Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About raghul725
raghul725
Engager
Member since:
05-20-2020
01-08-2021
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 05-20-2020 |
Activity Feed
- Posted radial gauge for displaying latest heap memory usage on Splunk Search. 01-07-2021 12:10 PM
- Posted Re: Strip datetime and group by filename on Splunk Search. 06-12-2020 06:20 AM
- Posted Re: Strip datetime and group by filename on Splunk Search. 06-12-2020 05:49 AM
- Posted Re: Strip datetime and group by filename on Splunk Search. 06-12-2020 01:21 AM
- Posted Re: Strip datetime and group by filename on Splunk Search. 06-11-2020 11:57 AM
- Posted Re: Strip datetime and group by filename on Splunk Search. 06-11-2020 10:04 AM
- Posted Re: Strip datetime and group by filename on Splunk Search. 06-11-2020 09:42 AM
- Tagged Re: Strip datetime and group by filename on Splunk Search. 06-11-2020 09:42 AM
- Posted Strip datetime and group by filename on Splunk Search. 06-11-2020 08:35 AM
- Karma Re: search string containing alphanumeric characters and square brackets for richgalloway. 06-05-2020 12:51 AM
- Posted Re: Don't Expire Alerts on Alerting. 06-03-2020 04:19 AM
- Posted Re: Don't Expire Alerts on Alerting. 06-03-2020 03:50 AM
- Posted Don't Expire Alerts on Alerting. 06-03-2020 02:33 AM
- Tagged Don't Expire Alerts on Alerting. 06-03-2020 02:33 AM
- Tagged Don't Expire Alerts on Alerting. 06-03-2020 02:33 AM
- Tagged Don't Expire Alerts on Alerting. 06-03-2020 02:33 AM
- Posted Re: search string containing alphanumeric characters and square brackets on Splunk Search. 05-23-2020 11:25 AM
- Posted search string containing alphanumeric characters and square brackets on Splunk Search. 05-23-2020 08:12 AM
- Tagged search string containing alphanumeric characters and square brackets on Splunk Search. 05-23-2020 08:12 AM
- Tagged search string containing alphanumeric characters and square brackets on Splunk Search. 05-23-2020 08:12 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-07-2021
12:10 PM
Hello, I have the following log 19:02:32.576 [hz.cache-server-2.HealthMonitor] INFO com.hazelcast.int.dia.HM - [X.X.X.X]:5701 [X.X.X.X] [3.11.1] processors=12, physical.memory.total=98.2G, physical.memory.free=12.0G, swap.space.total=0, swap.space.free=0, heap.memory.used=4.3G, heap.memory.free=901.8M, heap.memory.total=5.2G, heap.memory.max=5.2G, heap.memory.used/total=82.96% And I am looking to extract the latest heap.memory.used/total value for the last 24 hours and display it in radial gauge Currently I am using the following index=* "heap.memory.used/total" | rex "heap.memory.used/total=(?<Number>\d+)" | stats latest(Number) as current_cpu_usage | gauge 0,20,40,60,80,100 I expected radial gauge to show the current mem usage i.e. 82.96%, but the speedo is stuttering at 0. I wonder my extraction of the % field is incorrect. Could someone assist me here and also how would I display the mem usage percentage in the dial please? Best Regards,
... View more
Labels
- Labels:
-
field extraction
06-12-2020
06:20 AM
Yes I tried your test query it works And tried it immediately without time after @& I thought it would work and it did. OK now, If I run the query against my logs using search i.e. by not passing the log lines via the query, I see 31 events for yesterday, but statistics (0). As usual if I remove "by reptype", returns the count as 31 under statistics.
... View more
06-12-2020
05:49 AM
I see what the confusion could be. Sorry I should have been clear. When I said File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @08:00 File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @10:15 File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @11:00 The time after @ is not in the logs, that was just an example stating it runs around that time. So to put it simply the logs would like File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip Would your suggestion still work please?
... View more
06-12-2020
01:21 AM
Hello Again, As soon as I group "by reptype", no events are returned. Any other suggestions please?
