged How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-04-2020 12:13 AM
- Tagged How to specify midnight time in EST time using time modifier in a search query on Splunk IT Service Intelligence. 03-04-2020 12:13 AM
- Posted Re: 90 day average per field using Summary indexing and outputlookup on Knowledge Management. 02-14-2020 10:59 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
06-30-2020
01:48 AM
Hi , thanks for the reply. I had tried the same with the clause before and after the chart command. It didn't work for me in either case. However the following worked for me. I am not not sure though why it worked and what is Splunk's behavior when I used strftime. | eval date=strftime(_time,"%d-%b-%y %H:%M:%S %a") | chart limit=0 useother=false count as Volume by date,Description
... View more
06-30-2020
01:43 AM
Same here. We too have a requirement where we need to color the table cell value based on some criteria. This needs to be sent as an email. Can you help regarding this.
... View more
06-29-2020
12:43 AM
Lifesaver. Excellent!! I still couldn't understand how is Splunk treating it differently
... View more
06-29-2020
12:05 AM
I have a search query which yields a timechart . I want to show just the weekdays and skip the weekends in the charting of data using timechart. I have used the clause | eval day_of_week = strftime(_time,"%A") | where NOT (day_of_week="Saturday" OR day_of_week="Sunday") | fields - day_of_week in my query before and after the timechart. The data doesn't have the weekend information whereas when this is charted using the timechart I always get the weekends on my x-axis. Any idea how to solve it?
... View more
05-18-2020
02:48 AM
Hi ,
I have a requirement where I want to save the search query after the query has run to a file. Basically i want to have a file with Query name and the query so that users can save and load back their queries in the Dashboard.
Would like to know how can i save a query to a file using outputcsv in the Splunk Dashboard ? How do i get hold of that search query with resolved token values.
Also is there a clean way that Splunk provides to save the dashboard query to a file?
Thanks.
... View more
03-09-2020
04:25 AM
Yes so that's what I am trying to avoid. I want a query that would always search in the EST TZ no matter where the user is. I want to make the query generic so that i don't have to offset the timerange based on my TZ. Because the query time range would keep on changing based on the user TZ.
... View more
03-09-2020
04:22 AM
The time range would definitely work but the point is if I take this query and search being in a different TZ other than AEST, this would fail because we specify the start and end time offset based on the TZ we are in(AEST in your case).
Is there a way to make it TZ agnostic, meaning I would take the latest=now and then derive the earliest as earliest = (12 AM midnight time in EST w.r.t current time i. e now). Meaning if the current time in EST is say 06-03-2020 09:00 AM then my query would run from 06-03-2020 12 AM EST to 06-03-2020 09:00 AM EST.
So how do I calculate or specify the snap time 06-03-2020 12:00 AM EST in the query. All I have is the current time with as input.
If there is a way to do this then irrespective of the TZ user is in , the query would always search in the EST time range.
... View more
03-08-2020
11:58 PM
I need to specify 12 am midnight EST time snap time at the earliest time modifier field in search query.
So if the current time in EST is 09-03-2020 3:45 AM then I want to specify 09-03-2020 12 AM time in my search query as part of time range.
... View more
03-04-2020
12:13 AM
1 Karma
I am in a X time zone which can be any time zone. The splunk indexers are in EST time zone. I want to search all the events from the current time since the midnight in the EST time zone.
Question is how do I specify the time range using time modifier. If I use latest=now and earliest=@d in my search query , the @d is the midnight time of my current time zone and not the EST timezone.
How do I create a time range for search query which says "Give me the events since midnight in EST to current time in EST".
Note: This query should run irrespective of the timezone of the user running it. Basically we want to search the events in EST being in a diff time zone.
... View more
- Tags:
- Splunk Business Flow
- Splunk IT Service Intelligence
- splunk-enterprise
- splunk-insights-for-infrastructure
- splunk-investigate
Labels
- Labels:
-
administration
-
configuration
02-14-2020
10:59 PM
Cool. Thanks for pointing it out. I did it the old school way and a very raw way.
So here's what I did:
- using a scheduled search query I queried the results for that day
- Appended the rows in the csv(loopup csv file already populated with previous x days data) with the above query results
- Checked if the timestamp of the results is beyond 90 days and then filtered out the results
- Wrote the filtered results back to the csv file so that the csv has the results for the past 90 days.
