Thanks @nadlurinadluri ,
This worked in my case -
index=_internal source=*splunkd_ui_access.log uri="*" NOT (user="-")
| eval access_time =strftime(_time,"%b %d, %Y : %H:%M:%S")
| stats min(access_time) as "Firstaccess" max(access_time) as "lastaccess" by user
... View more
This works for me
index=_internal source=*splunkd_ui_access.log uri="app uri" NOT (user="-")
| stats count by user
Can we also get the LastAcess Time stamp there by all users using the report OR Dashboard?
... View more
I'm looking for query where we can find users using the dashboards. The report I need is of users using XabAB_TBBBBB_Dashboard in Splunk Report Window, between the 20th August - Till Date.
But when I try to find it by using below query, it gives the wrong
results .Thanks in advance 🙂
index="_internal" sourcetype=splunkd_ui_access | rex "/app/(?[^/]+)/(?[^?/\s]+)" |stats values(user)
... View more
Hi Somesoni2 ,
This search gives results .In DownFROM is august 13 DownTo is august12. Which is I changed as below .Please Correct query if anything not correct .Thanks In advance 🙂
index=_internal host=a OR host=b OR host=..all other hosts.. component=HttpPubSubConnection Running phone
| table _time host | sort 0 host _time | streamstats current=f window=1 values(_time) as prev_time
| eval duration=abs(_time-prev_time) | eval DownTo=strftime(prev_time,"%+") | eval DownFrom=strftime(_time,"%+") |dedup host
... View more
Hi somesoni2 ,
Thanks for the query. In above query How can i know from which time to when the splunk server is down for example 8/3/2018 7 am to 8/4/2018 6 am .. and .Down time in hours Please ?
Thanks,
splunker969
... View more
Hi ,
We had list of servers a,b,c,d,e,f. How can we check how long splunk uf agents are down on the servers a,b,c,d,e,f? At present we restarted uf agents. I am looking for a query. Any help would be great. Thanks in advance 🙂
... View more
Hi Splunk members,
How Can I get some metrics to indicate things like search concurrency, search queue depth, cancelled/timed out searches, etc by search head and by indexer?
... View more
Hi all we have list of 10 Solaris servers and they are us servers we installed ufs on those servers and are pointing us deployment servers .In deployment client.conf file .Since we have search when I ran that search it is showing that it is phoning home with Uk Deployment server any Help with query ? I believe there is something wrong with Query .Please correct query if any changes need ?Help highly appreciated ?
Query -
| `get_coverage(baseline="isac_systems", feed="kpci_8100_solaris")` | eval Coverage = if('Full Coverage'=="Yes" OR 'Partial Coverage'=="Yes","Yes","No")|search "Full Coverage"="*" "Partial Coverage"="*" "Calculated Region"="*" "Phoning Home"="Yes" "Whitelisted"="*" Coverage=No "Operational Environment (Sys)"="PROD" OR "Operational Environment (Sys)"="DISASTERREC" | table "System Name" "Application" "Solution" "Calculated Asset Group" "Calculated Asset Type" "Calculated Lifecycle Status" "Lifecycle Phase" "OS Type" "OS" "Calculated Region" "Operational Environment (Sys)" "Server Zone" Component Function "Data Source Count" "Data Sources" "Full Coverage" "Partial Coverage" "Whitelisted" "Phoning Home" "Last Phone Home Time" "IMD" deployment_server |rename deployment_server as "Phoning Home Deployment Server" | fields - "." | lookup imd_splunkds_mapping IMD Country_Code AS "Calculated Region" | rename Calculated_DS as "IMD Calculated Deployment Server"
... View more
Hi Mate,
As we are getting the duplicate results from the csv table and the results are coming with both normal host name and hostname with FQDNS. How do we resolve this and please suggest.
Example:
host
host.com
Thanks.
... View more