... View more
06-11-2020
11:57 AM
Sure, Group by file name without date&time (Example - AllOpenItemsPT, AllOpenItemsMaint etc) and display the count. But thinking about it, it may be useful to display the date&time as well, but then my previous group by won't work
... View more
06-11-2020
10:04 AM
Thanks Thanks, But as soon as I add "by epoch", search says no event returned. I guess group by epoch does apply here, because epoch is defined by - %Y%M%D_%H-%M" And none of the files can be grouped based on that?
... View more
06-11-2020
09:42 AM
Sure, Group by file name without date&time (Example - AllOpenItemsPT, AllOpenItemsMaint etc) and display the count. But thinking about it, it may be useful to display the date&time as well, but then my previous group by won't work
... View more
- Tags:
- Grou
06-11-2020
08:35 AM
Hello, I have the following logs from Cron File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @08:00 File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @10:15 File successfully sent - AllOpenItemsPT_YYYYMMDD_HR-MM.csv.zip @11:00 File successfully sent - AllOpenItemsMaint_YYYYMMDD_HR-MM.csv.zip @07:00 File successfully sent - AllOpenItemsMaint_YYYYMMDD_HR-MM.csv.zip @09:00 File successfully sent - AllOpenItemsMaint_YYYYMMDD_HR-MM.csv.zip @13:00 File successfully sent - AllOpenItemsCOUNTRYNAME_YYYYMMDD_HR-MM.csv.zip @12:00 File successfully sent - AllOpenItemsCOUNTRYNAME_YYYYMMDD_HR-MM.csv.zip @14:30 File successfully sent - AllOpenItemsCOUNTRYNAME_YYYYMMDD_HR-MM.csv.zip @17:20 I am trying to group the files based on "AllOpenItems" string for last 24 hours and tried the below. index=* namespace=* "File successfully sent -"| rex "File successfully sent - AllOpenItems(?<reptype>\w+)"|stats values(reptype) as ReportType by reptype The problem with the above is, I am unable to strip the Date&time the file name, so it won't group as per my requirement. Could someone assist please?
... View more
06-03-2020
03:50 AM
So essentially, what we are saying here is
Alert Expire field defines how long the alert will be visible, once triggered and does NOT set an expiry on the alert trigger i.e. alter trigger will be enabled until that is disabled manually.
... View more
06-03-2020
02:33 AM
Hello All,
Sorry to ask a silly question, I had a look around, but unable to find a solution.
When we set an alert in Splunk, there is an Expires Parameter.
I understand this is TTL for the Alert (Sorry if I have misunderstood it).
I don't want my Alert to Expire. How can I achieve this please?
If there is no means to achieve this, is there a way to trigger a notification, when that alert is about to expire please? I tried couple of options in alert setting, to see if splunk triggers a notification when an alert expires, I am afraid no notification was triggered.
For example set "Trigger Condition", "Trigger Time" and set the alert to Expire in 10 mins. The alert Expired but no notification was triggered via email. I had a feeling it won't work, as Trigger Condition means - The condition that triggers the alert and NOT alert expiry - but just tried my luck!
Best Regards,
... View more
Labels
- Labels:
-
alert condition
05-23-2020
11:25 AM
Nice thanks Richgalloway,
Regex works, but for some reason searchmatch does not return any results.
Anyways I can survive with Regex.
Best Regards,
... View more
05-23-2020
08:12 AM
Hello,
I have the following lines in logs
[Kafka Server 4], shut down completed (kafka.server)
[Kafka Server 4], start completed (kafka.server)
The number before ] could be anything between 0-9
So I am trying the following
index=* namespace=XXXXXX | search ["Kafka Server"\s\d]\,\ss\w+
And I am expecting the result to be
[Kafka Server 4], shut [Kafka Server 4], start
But I am not getting the desired result
While I try
index=* namespace=XXXXXX | search ["Kafka Server" I get
[Kafka Server 4], shut down completed (kafka.server)
[Kafka Server 4], start completed (kafka.server)
[Kafka Server 5], shut down completed (kafka.server)
[Kafka Server 6], start completed (kafka.server)
...... etc
Could someone assist me please?
Regards
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-08-2021
01:02 PM
|
