Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About chinmay25
chinmay25
Path Finder
Member since:
05-26-2020
08-24-2023
Community Statistics
| Posts | 44 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 05-26-2020 |
Activity Feed
- Posted Re: Help with a query to set an Alert only when two conditions met? on Splunk Enterprise. 08-24-2023 07:28 AM
- Karma Re: Help with a query to set an Alert only when two conditions met? for ITWhisperer. 08-24-2023 07:22 AM
- Posted How to create a search to set an Alert only when two conditions met? on Splunk Enterprise. 08-24-2023 06:54 AM
- Posted Re: How to sort out values greater that a certain number in a table? on Splunk Enterprise. 08-22-2023 08:03 AM
- Tagged Re: How to sort out values greater that a certain number in a table? on Splunk Enterprise. 08-22-2023 08:03 AM
- Posted Re: How to sort out values greater that a certain number in a table? on Splunk Enterprise. 08-09-2023 10:54 AM
- Posted Re: How to sort out values greater that a certain number in a table? on Splunk Enterprise. 08-09-2023 09:21 AM
- Karma Re: How to sort out values greater that a certain number in a table? for ITWhisperer. 08-09-2023 09:06 AM
- Posted How to sort out values greater that a certain number in a table? on Splunk Enterprise. 08-09-2023 07:45 AM
- Karma Re: How to search for values greater than 10 in the results? for ITWhisperer. 01-19-2022 10:34 AM
- Posted How to search for values greater than 10 in the results? on Splunk Search. 01-19-2022 07:32 AM
- Posted Unable to get the correct visualization on Splunk Cloud Platform. 08-24-2021 09:14 AM
- Posted How to eliminate multiple time entries? on Splunk Cloud Platform. 07-13-2021 09:37 AM
- Posted Re: Help with Eval command!! on Splunk Cloud Platform. 01-26-2021 09:33 AM
- Karma Re: Help with Eval command!! for scelikok. 01-26-2021 09:33 AM
- Posted Re: Help with Eval command!! on Splunk Cloud Platform. 01-26-2021 08:03 AM
- Posted Re: Help with Eval command!! on Splunk Cloud Platform. 01-25-2021 02:06 PM
- Posted Re: Help with Eval command!! on Splunk Cloud Platform. 01-25-2021 01:18 PM
- Posted Re: Help with Eval command!! on Splunk Cloud Platform. 01-25-2021 01:18 PM
- Posted Re: Help with Eval command!! on Splunk Cloud Platform. 01-25-2021 01:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-24-2023
07:28 AM
For some reason where command was not working earlier. I realized that I had missed one statement in the query at the beginning. Thank you.
... View more
08-24-2023
06:54 AM
I have the following query that gives the count for port and CPU percent.
index=abc source=xyz SMFID=EDCD SMF119HDSubType=2 | timechart span=60m count by SMF119AP_TTLPort_0001 usenull=f useother=f | stats values(*) as * by _time | untable _time Port Count | where Count > 4000 | eval DATE = strftime(_time,"%m/%d/%y %H:%M:%S.%2N") | eval Date = substr(DATE,1,9) | eval Hours = substr(DATE, 11,18) | appendcols [search index=abc source=xyz (SYSNAME=EDCD) ((date_wday=tuesday AND date_hour=*) OR (date_wday=wednesday AND date_hour=*) OR (date_wday=thursday AND date_hour=*) OR (date_wday=friday AND date_hour=*) OR (date_wday=monday AND date_hour=10) OR (date_wday=monday AND date_hour=11) OR (date_wday=monday AND date_hour=12) OR (date_wday=monday AND date_hour=13) OR (date_wday=monday AND date_hour=14) OR (date_wday=monday AND date_hour=15) OR (date_wday=monday AND date_hour=16) OR (date_wday=monday AND date_hour=17) OR (date_wday=monday AND date_hour=18) OR (date_wday=monday AND date_hour=19) OR (date_wday=monday AND date_hour=20) OR (date_wday=monday AND date_hour=21) OR (date_wday=monday AND date_hour=22) OR (date_wday=monday AND date_hour=23) OR (date_wday=saturday AND date_hour=0) OR (date_wday=saturday AND date_hour=1) OR (date_wday=saturday AND date_hour=2) OR (date_wday=saturday AND date_hour=3) OR (date_wday=saturday AND date_hour=4) OR (date_wday=saturday AND date_hour=5) OR (date_wday=saturday AND date_hour=6) OR (date_wday=saturday AND date_hour=7)) | bin span=1h@h _time | eval "Hours"=strftime('_time',"%H:%M:%S.%2N") | eval DATE = strftime('_time',"%m/%d/%y %H:%M:%S.%2N") | eval Date = substr(DATE, 1,9) | eval CPU = round(RCVCPUA/16,2) | stats avg(CPU) as "CPU" by Hours Date | eval CPU=round(CPU,2) ] | table Date Hours Port Count CPU
This generates the following result. I want to set an alert only when the count is >5000 and CPU >80. What combined statement can be used to get the desired result?
