Activity Feed
- Posted Re: How to merge two charts which have different stats by in Splunk on Splunk Search. 07-30-2020 10:34 AM
- Karma Re: How to merge two charts which have different stats by in Splunk for gcusello. 07-30-2020 10:33 AM
- Posted Re: How to merge two charts which have different stats by in Splunk on Splunk Search. 07-29-2020 01:22 AM
- Tagged Re: How to merge two charts which have different stats by in Splunk on Splunk Search. 07-29-2020 01:22 AM
- Tagged Re: How to merge two charts which have different stats by in Splunk on Splunk Search. 07-29-2020 01:22 AM
- Karma Re: How to merge two charts which have different stats by in Splunk for gcusello. 07-29-2020 01:19 AM
- Posted Re: How to merge two charts which have different stats by in Splunk on Splunk Search. 07-28-2020 10:25 AM
- Posted How to merge two charts which have different stats by in Splunk on Splunk Search. 07-28-2020 03:59 AM
- Posted Re: how to only check events from the latest source file on Splunk Search. 07-06-2020 03:07 AM
- Posted Re: how to only check events from the latest source file on Splunk Search. 07-06-2020 03:06 AM
- Posted Re: The values of the table are made to come to the start of the column instead of filling zeros on Splunk Search. 06-26-2020 08:07 AM
- Karma Re: The values of the table are made to come to the start of the column instead of filling zeros for richgalloway. 06-26-2020 08:06 AM
- Posted The values of the table are made to come to the start of the column instead of filling zeros on Splunk Search. 06-26-2020 07:37 AM
- Posted How to display contents of two field as range in x-axis in Splunk? on Splunk Enterprise. 06-18-2020 06:47 AM
- Tagged How to display contents of two field as range in x-axis in Splunk? on Splunk Enterprise. 06-18-2020 06:47 AM
- Tagged How to display contents of two field as range in x-axis in Splunk? on Splunk Enterprise. 06-18-2020 06:47 AM
- Tagged How to display contents of two field as range in x-axis in Splunk? on Splunk Enterprise. 06-18-2020 06:47 AM
- Karma How to replace replace strings? for saurabhkunte. 06-17-2020 12:33 AM
- Karma Re: replace strings for Richfez. 06-17-2020 12:33 AM
- Tagged How to combine two search queries where one query has to use a filter option? on Splunk Enterprise. 06-16-2020 11:27 PM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 |
07-30-2020
10:34 AM
Yeah i resolved by using filldown and fillnull. Thanks so much @gcusello
... View more
07-29-2020
01:22 AM
Thank u so much @gcusello . This worked....Got a small prob alone..like there are empty cell for certain columns...I am trying to fill the empty columns with 0 but its not happening. Tried this, But it didnot work eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(<<FIELD>>)==0, "0", <<FIELD>>)
... View more
07-28-2020
10:25 AM
Hi @gcusello , This almost worked, only thing is wherever DueOpen had values those respective Calender weeks alone got repeated...Hence displaying the x-axis with two times the same CW like this. I tried dedup CW before the sort, but that seems to remove the DueOpen . Is there a way to solve this.
... View more
07-28-2020
03:59 AM
Hi, I wanted a single graph to show values. One search is index="cumu_open_csv" Assignee="ram" | eval open_field=if(in(Status,"Open","Reopened","Waiting","In Progress"), 1,0) | stats count(eval(open_field=1)) AS Open, count(eval(open_field=0)) AS closed by CW_Created this gives me a table as Similarly I have another search index="cumu_open_csv" Assignee="ram" | eval open_field=if(in(Status,"Open","Reopened","Waiting","In Progress"), 1,0) | stats count(eval(open_field=1)) As DueOpen by CW_DueDate which gives me another table as I tried to combine these two using appendcols...but the X-axis has only the CW_Created and displays the second table details in wrong CW. I wanted CW_Created and CW_Duedate to be combined and provide the result in a single table like CW, Open,Close,DueCount wherever DueCount is not for a particular CW fill it with 0, for others display the data like so.. Open Close DueCount CW27 7 0 0 CW28 2 0 0 CW29 0 0 4 CW30 0 7 3 CW31 0 0 1 CW32 0 0 1 Kindly help me with this.
... View more
07-06-2020
03:07 AM
Hi @inventsekar ..I tried the solution which u provided...It didnot work is there any other solution
... View more
07-06-2020
03:06 AM
Hi...I tried the answer which you provided...It didn't work..is there any other way...
... View more
06-26-2020
08:07 AM
@richgalloway Thank you so much for the quick reply!! It worked!!
