Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kdulhan
kdulhan
Explorer
Member since:
08-30-2017
06-05-2020
Community Statistics
| Posts | 38 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 08-30-2017 |
Activity Feed
- Got Karma for Searching a particular field and performing actions based on its presence and value. 06-05-2020 12:49 AM
- Got Karma for Sum to have a value as zero in case not found. 06-05-2020 12:49 AM
- Posted Re: Sum to have a value as zero in case not found on Splunk Search. 09-22-2017 12:23 PM
- Posted Re: Sum to have a value as zero in case not found on Splunk Search. 09-22-2017 12:19 PM
- Posted Sum to have a value as zero in case not found on Splunk Search. 09-22-2017 08:59 AM
- Tagged Sum to have a value as zero in case not found on Splunk Search. 09-22-2017 08:59 AM
- Tagged Sum to have a value as zero in case not found on Splunk Search. 09-22-2017 08:59 AM
- Tagged Sum to have a value as zero in case not found on Splunk Search. 09-22-2017 08:59 AM
- Posted Re: Splunk dashboard refresh every 24 hours required (00:00 to 24:00 MST Hours) on Reporting. 09-22-2017 08:35 AM
- Posted Re: Splunk dashboard refresh every 24 hours required (00:00 to 24:00 MST Hours) on Reporting. 09-20-2017 07:20 AM
- Posted Splunk dashboard refresh every 24 hours required (00:00 to 24:00 MST Hours) on Reporting. 09-19-2017 08:06 AM
- Tagged Splunk dashboard refresh every 24 hours required (00:00 to 24:00 MST Hours) on Reporting. 09-19-2017 08:06 AM
- Tagged Splunk dashboard refresh every 24 hours required (00:00 to 24:00 MST Hours) on Reporting. 09-19-2017 08:06 AM
- Tagged Splunk dashboard refresh every 24 hours required (00:00 to 24:00 MST Hours) on Reporting. 09-19-2017 08:06 AM
- Posted How can I get the percentage of requests taking less then 500ms? on Splunk Dev. 09-12-2017 06:46 AM
- Tagged How can I get the percentage of requests taking less then 500ms? on Splunk Dev. 09-12-2017 06:46 AM
- Tagged How can I get the percentage of requests taking less then 500ms? on Splunk Dev. 09-12-2017 06:46 AM
- Posted How do I auto-refresh a dashboard? on Dashboards & Visualizations. 09-04-2017 02:26 PM
- Tagged How do I auto-refresh a dashboard? on Dashboards & Visualizations. 09-04-2017 02:26 PM
- Tagged How do I auto-refresh a dashboard? on Dashboards & Visualizations. 09-04-2017 02:26 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
09-22-2017
12:23 PM
I have the above as a part of biq search query so can't add it. My complete query has the below as a two columns in appendcols.
Search ns=app1 Error | stats sum(eval(AcctNo="'1000394'")) as "FailedOccurences" sum(eval(AcctNo!="'1000394'")) as "SuccessOccurences"
Please let me know how to get the value of 0 for Failed and Success Occureances if not found.
Thanks
... View more
09-22-2017
08:59 AM
1 Karma
Hi All,
I have some search criteria followed by stats as:
Search ns=app1 Error | stats sum(eval(AcctNo="'1000394'")) as "FailedOccurences".
In case if that AcctNo is not found in the Search, it does not display FailedOccurences.
Kindly let me how can I get a value of Zero for FailedOccurences if AcctNo is not found in Search result.
Thank you.
... View more
09-22-2017
08:35 AM
Thanks.
I have two reports sending results as an Inline table in the email. That means I am getting two emails with inline table results generated from two reports. Can I consolidate the results into a single email with two inline tables.
... View more
09-20-2017
07:20 AM
I have saved the search as a scheduled search to run at 8:00 everyday. And selected the Time range as Yesterday. Kindly let me know if this will pick all the events for Yesterday starting at 00:00:00 and ending at 24:00:00. If not, please let me know a way to have the time range for the reporting events to be yesterday starting at 00:00:00 and ending at 24:00:00.
So if it runs on 20/09 at 8:00, it should have the events from 19/09 00:00:00 to 19/09 24:00:00. And next time it runs on 21/09 at 8:00, it should have the events from 20/09 00:00:00 to 20/09 24:00:00.
Thanks.
... View more
09-19-2017
08:06 AM
Hi All,
I have a SPLUNK search query which I run on a daily basis for the past day by selecting Date Range Between 09/18/2017 00:00:00 and 09/18/2017 24:00:00 i.e. for one complete day.
I get some tabular statistics providing a summary of total records, failed and passed records for that day.
Now if I want to automate this to run for everyday to get the summary results for previous day and display it on dashboard.
After getting the summary view in tabular format using the Date range selected, I Save it as Dashboard Panel, Panel powered by Inline Search.
And then I go to View Dashboard.
Click on Edit > Edit Search (Mirror Icon) > Select Time Range as 'Use Time Picker' -> Auto Refresh Delay and click on Custom to put 24h. And then Save it.
Please let me know if it will refresh the Dashboard panel exactly after 24hours considering the Date Range provided i.e. Between 09/18/2017 00:00:00 and 09/18/2017 24:00:00. So next refresh will give me data for Date Range Between 09/19/2017 00:00:00 and 09/19/2017 24:00:00. And I need the refresh to happen on 09/20/2017 at 2:00 AM.
Thank you.