Date
Hours
Port
Count
CPU
08/22/23
7:00:00.00
23050
75787
38.42
08/22/23
8:00:00.00
23050
19854
84.56
08/22/23
9:00:00.00
23008
4126
37.16
08/22/23
9:00:00.00
23050
20121
35.71
... View more
- Tags:
- splunk search
Labels
- Labels:
-
using Splunk Enterprise
08-22-2023
08:03 AM
I have the following query that gives the count for port and CPU percent. index=abc source=xyz SMFID=EDCD SMF119HDSubType=2 | timechart span=60m count by SMF119AP_TTLPort_0001 usenull=f useother=f | stats values(*) as * by _time | untable _time Port Count | where Count > 4000 | eval DATE = strftime(_time,"%m/%d/%y %H:%M:%S.%2N") | eval Date = substr(DATE,1,9) | eval Hours = substr(DATE, 11,18) | appendcols [search index=abc source=xyz (SYSNAME=EDCD) ((date_wday=tuesday AND date_hour=*) OR (date_wday=wednesday AND date_hour=*) OR (date_wday=thursday AND date_hour=*) OR (date_wday=friday AND date_hour=*) OR (date_wday=monday AND date_hour=10) OR (date_wday=monday AND date_hour=11) OR (date_wday=monday AND date_hour=12) OR (date_wday=monday AND date_hour=13) OR (date_wday=monday AND date_hour=14) OR (date_wday=monday AND date_hour=15) OR (date_wday=monday AND date_hour=16) OR (date_wday=monday AND date_hour=17) OR (date_wday=monday AND date_hour=18) OR (date_wday=monday AND date_hour=19) OR (date_wday=monday AND date_hour=20) OR (date_wday=monday AND date_hour=21) OR (date_wday=monday AND date_hour=22) OR (date_wday=monday AND date_hour=23) OR (date_wday=saturday AND date_hour=0) OR (date_wday=saturday AND date_hour=1) OR (date_wday=saturday AND date_hour=2) OR (date_wday=saturday AND date_hour=3) OR (date_wday=saturday AND date_hour=4) OR (date_wday=saturday AND date_hour=5) OR (date_wday=saturday AND date_hour=6) OR (date_wday=saturday AND date_hour=7)) | bin span=1h@h _time | eval "Hours"=strftime('_time',"%H:%M:%S.%2N") | eval DATE = strftime('_time',"%m/%d/%y %H:%M:%S.%2N") | eval Date = substr(DATE, 1,9) | eval CPU = round(RCVCPUA/16,2) | stats avg(CPU) as "CPU" by Hours Date | eval CPU=round(CPU,2) ] | table Date Hours Port Count CPU This generates the following result. I want to set an alert only when the count is >5000 and CPU >80. What combined statement can be used to get the desired result? Date Hours Port Count CPU 08/22/23 7:00:00.00 23050 75787 38.42 08/22/23 8:00:00.00 23050 19854 84.56 08/22/23 9:00:00.00 23008 4126 37.16 08/22/23 9:00:00.00 23050 20121 35.71
... View more
- Tags:
- splunk
08-09-2023
10:54 AM
I am having that trouble too. So we want to be alerted when both conditions meet. The count is over 5000 and the EDCD percent is above 90%. Right now I have 2 separate alerts one for count over 5000 and another for EDCD percent above 90%. Is there a way we can combine the two using a AND clause.
