Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About raghul725
raghul725
Explorer
Member since:
05-20-2020
10-18-2024
Community Statistics
| Posts | 38 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 05-20-2020 |
Activity Feed
- Posted Re: Calculate duration between 2 events everytime those events occur on Splunk Search. 10-15-2024 08:39 AM
- Posted Re: Calculate duration between 2 events everytime those events occur on Splunk Search. 10-11-2024 11:27 PM
- Posted Re: Calculate duration between 2 events everytime those events occur on Splunk Search. 10-11-2024 08:00 AM
- Posted Re: Calculate duration between 2 events everytime those events occur on Splunk Search. 10-10-2024 07:17 AM
- Posted Calculate duration between 2 events everytime those events occur on Splunk Search. 10-09-2024 09:30 AM
- Posted Re: Use token to show the value returned by addcoltotals command in the subject of the email on Alerting. 02-01-2024 10:26 AM
- Posted Re: Use token to show the value returned by addcoltotals command in the subject of the email on Alerting. 01-31-2024 10:37 AM
- Tagged Use token to show the value returned by addcoltotals command in the subject of the email on Alerting. 01-31-2024 07:49 AM
- Tagged Use token to show the value returned by addcoltotals command in the subject of the email on Alerting. 01-31-2024 07:49 AM
- Posted Use token to show the value returned by addcoltotals command in the subject of the email on Alerting. 01-31-2024 07:48 AM
- Posted Re: Suppress results once a condition is met on Splunk Search. 11-28-2023 09:34 AM
- Posted Re: Suppress results once a condition is met on Splunk Search. 11-27-2023 07:02 AM
- Posted Re: Suppress results once a condition is met on Splunk Search. 11-27-2023 05:36 AM
- Posted Re: Suppress results once a condition is met on Splunk Search. 11-27-2023 04:41 AM
- Posted Re: Suppress results once a condition is met on Splunk Search. 11-27-2023 04:10 AM
- Posted Re: Suppress results once a condition is met on Splunk Search. 11-26-2023 04:52 AM
- Posted Re: Suppress results once a condition is met on Splunk Search. 11-26-2023 02:38 AM
- Posted Suppress results once a condition is met on Splunk Search. 11-24-2023 07:31 AM
- Posted Re: Pass values in splunk search and compare it with results on Splunk Search. 10-30-2023 04:55 AM
- Posted Re: Pass values in splunk search and compare it with results on Splunk Search. 10-28-2023 08:17 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-15-2024
08:39 AM
OK, please find the details below Logs below - 3 sets of Start and End. And I expected my query to provide 3 duration values. But I get ONLY 2, as observed below. 10/9/24 10:32:31.540 AM 2024-10-09T10:32:31.540+08:00 | INFO | 1 | | xxxxxxxxxxxxxxxxx : End View Refresh (price_vw) !!! 10/9/24 10:32:14.000 AM 2024-10-09T09:32:14.000+07:00 | INFO | 1 | | xxxxxxxxxxxxxxxxx : End View Refresh (price_vw) !!! 10/9/24 10:30:36.643 AM 2024-10-09T09:30:36.643+07:00 | INFO | 1 | | xxxxxxxxxxxxxxxxx : Start View Refresh (price_vw) !!! 10/9/24 10:30:34.337 AM 2024-10-09T10:30:34.337+08:00 | INFO | 1 | | xxxxxxxxxxxxxxxxx : Start View Refresh (price_vw) !!! 10/9/24 10:02:32.229 AM 2024-10-09T10:02:32.229+08:00 | INFO | 1 | | xxxxxxxxxxxxxxxxx : End View Refresh (price_vw) !!! 10/9/24 10:00:42.108 AM 2024-10-09T10:00:42.108+08:00 | INFO | 1 | | xxxxxxxxxxxxxxxxx : Start View Refresh (price_vw) !!! ----------------------------- ------------------------------------------------------------------------------ Durations: 117.203 110.121
... View more
10-11-2024
11:27 PM
Hello, 2 events does not produce 4 results, 2 events will produce just 1 result. The log I provided was just a sample set to show what I am searching. So, if I search for just "View Refresh" for a duration of 1 hour, I see 4 sets of events - i.e 4 entries of "start" and "end" of each. So when I ran my query I was expecting 4 duration values, 1 for each set. But I get 2 duration values. RichGalloway, suggested to add maxspan along with transaction. I did that, but I still get the same result i.e. 2 duration values and NOT 4 duration values.
