About PradReddy

PradReddy · ‎11-04-2021

Hi jtoy1986, If visualization is a Statistics Table then you can define rules for coloring as below XML: <table> <search> <query>| makeresults | eval deviceSeverity = "Up" | append [| makeresults | eval deviceSeverity = "Down" ] | stats latest(deviceSeverity) | eval range=case(deviceSeverity == "Up", "low", deviceSeverity == "Down", "severe")</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="latest(deviceSeverity)"> <colorPalette type="map">{"Down":#DC4E41,"Up":#53A051}</colorPalette> </format> </table> ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎10-24-2021

Hi corti77, I have created a test search and referred it inside dashboard panel as mentioned below which worked without any issues Please check permissions associated with those saved search as well as index referred inside it <panel> <title>TEST SAVED SEARCH RESULTS</title> <table> <search ref="WFH TEST SEARCH"></search> <option name="count">5</option> <option name="drilldown">none</option> </table> </panel>

PradReddy · ‎10-24-2021

Hi adarshbc, Try using "trendline" command and information around that command can be found here https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Trendline Please adjust Product and version that suits your enterprise ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎10-24-2021

Hi mgbersales, Does Saturday / Tuesday refers to any specific dates or irrespective of date, if _time falls between any Saturday 8pm - Tuesday 8am then eliminate those events?

PradReddy · ‎10-24-2021

Hi bdunstan, Can you please run searches (3) and (4) to see how lipsy searches differ in the search.log and then we can narrow down to issue for failures In general TERM Match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor segmenters, such as periods or underscores. Here's some good documentation on this. https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/UseCASEandTERMtomatchphrases ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎10-24-2021

Hi bdunstan, To modify the app bar for your custom app, edit its navigation definition file, default.xml. You must refresh Splunk Web before you can see your changes. 1) In your text editor, open $SPLUNK_HOME/etc/apps/appname/default/data/ui/nav/default.xml. 2) Make your changes to the XML, then save the file. 3) To view changes, navigate to http://<host>:<mport>/debug/refresh, click Refresh to refresh Splunk Web, then navigate to your app in the web browser. Code for your requirements <collection label="Help"> <a href="link">Tutorials</a> <a href="link">Help with this page</a> <a href="link">File a bug</a> </collection> ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎10-24-2021

Hi sahana, Please use this blog for making a dashboard with tabs https://www.splunk.com/en_us/blog/tips-and-tricks/making-a-dashboard-with-tabs-and-searches-that-run-when-clicked.html ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎10-24-2021

Hi L1mLam, Just use field name in this option and it will work More information around alert suppression configuration attributes can be found here - https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Savedsearchesconf#alert_suppression.2Fseverity.2Fexpiration.2Ftracking.2Fviewing_settings alert.suppress.fields = <comma-delimited-field-list> * List of fields to use when suppressing per-result alerts. This field *must* be specified if the digest mode is disabled and suppression is enabled. * Default: empty string. ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎10-24-2021

Hi posuw, Can you please elaborate on need to find look match ?

PradReddy · ‎10-24-2021

Hi thisissplunk, Tstats search syntax seems correct and able to get a valid output for distinct_count on my end. To my understanding there is no limitations for distinct_count aggregate function. When you enable acceleration for a data model, Splunk software builds the initial set of .tsidx file summaries for the data model and then runs scheduled searches in the background every 5 minutes to keep those summaries up to date. Each update ensures that the entire configured time range is covered without a significant gap in data. This method of summary building also ensures that late-arriving data is summarized without complication. Can you please verify DM accelerations searches executions status using below search index=_internal sourcetype="scheduler" savedsearch_id="<user>;<appname>;_ACCELERATE_DM_<appname>_<DataModelName>_ACCELERATE_" ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎10-24-2021

Hi cyber_Maddy, Overuse of real-time search can result in performance costs and in this you are not able to scheduled a real-time alert because of restrictions that have applied in your environment Options for restricting real-time search are as follows: 1) Disable real-time search at the indexer level by editing indexes.conf for specific indexes. 2) Disable real-time search for particular roles and users. 3) Edit limits.conf to reduce the number of real-time searches that can be run concurrently at any given time. 4) Edit limits.conf to restrict indexer support for real-time searches. The documentation, How to restrict usage of real-time search is where you will want to go. https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/Restrictrealtimesearch Also, make sure you're reading the documentation for your version of Splunk. ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎10-23-2021

Hi pk0024, It seems your base search is a non-transforming search, you must explicitly state in the base search what fields will be used in the post-process search using the | fields command. As per splunk best practices around base search usage can be found here - https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/Savedsearches (adjust version that suits your environment) On another note - In regards to eventtype is that "0" expected or is it a typo mistake eventtype="err0r" ------ An upvote would be appreciated and Accept Solution if it helps!

PradReddy · ‎02-15-2021

PradReddy · ‎07-19-2020

Hi mztopp, Please check if this helps for alert Query: | makeresults | eval User_Name="a",POP_Address="192.168.0.1" | append [| makeresults | eval User_Name="a",POP_Address="172.16.0.1"] | append [| makeresults | eval User_Name="b",POP_Address="193.168.0.1"] | append [| makeresults | eval User_Name="c",POP_Address="172.16.0.1"] | append [| makeresults | eval User_Name="b",POP_Address="194.168.0.1"] | append [| makeresults | eval User_Name="a",POP_Address="194.168.0.1"] | fields _time User_Name POP_Address | eval Connection_Type=case(LIKE(POP_Address,"192.168%"),"Internal",LIKE(POP_Address,"172.16%"),"Internal",0=0,"External") | stats sum(eval(Connection_Type="Internal")) as Internal sum(eval(Connection_Type="External")) as External count AS Total by User_Name | fillnull value=0 Internal,External Output: Once you have defined condition when this alert needs to be triggered please user "WHERE" command Example: | where External>1 Alert gets triggered including users when External connections are greater than 1 like this Thanks, Pradeep Reddy

PradReddy · ‎07-19-2020

Posts	15
Solutions	3
Karma Given	0
Karma Received	2
Member Since	‎10-19-2017

Online Status	Offline
Date Last Visited	‎06-08-2024 12:55 PM

Re: Dashboard Background Color Formatting Based on...

Re: no results found in dashboard but the query do...

Re: Trendline for splunk query

Re: Filter events based on the time range(day of w...

Re: TERM(): How does it work under the covers ?

Re: Help: Customise Navigation (Help)

Re: Need to create tab view for dashboard panel

Re: Alert notifications being incorrectly suppress...

Re: search log on list of server ip without using ...

Re: tstats with count() works but dc() produces 0 ...

Re: Real time alert option not available

Re: Splunk query doesnt show results in dashboard ...

Re: Search a Datamodel using field values from a l...

Re: How to create a single query that can show Int...

Re: How to create a single query that can show Int...