... View more
08-09-2023
09:21 AM
The solution worked perfectly for the count over 5000. How can I combine the query for count greater than 5000 with the following query that generates the percent data. I want to set an alert only when the count is greater that 5000 and EDCD > 90 index=abc source=xyz (SYSNAME=EDCD) ((date_wday=tuesday AND date_hour=*) OR (date_wday=wednesday AND date_hour=*) OR (date_wday=thursday AND date_hour=*) OR (date_wday=friday AND date_hour=*) OR (date_wday=monday AND date_hour=10) OR (date_wday=monday AND date_hour=11) OR (date_wday=monday AND date_hour=12) OR (date_wday=monday AND date_hour=13) OR (date_wday=monday AND date_hour=14) OR (date_wday=monday AND date_hour=15) OR (date_wday=monday AND date_hour=16) OR (date_wday=monday AND date_hour=17) OR (date_wday=monday AND date_hour=18) OR (date_wday=monday AND date_hour=19) OR (date_wday=monday AND date_hour=20) OR (date_wday=monday AND date_hour=21) OR (date_wday=monday AND date_hour=22) OR (date_wday=monday AND date_hour=23) OR (date_wday=saturday AND date_hour=0) OR (date_wday=saturday AND date_hour=1) OR (date_wday=saturday AND date_hour=2) OR (date_wday=saturday AND date_hour=3) OR (date_wday=saturday AND date_hour=4) OR (date_wday=saturday AND date_hour=5) OR (date_wday=saturday AND date_hour=6) OR (date_wday=saturday AND date_hour=7)) | bin _time span=1h | eval CPU = round(RCVCPUA/16,2), Hour = date_hour | chart eval(round(avg(CPU),2)) as "CPU" over Hour by SYSNAME This query generates a table as follows Hour EDCD 8 43.5 9 76.2 10 91.5 Thank you, Chinmay.
... View more
08-09-2023
07:45 AM
Hello, I have the following query that I am working with and it generates a table with multiple counts for various ports at 15 min intervals. index=abc source=xyz SMF119HDSubType=2 | timechart span=15m count by SMF119AP_TTLPort_0001 usenull=f useother=f | stats values(*) as * by _time | table _time Port1 Port2 The result is the following table. I only want to display results more that 5000 counts. I am trying to use the where Port 2>5000 command. But it does not work. I am only displaying 2 port columns. However, I have several other ports to monitor as well. _time Port1 Port2 2023-08-09 09:30:00 800 2700 2023-08-09 09:45:00 1200 4800 2023-08-09 10:00:00 1300 5300 2023-08-09 10:15:00 600 8000 2023-08-09 10:30:00 400 13500 I would appreciate your inputs. Thank you, Chinmay.
... View more
Labels
- Labels:
-
using Splunk Enterprise
01-19-2022
07:32 AM
I am working on the query that generates a table with count of security violations. I want to filter our the users with violations greater than 10. | rex field=_raw "(?<Message>Security\sviolation)\s\S+\s\S+\s(?<User>[A-Z0-9]+)" | eval Time = strftime(_time, "%m-%d-%Y %H:%M:%S") | rename JOBNAME as Jobname Time as Date | eval Workload = substr(Jobname,1,3) | stats count(Message) as "Security Violations" by Jobname User Resulting table User Security Violations ABC 1 DEF 4 GHI 12 JKL 3 XYZ` 20 Thank you,
... View more
Labels
- Labels:
-
table
08-24-2021
09:14 AM
I have been editing the following query in order to get the duration for workload.....how ever while creating the visualization we only see duration of the bar chart......i am looking to see if we can get something with regards to the workload and/0r Jobname. | inputlookup cyclestarttimes.csv | lookup cycleendtimes.csv CYCLE WORKLOAD | search WORKLOAD=F91 | where isnotnull(ENDTIME) | eval STARTC = "2021-08-19" | eval ENDC = "2021-08-20" | eval STARTC = strptime(STARTC, "%Y-%m-%d") | eval ENDC = strptime(ENDC, "%Y-%m-%d") | eval CYCLEC = strptime(CYCLE, "%Y-%m-%d") | where CYCLEC >= STARTC AND CYCLEC <= ENDC | stats values(STARTTIME) as START values(ENDTIME) as STOP by WORKLOAD CYCLE | eval _time = strptime(START, "%Y-%m-%d %H:%M:%S") | eval end_time = strptime(STOP, "%Y-%m-%d %H:%M:%S") | eval duration = (end_time - _time) * 1000 | eval JOBNAME = WORKLOAD | stats count by _time,duration, WORKLOAD, JOBNAME | table _time WORKLOAD JOBNAME duration
... View more
Labels
- Labels:
-
using Splunk Cloud
07-13-2021
09:37 AM
Hello, This is the query that I am working on. Its showing multiple time entries. How do we get it to filter down to single entry? (index=xyz source=abc) SMF30JBN=MC2DC03D SMF30JNM=JOB* SMF30STP=5 | table DATETIME SMF30JBN SMF30STP SMF30JNM SMF30STM Thank you, Chinmay.