... View more
09-12-2017
06:46 AM
I have a below query:
index=idx1 | search 'apiname' = AccountSec | eval TotalTime=Start-End | stats count as "TotalRequests",count(eval(StatusCode like "2%")) as "SuccessCount",count(eval(StatusCode = "500")) as "Error 500",count(eval(StatusCode > "200")) as "Total errors" ,count(eval(TotalTime>500)) as "Count1"by apiname
Kindly let me know how can I get the percentage of requests taking less then 500ms i.e. ((TotalRequests-Count1)/TotalRequests)*100.
... View more
- Tags:
- ms
- splunk-enterprise
09-04-2017
02:26 PM
I have pasted the Search query which gives me the count in the search bar and saved as Dashboard showing number of count columns. Kindly let me know how can I set this Dashboard to be refreshed every 1 hour or 24 hours.
Thank you!
... View more
09-04-2017
01:33 PM
Can I have eval and stats count after ActNo as
timestamp ns=app1 [ErrorResponse] Service='trigger1' id=105 [ns=app1 Service='trigger1' Id!='temp-100' | Search ErrorResponse | table ActNo | eval | stats count as "Count1"]
Also I want to check if there are records with that ActNo in the outer search or not. If not, I want to write that ActNo.
Thank you!
... View more
09-02-2017
11:44 AM
Yes. And apologies for changing the contents as I was also not sure on the pattern of events I was getting. Thank you!
... View more
09-01-2017
01:52 PM
AppId in the events is displayed with single quotes as appId='New1'
... View more
09-01-2017
01:51 PM
Sorry it is displayed in event with single quotes as appId='New1'
... View more
09-01-2017
01:51 PM
appId in the event is displayed as appId=='New1'
... View more
09-01-2017
01:50 PM
appId in the event is displayed as appId=='New1'
... View more
09-01-2017
01:43 PM
Thanks.
I get the account no and two counters as counter and bothcounters. But for every account no, it is only bothcounters having value as 1 while counter is always 0 which is not the case with respect to events as they got the some of the AcctNo has the appId as New1 and other's don't.
... View more
09-01-2017
01:36 PM
index=l2_idx ns=app1 Service='trigger1' Id!='temp-100 ErrorResponse | fields ActNo | stats sum(eval(appId=="New1")) as counter1 sum(eval(appId!=="New1")) as counter2 by ActNo
Getting error as:
Error in 'stats' command: The eval expression for dynamic field 'eval(appId!=="New1")' is invalid. Error='The expression is malformed. An unexpected character is reached at '="New1"'.
... View more
09-01-2017
09:51 AM
In order to search for the error records, I use :
ns=app1 Service='trigger1' Id!='temp-100' | Search ErrorResponse
Here I get an event like:
timestamp ns=app1 [ErrorResponse] Service='trigger1' id=105 ActNo=1234
Now I have to fetch this ActNo field and search with only ActNo=1234. It will list many events and in those I have to look for a field appId = 'New1'. If New1, I have to add it to a counter1 else counter2.
Thank you!
... View more
09-01-2017
06:54 AM
I have a below SPLUNK event:
ns=app1 Service='trigger1' id=100 ActNo='101' ServiceType='REST',ResponseCode='200',ResponseTime='322ms'
I want to extract all the events where ResponseTime>1000ms.
ns=app1 Service='trigger1' id=100 | stats count(eval(ResponseTime>"'500ms'")) as "Count SLA > 500 ms" works fine.
But when i try to search for the events with ResponseTIme>1000ms using
ns=app1 Service='trigger1' id=100 | stats count(eval(ResponseTime>"'1000ms'")) as "Count SLA > 1000 ms"
whereas I have the events with ResponseTime > 1000ms
I am able to search an event with ResponseTime="'1552ms'"
i.e. ns=app1 Service='trigger1' id=100 | ResponseTime="'1552ms'"
Thank you!
... View more
- Tags:
- splunk-enterprise
09-01-2017
06:18 AM
My bad. I misread/misunderstood the logs. Kindly provide the guidance for my recent posted query.
... View more
09-01-2017
03:27 AM
In order to search for the error records, I use :
ns=app1 Service='trigger1' Id!='temp-100' | Search ErrorResponse
Here I get an event like:
timestamp ns=app1 [ErrorResponse] Service='trigger1' id=105 ActNo=1234
Now I have to fetch this ActNo field and search with only ActNo=1234. It will list many events and in those I have to look for a field appId = 'New1'. If New1, I have to add it to a counter1 else counter2.
Thank you!
... View more
09-01-2017
03:26 AM
In order to search for the error records, I use :
ns=app1 Service='trigger1' Id!='temp-100' | Search ErrorResponse
Here I get an event like:
timestamp ns=app1 [ErrorResponse] Service='trigger1' id=105 ActNo=1234
Now I have to fetch this ActNo field and search with only ActNo=1234. It will list many events and in those I have to look for a field appId = 'New1'. If New1, I have to add it to a counter1 else counter2.
Thank you!
... View more
09-01-2017
02:21 AM
Hello,
In order to search for the error records, I use :
ns=app1 Service='trigger1' Id!='temp-100' | Search ErrorResponse
Here I get an event like:
timestamp ns=app1 [ErrorResponse] Service='trigger1' id=105 ActNo=1234
Now I have to fetch this ActNo field and search with only ActNo=1234. It will list many events and in those I have to look for a field appId = 'New1'. If New1, I have to add it to a counter1 else counter2.
Thank you!
... View more
08-31-2017
03:24 PM
Yes it worked, thanks a ton.
I have another query posed on the same line with subject 'Searching a particular field and performing actions based on its presence and value'. I think you might be able to help me quickly in that.
Thank You!.
... View more
08-31-2017
02:56 PM
Is there any way where we can search ErrorResponse independently and club the count with count1 and count2 in a tabular format?
... View more
