About romoc

romoc · ‎10-02-2017

It worked like a charm! thanks @niketnilay!

romoc · ‎10-02-2017

Hi Niketnilay - I just replied @xisura. I'm not getting the expected results yet and provided further details. Hope you could have any other suggestion.

romoc · ‎10-02-2017

Thanks xisura - I tried your suggestion but unfortunately I get "no results found". I want to clarify also that x and y are the two possible values for db_name and I'm not sure if function eval rec_diff=x-y would work. This is a sample of 4 events captured: 2017-10-01 01:47:16.541, DB_NAME="x", TABLE_NAME="a", SNAP_DATE="2017-09-30 21:47:16.2", ROW_COUNT="183" 2017-10-01 01:42:36.069, DB_NAME="y", TABLE_NAME="a", SNAP_DATE="2017-10-01 01:42:35.0", ROW_COUNT="183" 2017-10-01 01:47:16.541, DB_NAME="x", TABLE_NAME="b", SNAP_DATE="2017-09-30 21:47:16.2", ROW_COUNT="1731" 2017-10-01 01:42:36.069, DB_NAME="y", TABLE_NAME="b", SNAP_DATE="2017-10-01 01:42:35.0", ROW_COUNT="1738" I'll appreciate any help on this. Thanks

romoc · ‎10-02-2017

Thanks Xisure - I tried your suggestion but it get no results found. By the way, x and y are the possible values for field db_name so, I'm not sure if the eval function is expressed correctly. For example, this is in fact how some events (from all the list of possible events) look like: DB_NAME="x", TABLE_NAME="a", SNAP_DATE="2017-09-30 21:17:16.267", ROW_COUNT="183" DB_NAME="y", TABLE_NAME="a", SNAP_DATE="2017-10-01 01:12:35.0", ROW_COUNT="180" DB_NAME="y", TABLE_NAME="b", SNAP_DATE="2017-09-30 21:17:16.267", ROW_COUNT="1731" DB_NAME="x", TABLE_NAME="b", SNAP_DATE="2017-10-01 01:12:35.0", ROW_COUNT="1738" I will appreciate any help. Thanks

romoc · ‎10-02-2017

Hi Niketnilay, That was just a sample of records - there would be more tables to compare and the list could grow over the time. What is a fact, there would be always two databases to compare - x and y in this case.

romoc · ‎10-01-2017

Hi Splunk Experts, I need to create a report to display the table record count difference between two databases during a period of time. Events (list) are captured as follow: db_name table_name row_count x a 4 x b 3 y a 4 y b 1 Report should look like this: table_name x y rec_diff a 4 4 0 b 3 1 2 Any help will be very appreciated.

romoc · ‎06-27-2017

Thanks niketnilay - looks like it's what we were looking for. I will be working on get it implemented.

romoc · ‎06-26-2017

Hello, I'd like to create a single value chart, based on below search, to display the number of invalid objects in a database. I would like to format in red (critical) when there is at least one invalid object from OWNER "SYS" or "SYSTEM", yellow (warning) if there is invalid object is coming from any other owner than "SYS" and "SYSTEM". Green if there isn't any invalid object in the database. It would be desirable if the count to display were the total of invalid objects in the database. sourcetype=oracle:object STATUS!=VALID | stats count by OWNER OWNER COUNT SYS 1 MYCUST 2 Any help will be really appreciated.

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎06-26-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to get a calculated column in a table

how to format single value chart based on multiple...

Re: How to get a calculated column in a table

Re: How to get a calculated column in a table

Re: How to get a calculated column in a table

Re: How to get a calculated column in a table

Re: How to get a calculated column in a table

How to get a calculated column in a table

Re: how to format single value chart based on mult...

how to format single value chart based on multiple...