Then in the dashboard I read this csv and populate the report for the last 90 days.
But I will definitely take a look at your approach. Thanks very much. Appreciate it.
... View more
02-14-2020
10:51 PM
I managed to solve this in the following manner. Though it may not be efficient but it worked for me.
Instead of the date I kept the time as "seconds from epoch" in the csv file which looked like(assume the data is dummy).
Day Messages
12022020 1571
12022020 302
12022020 1
Then using the following construct i was able to take a diff and compare it.
| inputlookup abc.csv | eval today=relative_time(now(), "%d") | eval diff = today - Day | where diff <= 86400
I am sure the strptime function should have done the job too with my previous approach but somehow in my case it didn't convert the date in the csv to date that can be compared. So I took this approach. Still trying to figure out why strptime didn't work.
... View more
02-14-2020
10:43 PM
Thanks for the help. I used the relative_time function as you pointed out. That came in handy.
Unfortunately the strptime function didn't work for me as I have mentioned before. It didn't convert the time in csv to time to be compared. I don't get result for today variable.
However I managed to find a solution by dumping the time in "secs from epoch" in the csv and then compared the diff between the today's start time with the time in csv.
used constructs like | eval diff=relative_time(now(), "@d") - Day | where diff < 86400.
Still wondering why strptime didn't work for me. However I found that | convert ctime(Day) did work for me
Is there any condition that strptime has when used with inputlookup. Nothing mentioned in the documentation.
... View more
02-14-2020
10:40 PM
Thanks for the help. Unfortunately the strptime function didn't work for me. It didn't convert the time in csv to time to be compared. I don't get result for today variable.
However I managed to find a solution by dumping the time in "secs from epoch" in the csv and then compared the diff between the today's start time with the time in csv.
used constructs like | eval diff=relative_time(now(), "@d") - Day | where diff < 86400.
Still wondering why strptime didn't work for me. However I found that | convert ctime(Day) did work for me.
... View more
02-13-2020
05:33 AM
I have a lookup csv file which has the following data.
Day Messages
12/02/2020 1571
12/02/2020 302
12/02/2020 1
What I want to do is read the Day column and then subtract the day from today's date to check if the difference is greater than 30.
If the diff > 30 filter it out.
I tried the following query and it doesn't work.
| inputlookup messages_per_day.csv | eval today=strftime(now(), "%d/%m/%Y") | eval diff=today - Day
... View more
02-12-2020
09:21 PM
I have a requirement to get the average of the count of the IPs over the last 90 days. I have thought of 2 approaches to distribute the query overhead across a span of 90 days.
Will schedule a query to run everyday at the end of the day and collect the result in a csv file using outputlookup. Will keep appending the results every day to the existing file. Then use this file to get the 90 day average.
Use summary indexing and schedule a query to run everyday at the end of the day and collect the result in the summary index specifying the search a name. Will keep appending the results every day to this index . Then use this index to get the 90 day average.
Question:
Is there a way to restrict the lookup csv file or the summary index to have just the latest 90 days record. Meaning , I want to purge the rows in the index or the file which are greater than 90 days. How can I do it?
... View more
02-12-2020
09:09 PM
Thanks for the prompt reply . It works . Thanks again. Got to learn a new command.
... View more
02-11-2020
09:58 AM
Say I have an index A which has all the IPs logged during the day. So every event has an IP and the timestamp it was seen.
What I need to find is the count of the occurrence of each IP for the first 15 mins starting from the timestamp of the first occurrence of the IP.
Example: Say I find IP 1.2.3.4 at 10:00, 10:05,10:12, 10:16,10:20 and IP 9.8.7.6 at 11:00, 11:05, 11:10, 11:20.
For IP 1.2.3.4 the first occurrence was at 10:00 . So in the first 15 mins which is from 10:00 till 10:15 I get the occurrence count as 3. Occurrence at 10:16 and 10:20 is ignored.
Similarly for IP 9.8.7.6 the first occurrence was at 11:00 , so the first 15 mins i.e from 11:00 to 11:15 the occurrence count is 3. 11:20 occurrence is ignored.
So basically I want a search query which will give me the count of occurrence of each IP for the first 15 mins starting from the first occurrence of each IP.
The search result here would be
1.2.3.4 3
9.8.7.6 3
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-30-2020
05:21 AM
|