... View more
Labels
- Labels:
-
using Splunk Cloud
01-26-2021
09:33 AM
Thank you. This solution works. I had used the append command to make it work, but this is more efficient. Regards, Chinmay.
... View more
01-26-2021
08:03 AM
Hi Scelikok, Unfortunately, its still not picking up anything in the Type column. The Type column is blank. Chinmay.
... View more
01-25-2021
01:18 PM
Hi, I tried your latest command with 1=1, "Both". The table still shows Both and not Input or Output. Type Both Both Both
... View more
01-25-2021
01:03 PM
Hi Scelikok, I want the result table to have the following column for type. It should not have "Both" in it. In place of SMF014 I want Input and In place of SMF015 I want Output in the Type Column. Type Input Input Input Input Output Input Output Input
... View more
01-25-2021
12:05 PM
Hi Scelikok, Thank you for the help. It does work. However, I may have defined the problem incorrectly. What I expect the Type column to pick up is INPUT in place of SMF014 and OUTPUT in place of SMF015. Looking forward to your suggesstion. Chinmay.
... View more
01-25-2021
09:07 AM
I am using the following eval command. I want the type column to pick up both the sources. index=xyz (source=smf015 OR source=smf014) | stats values(source) as source by JFCBDSNM DATETIME SMF14JBN SMF14RST SMF14SPN JFCBELNM TIOEDDNM SMF14PGN | eval Type= case(source=smf014,Input,source=smf015,Output, (source=smf015 and source=smf014),Both) | table DATETIME JFCBDSNM SMF14JBN SMF14SPN TIOEDDNM SMF14PGN Type I would appreciate the help.
... View more
Labels
- Labels:
-
using Splunk Cloud
10-22-2020
03:21 PM
We are using the Splunk professional service for the migration as well as re-indexing of data from On-prem to Cloud.
... View more
10-22-2020
03:04 PM
Hello, I am looking for a simple query that would provide me the completion percentage of the data migration from On-prem environment to Cloud. Please see the example below.
... View more
Labels
- Labels:
-
using Splunk Cloud
10-13-2020
02:19 PM
I tried removing the earliest and latest setting in the base search and it still would not give me results for Sept. It is showing for Oct.
... View more
10-13-2020
10:44 AM
I wish to generate the results for month of September. I am currently using the following query, however if i set the date range it doesnt generate results for September. We still see the data for October. index=XYZ source=XYZ (SMF30JBN=F*DC03D OR SMF30JBN=M*DC03D) (SMF30STP=1 OR (SMF30STP=4 AND SMF30STM=DOWNS020)) SMF30JNM=JOB* earliest=@d-48h latest=@d+6h | eval ACTUAL_START = case(SMF30STP=1,DATETIME) | eval ACTUAL_END = case(SMF30STP=4,DATETIME) | stats values(ACTUAL_START) as ACTUAL_START values(ACTUAL_END) as ACTUAL_END by SMF30JNM SMF30JBN | rename SMF30JBN as JOBNAME | eval CYCLE = relative_time(now(),"@d-720m") | eval WEEKDAY=strftime(CYCLE,"%A") | eval CYCLE = strftime(CYCLE, "%Y-%m-%d %H:%M:%S.%2N") | eval MONTH = substr(CYCLE,6,2) | eval DAY = substr(CYCLE,9,2) | eval YEAR = substr(CYCLE,1,4) | eval DATE = substr(CYCLE,1,10) | lookup workloadinfo.csv JOBNAME output WEEK_START WEEK_END WEEK_RT SAT_START SAT_END SAT_RT SYS STATES | eval WEEK_START = case(WEEK_START="SLA0600",relative_time(now(),"@d-1080m"),WEEK_START="SLA0700",relative_time(now(),"@d-1020m"),WEEK_START="SLA1300",relative_time(now(),"@d-660m"),WEEK_START="SLA1400",relative_time(now(),"@d-600m"),WEEK_START="SLA1430",relative_time(now(),"@d-570m"),WEEK_START="SLA1600",relative_time(now(),"@d-480m"),WEEK_START="SLA1700",relative_time(now(),"@d-420m"),WEEK_START="SLA1730",relative_time(now(),"@d-390m"),WEEK_START="SLA1800",relative_time(now(),"@d-360m"),WEEK_START="SLA1830",relative_time(now(),"@d-330m"),WEEK_START="SLA1900",relative_time(now(),"@d-300m"),WEEK_START="SLA1930",relative_time(now(),"@d-270m"),WEEK_START="SLA2000",relative_time(now(),"@d-240m"),WEEK_START="SLA2100",relative_time(now(),"@d-180m"),WEEK_START="SLA2200",relative_time(now(),"@d-120m")) | eval WEEK_END = case(WEEK_END="SLA0600",relative_time(now(),"@d-1080m"),WEEK_END="SLA0700",relative_time(now(),"@d-1020m"),WEEK_END="SLA1300",relative_time(now(),"@d-660m"),WEEK_END="SLA1400",relative_time(now(),"@d-600m"),WEEK_END="SLA1430",relative_time(now(),"@d-570m"),WEEK_END="SLA1600",relative_time(now(),"@d-480m"),WEEK_END="SLA1700",relative_time(now(),"@d-420m"),WEEK_END="SLA1730",relative_time(now(),"@d-390m"),WEEK_END="SLA1800",relative_time(now(),"@d-360m"),WEEK_END="SLA1830",relative_time(now(),"@d-330m"),WEEK_END="SLA1900",relative_time(now(),"@d-300m"),WEEK_END="SLA1930",relative_time(now(),"@d-270m"),WEEK_END="SLA2000",relative_time(now(),"@d-240m"),WEEK_END="SLA2100",relative_time(now(),"@d-180m"),WEEK_END="SLA2200",relative_time(now(),"@d-120m")) | eval SAT_START = case(SAT_START="SLA0600",relative_time(now(),"@d-1080m"),SAT_START="SLA0700",relative_time(now(),"@d-1020m"),SAT_START="SLA1300",relative_time(now(),"@d-660m"),SAT_START="SLA1400",relative_time(now(),"@d-600m"),SAT_START="SLA1430",relative_time(now(),"@d-570m"),SAT_START="SLA1600",relative_time(now(),"@d-480m"),SAT_START="SLA1700",relative_time(now(),"@d-420m"),SAT_START="SLA1730",relative_time(now(),"@d-390m"),SAT_START="SLA1800",relative_time(now(),"@d-360m"),SAT_START="SLA1830",relative_time(now(),"@d-330m"),SAT_START="SLA1900",relative_time(now(),"@d-300m"),SAT_START="SLA1930",relative_time(now(),"@d-270m"),SAT_START="SLA2000",relative_time(now(),"@d-240m"),SAT_START="SLA2100",relative_time(now(),"@d-180m"),SAT_START="SLA2200",relative_time(now(),"@d-120m")) | eval SAT_END = case(SAT_END="SLA0600",relative_time(now(),"@d-1080m"),SAT_END="SLA0700",relative_time(now(),"@d-1020m"),SAT_END="SLA1300",relative_time(now(),"@d-660m"),SAT_END="SLA1400",relative_time(now(),"@d-600m"),SAT_END="SLA1430",relative_time(now(),"@d-570m"),SAT_END="SLA1600",relative_time(now(),"@d-480m"),SAT_END="SLA1700",relative_time(now(),"@d-420m"),SAT_END="SLA1730",relative_time(now(),"@d-390m"),SAT_END="SLA1800",relative_time(now(),"@d-360m"),SAT_END="SLA1830",relative_time(now(),"@d-330m"),SAT_END="SLA1900",relative_time(now(),"@d-300m"),SAT_END="SLA1930",relative_time(now(),"@d-270m"),SAT_END="SLA2000",relative_time(now(),"@d-240m"),SAT_END="SLA2100",relative_time(now(),"@d-180m"),SAT_END="SLA2200",relative_time(now(),"@d-120m")) | eval EXP_START = if(WEEKDAY="Saturday" OR WEEKDAY="Sunday",SAT_START,WEEK_START) | eval EXP_END = if(WEEKDAY="Saturday" OR WEEKDAY="Sunday",SAT_END,WEEK_END) | eval RUNTIME = if(WEEKDAY="Saturday" OR WEEKDAY="Sunday",SAT_RT,WEEK_RT) | eval ACTUAL_START = strptime(ACTUAL_START, "%Y-%m-%d %H:%M:%S.%2N") | eval ACTUAL_END = strptime(ACTUAL_END, "%Y-%m-%d %H:%M:%S.%2N") | eval STARTC = case(ACTUAL_START < EXP_START AND ACTUAL_END > EXP_START, EXP_START,ACTUAL_START > EXP_START,ACTUAL_START,(ACTUAL_START < EXP_START AND ACTUAL_END < EXP_START),null(),(ACTUAL_START > EXP_END AND ACTUAL_END > EXP_END),null()) | eval ENDC = case(ACTUAL_END > EXP_END AND ACTUAL_START < EXP_END, EXP_END, ACTUAL_END < EXP_END,ACTUAL_END,(ACTUAL_START < EXP_START AND ACTUAL_END < EXP_START),null(),(ACTUAL_START > EXP_END AND ACTUAL_END > EXP_END),null()) | eval DURATION =(ENDC-STARTC)/60 | eval ACTUAL_START = strftime(ACTUAL_START, "%Y-%m-%d %H:%M:%S.