Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About lewis269
lewis269
Explorer
Member since:
04-12-2015
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 04-12-2015 |
Activity Feed
- Karma Re: change count in chart to actual value for nolesrb5343. 06-05-2020 12:47 AM
- Posted Re: change count in chart to actual value on Splunk Search. 05-04-2015 09:49 PM
- Posted Re: change count in chart to actual value on Splunk Search. 05-04-2015 09:48 PM
- Posted Re: change count in chart to actual value on Splunk Search. 05-04-2015 09:47 PM
- Posted Re: change count in chart to actual value on Splunk Search. 05-04-2015 08:43 PM
- Posted change count in chart to actual value on Splunk Search. 05-03-2015 09:54 PM
- Tagged change count in chart to actual value on Splunk Search. 05-03-2015 09:54 PM
- Tagged change count in chart to actual value on Splunk Search. 05-03-2015 09:54 PM
- Posted Re: When I log into the Splunk indexer and go to the distributed management console, why do I not see the search head instance listed? on Getting Data In. 04-20-2015 12:34 AM
- Posted When I log into the Splunk indexer and go to the distributed management console, why do I not see the search head instance listed? on Getting Data In. 04-20-2015 12:26 AM
- Tagged When I log into the Splunk indexer and go to the distributed management console, why do I not see the search head instance listed? on Getting Data In. 04-20-2015 12:26 AM
- Tagged When I log into the Splunk indexer and go to the distributed management console, why do I not see the search head instance listed? on Getting Data In. 04-20-2015 12:26 AM
- Tagged When I log into the Splunk indexer and go to the distributed management console, why do I not see the search head instance listed? on Getting Data In. 04-20-2015 12:26 AM
- Tagged When I log into the Splunk indexer and go to the distributed management console, why do I not see the search head instance listed? on Getting Data In. 04-20-2015 12:26 AM
- Tagged When I log into the Splunk indexer and go to the distributed management console, why do I not see the search head instance listed? on Getting Data In. 04-20-2015 12:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-04-2015
09:49 PM
As @nolesrb5343 said...this was the solution to the problem.
source="Wireless_Gobblers_20150504_102111_716.csv" host="prime" index="prime-test" sourcetype="ios:prime-test" "Bytes Received" > 0 | chart sum("Bytes Received") OVER "Client Username"
using sum over the field. relatively simple.
... View more
05-04-2015
09:48 PM
Oh should be...this.
source="Wireless_Gobblers_20150504_102111_716.csv" host="prime" index="prime-test" sourcetype="ios:prime-test" "Bytes Received" > 0 | chart sum("Bytes Received") OVER "Client Username"
that works actually.
... View more
05-04-2015
09:47 PM
i understand the string...but where is "bytes" coming from? should that be "Bytes Received"??
sorry still wrapping my head around searching in Splunk
... View more
05-04-2015
08:43 PM
source="Wireless_Gobblers_20150504_102111_716.csv" host="prime" index="prime-test" sourcetype="ios:prime-test" "Bytes Received" > 0
currently grabs all the events where the bytes received is more than 0 as we don't care about anything that doesn't send any data.
i can filter the sources to bytes received and username but then have a lot of trouble getting it into a readable graph where the bytes are on the Y axis and the usernames are on the X axis.
thanks
... View more
05-03-2015
09:54 PM
Hey,
i have two fields that i want to report on.
basically data from a wireless lan controller where we have "bytes received" and "username"
at the moment i can select both these fields and then visualize and it will show the usernames along the x axis which is what i want but it won't show the values for bytes recieved...only the "count" of events which isn't really useful.
essentially what i want to do is....
IF a username has more than 1 event then add "bytes received" together for each event into one value for each username.
the "bytes received" will be the Y axis and the usernames will be the X axis.
any idea on how i would do this? it's looking like it would be quite a complicated search??? but not sure.
Thanks in advance.
... View more
04-20-2015
12:34 AM
logged into search head and i can see all the instances on DMC. although when i log into the indexer and look at DMC, nothing appears (only the indexer).
... View more
04-20-2015
12:26 AM
I've added the indexer as a peer on the search head and can edit the roles of both the indexer and the search head from there.
When i log into the splunk instance (indexer) i go to distributed management console and only the server appears (indexer) there is no remote servers for the search head etc...
any idea why this is happening? seems they are linked... but they aren't?
running 6.2.2 on both servers.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