... View more
10-11-2024
08:00 AM
I am afraid I get the same results even with maxspan
... View more
10-10-2024
07:17 AM
Yup sorry, I should have delineated what I have done.
Log Examples:
Time: 10/10/24 6:30:11.478 AM
Start Event: 2024-10-10T06:30:11.478-04:00 | INFO | 1 | | xxxxxxxxxxxxxxxxx : Start View Refresh (price_vw) !!!
Time: 10/10/24 6:30:11.509 AM
End Event: 2024-10-10T06:30:11.509-04:00 | INFO | 1 | | xxxxxxxxxxxxxxxxx : End View Refresh (price_vw) !!!
index=* ("Start View Refresh (price_vw)" OR "End View Refresh (price_vw)")
| transaction startswith="Start View Refresh (price_vw)" endswith="End View Refresh (price_vw)"
| table duration
Now when I just look for the log events, I get 4 sets of Start and End events.
But when run the above for the same duration I was expecting 4 sets of duration, but I get just 2 sets.
... View more
10-09-2024
09:30 AM
Hello, I am looking to calculate how long it takes to refresh the view using the time of the events "End View Refresh" and "Start View Refresh" i.e. find the difference in time for each of these events whenever these 2 events occur. Tried number of things using streamstat and range, but it does provide me the desired result. Any assistance would be appreciated. Regards
... View more
02-01-2024
10:26 AM
OK, the Total_Delivered is defined via labelfield added to addtotalcols command. So if we run | appendpipe [| stats sum(File_Count) by Total_Delivered] without addtotalcols labelfield, then stats by from the above will not make any difference. And if I run it as |addcoltotals labelfield="Total_Delivered"|appendpipe [| stats sum(File_Count) as TFC by Total_Delivered] the output is as below Files | Files_Count | Total_Delivered | TFC| Total_Delivered F1 | 3 | | | F2 | 5 | | | F3 | 3 | | |Total | 11 | Total | 11| Total Are we expecting the above output please, altho' the view is NOT great, we can use TFC as token in subject to state the value I believe?
... View more
01-31-2024
10:37 AM
Sorry I am bit lost here, how can I run the command if I don't use addcoltotals please? Without addcoltotals labelfield="Total Delivered" the field Total Delivered will not exists to do count by. And if I add the command addcoltotals labelfield="Total Delivered" to your suggestion, it defeats the purpose, unless I am thick which I very well can be!
... View more
01-31-2024
07:48 AM
Hello, I am using addcoltotals command to get the total value of a column and I would like to display the value returned by addcoltotals command in the subject of the email when an alert is triggered. my_search|chart count AS XXXX by YYYY| addcoltotals labelfield="Total Delivered" The output is Files | Files_Count | Total Delivered F1 | 3 | F2 | 5 | F3 | 3 | | 11 | Total I would like 11 to be displayed in the subject line. Tried various tokens but could not get it working. Regards
... View more
Labels
- Labels:
-
email
11-28-2023
09:34 AM
Thank you, it works now. I am going to monitor for one more day before I mark your response as accepted solution. But in the meanwhile, could you kindly explain how the below lines work please? | eval {Status}=Status | fields - Status | stats values(*) as * | eval Status=coalesce(FILE_DELIVERED, FILE_NOT_DELIVERED) | fields Status I started guessing/ play with it, but certain lines I am unable to understand what it does/ how it fits here to provide me the desired result TBH.