%2N") | eval ACTUAL_END = strftime(ACTUAL_END, "%Y-%m-%d %H:%M:%S.%2N") | eval EXP_START = strftime(EXP_START, "%Y-%m-%d %H:%M:%S.%2N") | eval EXP_END = strftime(EXP_END, "%Y-%m-%d %H:%M:%S.%2N") | eval STARTC = strftime(STARTC, "%Y-%m-%d %H:%M:%S.%2N") | eval ENDC = strftime(ENDC, "%Y-%m-%d %H:%M:%S.%2N") | eval DURATION =if(DURATION < 0,0,DURATION) | eval DURATION = round(DURATION,2) | stats values(ACTUAL_START) as ACTUALSTART values(ACTUAL_END) as ACTUALEND values(EXP_START) as EXPSTART values(EXP_END) as EXPEND latest(STARTC) as CALCSTART latest(ENDC) as CALCEND sum(DURATION) as AVAILABILITY values(RUNTIME) as EXPRUNTIME values(WEEKDAY) as WEEKDAY values(MONTH) as MONTH values(DATE) as DATE values(SYS) as TYPE values(STATES) as CONTRACTOR values(YEAR) as YEAR values(DAY) as DAY by JOBNAME | eval DOWNTIME = round(abs(AVAILABILITY - EXPRUNTIME),2) | eval SLA_PERC = round(((AVAILABILITY / EXPRUNTIME) * 100),2) | eval AVAILABILITY = if(SLA_PERC > 100, ((AVAILABILITY)-(EXPRUNTIME)), AVAILABILITY) | eval SLA_PERC = if(SLA_PERC > 100, ((SLA_PERC)-100), SLA_PERC) | eval WORKLOAD = substr(JOBNAME, 1, 3) | fields *
... View more
Labels
- Labels:
-
using Splunk Cloud
07-30-2020
01:50 PM
Hi r. Ismo, Yes.
... View more
07-30-2020
09:53 AM
I have worked on a query in order to generate a report that gives us the monthly visits and bandwidth used etc. I have listed the query below. It gives the results in the splunk environment. But when we generate a PDF document we see the error listed below the query, after the results table. I would appreciate suggestions to resolve this issue. |rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)" |rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)" |rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)" |timechart span=1mon@mon dc(reqip) as "Unique Visitors", dc(uri) as Pages, sum(bytes) as Bandwidth(KB), count(uri) as Hits |eval Bandwidth(KB) = round('Bandwidth(KB)'/1024,2) |append [search index="med" sourcetype="med:httpaccess:log" *med.cms.gov* |rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)" |rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)" |rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)" |bin span=1mon@mon _time |stats count(uri) as viewed by _time, reqip |stats sum(viewed) as "Number of Visits" by _time] |stats values(*) as * by _time |fillnull |addcoltotals label="Total" labelfield="_time" |table _time "Unique Visitors" "Number of Visits" Pages Hits Bandwidth(KB) The expected result is
... View more
- Tags:
- Splunk Enterprise
Labels
- Labels:
-
using Splunk Cloud
07-13-2020
02:01 PM
without the convert command also I am seeing the same problem....the original data is in seconds.
... View more
07-13-2020
01:32 PM
I am working with a different query for Online CPU time in seconds and in that query the stats sum command work. here is the other query... | rex field=DATA "\S(?<DATE>.{10})(?<WORKLOAD>.{3})\S.{137}(?<CPU>.{7}).*" | where WORKLOAD in("F91","F92","FA1","FA2","FA3","FB2","FC4","FC5","FC6","FH1","FH2","FH3","FH4","FNC","FSC") | eval CPU_min=(CPU/60) | eval CPU_MIN=round(CPU_min, 2) | table WORKLOAD CPU_MIN | stats sum(CPU_MIN) as ONLINE_CPU_TIME by WORKLOAD
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-24-2023
04:44 PM
|
Karma given to