... View more
06-26-2020
07:37 AM
Hi, I am writing a search to create 3 columns of data P,F and C based on Teams. The table which I expect is this Teams P C F team1 441 0 6 team2 4668 0 0 team3 2163 57 27 and the result table which i got is Teams P C F team1 441 57 6 team2 4668 27 team3 2163 The search which i am using is index="fq" | where Status="P" | stats count as P by Teams | fillnull value=0 P | appendcols [ search index="fq" | where Status="F" | stats count as F by Teams | fillnull value=0 F] | appendcols [ search index="fq" | where Status="C" | stats count as C by Teams | fillnull value=0 "Covered"] Used fillnull too..But it did not work Kindly help me with this.
... View more
06-18-2020
06:47 AM
Hi, I have two fields as Created_time and Updated_time. Example: Created_time ---- Updated_time 9.15am ---- 10.35am Is it possible to bring both the field values on x-axis (like a range....like first value of x-axis is 9.15am it shows a particular count and the second value of x-axis is 10.35am showing count) Is this possible. Kindly help me with this
... View more
- Tags:
- eval
- range
- transaction
Labels
- Labels:
-
using Splunk Enterprise
06-16-2020
10:43 PM
I have a search query as sourcetype="file.csv"|eval Created_Date = mvindex(split(Created," "),0)| stats count as Issues_created by Created_Date which gives me output as Similarly another search query as sourcetype="file.csv" Resolved|eval Created_Date = mvindex(split(Created," "),0)|stats count as Issues_Resolved by Created_Date basically i am filtering out events which have status as Resolved and creating events which gives me output as I want to combine these two queris to give me bar chart which will display the statistics as Created_Date ---- Issues_created ---- Issues_Resolved 01-01-2020 8 8 01-02-2020 9 0 01-03-2020 6 1 Kindly help me with this..
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-16-2020
06:43 AM
Thanks!! It worked!!
... View more
06-16-2020
03:38 AM
I have a Python script which will take input file as .log and produces .csv files. I used to upload these .csv files in Splunk and process them to create charts and Statistics table. I wanted to know if there is any option where I upload all .log files to splunk and the Python script will run on the .log files which are uploaded to splunk and generate .csv files which are automatically uploaded to splunk... In Short, a one-shot solution...like At the beginning I will just upload all .log files ...maybe with click of a button in dashboard it can create all .csv files, upload them automatically and then i can create queries to create Charts.
... View more
Labels
- Labels:
-
Other
06-16-2020
03:29 AM
Hi @javiergn ...the query you suggested produced a field which is same as count but with first row not filled... the addition did not happen
... View more
06-16-2020
02:52 AM
I have a two fields Calendar_week, Count... I am trying to create a New field as Cumulative count which will add the previous cumulative count with Current Count. For eg Calender_week----Count----Cumulative_Count 1 ---- 0 ----0 2 ---- 1 ----1 3 ---- 2 ----3 Is there a search which could do this.. Thanks
... View more
Labels
- Labels:
-
eval
-
field extraction
06-12-2020
03:37 AM
Yeah...I am using splunk as Administrator... Through CLI , my access to the folder is denied. What should I do to resolve this.
... View more
06-11-2020
11:50 PM
Hi...I have installed trial version of Splunk.
It is very strange that I see a folder named as Splunk in my Program files of C:
I am able to create Apps, do searches , Dashboards and everything. But I wanted to open the Splunk directory in C: but couldn't open it. The Folder just doesn't open. Could there be any specific reason for this.
KIndly help me with this. Thanks!!
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-10-2020
02:11 AM
Thank you so much!! Got it
... View more
06-10-2020
02:04 AM
| inputlookup source_file_name.csv This search does not work for me...It gives me statistics(0) ... Could there be any reason for this
... View more
06-10-2020
01:57 AM
| inputlookup source_file_name.csv This search does not work for me...It gives me statistics(0) ... Could there be any reason for this
... View more
06-10-2020
01:08 AM
I used to display the content as table using this command in search table Name, Date, Icecream_purchased, Choco_purchased Using as table can help in creating Charts For chart creation: |chart value(Icecream_purchased),value(Choco_purchased) over Name by Date Is there a way to get this chart if I use inputlookup?
... View more
06-10-2020
12:47 AM
Hi....I am relatively new to Splunk...
So i am uploading a csv file as a input to splunk and trying to plot charts....The thing I have the contents of csv file in a specific format...
Example:
so when i upload this csv to splunk it creates a table like this
The problem is the Names are not shown for certain rows (even though the user knows from seeing the csv that first 5 rows belong to Raja and next 5 rows belong to Pragya) and only in some rows Names can be seen..
Is there anything we can do in splunk internally to solve this...Any help would be great!! Thanks!!
... View more
Labels
- Labels:
-
CSV