... View more
11-27-2023
07:02 AM
Thank you - what version of splunk does your suggestion work please, because I ran the query before I can modify mine, no results at all for any value of head. We are on 8.2.11.2
... View more
11-27-2023
05:36 AM
Brilliant, my requirements are, the output should contain FILE_DELIVERED status for head 4 and head 5 as well, as we have received FILE_DELIVERED status for head 3. In other words, as soon as we see FILE_DELIVERED, the subsequent runs should always include FILE_DELIVERED line ONLY (should NOT include FILE_NOT_DELIVERED from the previous or current run)so the alert won't be missed. The output should continue stating FILE_NOT_DELIVERED ONLY when no occurrence of FILE_DELIVERED was found.
... View more
11-27-2023
04:41 AM
Hello, I continued to receive FILE_NOT_DELIVERED message, despite the output contains FILE_DELIVERED status Requirement: For Example: So we expect the file to be delivered around 05:15 AM, any alert before that should continue with FILE_NOT_DELIVERED and if the SPL finds the file to be delivered, any alert after that should just output FILE_DELIVERED, removing/suppressing FILE_NOT_DELIVERED in the subsequent runs until 07:00 AM. If the file was NOT delivered, then the alert should continue stating FILE_NOT_DELIVERED until 07:00 AM By following this approach I believe we can ensure the status of the file delivery (regardless of the status) cannot be missed. I am not sure if the SPL you have posted in your previous post will satisfy this requirement, but I will certainly check.
... View more
11-27-2023
04:10 AM
Hello there, unfortunately the previous input does not provide the desired result, unless I am lost - which could very well be. But I have explained the requirement again in my previous post. Would it be possible to check my previous post and suggest please?
... View more
11-26-2023
04:52 AM
Thank you for your response. Sorry if I was not clear with my original request. Alert should continue to say FILE_NOT_DELIVERED until SPL evaluates to FILE_DELIVERED. Once the SPL's output is FILE_DELIVERED, for every 15 mins of the remaining schedule (until 07:00 AM), the alert should just say FILE_DELIVERED and remove FILE_NOT_DELIVERED in the output. For Example: So we expect the file to be delivered around 05:15 AM, any alert before that should continue with FILE_NOT_DELIVERED and if the SPL finds the file to be delivered, any alert after that should just output FILE_DELIVERED, removing/suppressing FILE_NOT_DELIVERED in the subsequent runs until 07:00 AM. If the file was NOT delivered, then the alert should continue stating FILE_NOT_DELIVERED until 07:00 AM By following this approach I believe we can ensure the status of the file delivery (regardless of the status) cannot be missed. I am not sure if the SPL you have posted in your previous post will satisfy this requirement, but I will certainly check. Thanks again.
... View more
11-26-2023
02:38 AM
Thank you. Sorry for being silly. If we set the where clause and alert when there are NO results, when the file is delivered the alert will NOT include FILE_DELIVERED message? Have I got this right? If that is the case, then this MAY NOT meet my requirement, as my alert should include FILE_DELIVERED message once the SPL finds that File was delivered. Again apologies if I have misunderstood your response
... View more
11-24-2023
07:31 AM
Hello,
index=* "My-Search-String" |rex "My-Regex"| eval Status=if(like (my-rex-extractor-field,"xxx-yyyy%"), "FILE_DELIVERED", "FILE_NOT_DELIVERED")|table Status
I need to run the above between 5-7 AM alert via email. Although the file arrives around 05:15 AM, I want to continue running this as an alert until 07 AM because the alert should continue to state the status to avoid missing and this will be detrimental if the status continues to be FILE_NOT_DELIVERED
But the problem here is the alert continues to output FILE_NOT_DELIVERED albeit containing FILE_DELIVERED in the ouput
Current behaviour - when the alert triggers at 05:45 AM - alert set to run as cron schedule - every 15 mins
FILE_NOT_DELIVERED FILE_NOT_DELIVERED FILE_DELIVERED FILE_NOT_DELIVERED FILE_NOT_DELIVERED
Expected behaviour
as soon as the SPL finds FILE_DELIVERED, for all subsequent runs the FILE_NOT_DELIVERED result should be suppressed and the SPL should continue to return FILE_DELIVERED
How do I achieve this please?
... View more
Labels
- Labels:
-
lookup
10-30-2023
04:55 AM
I am afraid its on Version:8.2.11.2 That answers it. Assume there is nothing else we can try on the version I am on please? Best Regards
... View more
10-28-2023
08:17 AM
Thank you, but when I run the suggestion provided on a time period I know would not return any result, nothing shows up. I expected it provide me the entire list in makeresults. Sorry if I am missing something here or I don't understand your suggestion.
... View more
10-27-2023
03:14 AM
Hello, Currently my search looks for the list of containers which includes initialised successfully message and lists them. The alert I have set is to look for the number of containers under total connections column and if it is less then 28, then some of them did not connect successfully How can pass I the list of containers in my search and compare that with the result produced and state if the result is missing a container please? Sorry I cannot provide the exact search on a public forum, so I am sharing something similar. Example: (my example just shows 4 containers) The search should return container A, container B, container C, container D Current search: index=* Initialised xxxxxxxxxxxx xxxxxx|rex "\{consumerName\=\'(MY REGEX)"|chart count AS Connections by name| addcoltotals labelfield="Total Connections" The current result is Container_Name | Count | Total_Connections Container A | 1 | Container B | 1 | Container C | 1 | Container D | 1 | 4 How can I tweak the above search to include container A,B,C and D and if container D is missing in the result, the search should compare the result with the values passed in the search and state which container is missing as the last line in the above table i.e. preserve the existing result but state which container is missing from the result as well please? Regards
... View more
Labels
- Labels:
-
lookup
-
search job inspector
06-20-2023
05:17 AM
Brilliant Daniel, Sorry to sound silly What is the purpose of eval {rvl_status}=count If I remove this, No_success count is always 2 regardless of whether the ones are found or not
... View more
06-19-2023
10:22 AM
Hello All,
I have created the following search in splunk
index=* namespace=*
|rex "Executing http:\/\/(?<rval>\w+.*)"
|eval rvl_status=case(rval=="se","E_Successful",rval=="vt","F_Successful")
|stats count by rvl_status
The E_Successful and F_Successful count will always be 1 for a date
This works perfectly.
But what I am seeking is to add another case condition, when no events are returned and call it No_Success and increase its count either by 1 or 2 or depending the count value of E_Successful or F_Successful i.e. No_Success count will be 1 if either E_Successful or F_Successful count is 0 or No_Success count will be 2 if E_Successful & F_Successful counts are 0.
I have tried various things, but I am unable to get the desired results. Could someone assist me please?
... View more
05-21-2023
06:25 AM
Hello
I would like to count the number of values every time the search matches the string alternativeIdValue- i.e. after the = count the values separated by ,
alternativeIdValue=IE778898,WX888889,IS89657578,XS76575889.............................................
The length of each value can be different and the only common pattern is they are separated by comma and they start with an alphabet.
... View more
03-09-2023
07:16 AM
1 Karma
Brilliant thank you very much
... View more
03-08-2023
10:29 AM
Hello,
I am performing the following search to extract the time taken to upload
index=* my_search |rex "\[upload\] executed in (?<ut>\d+\w+)"
the above extracts values like 343ms, 8s30ms, 11s404ms
How would I extract the seconds portion, convert it into ms and add it to ms so that I can get the upload time always in ms please?
... View more
Labels
- Labels:
-
eval
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-18-2024
03:09 PM
|
