About sh254087

sh254087 · ‎04-03-2024

@RichfezThanks for the response, Rich. Since mvexpand/mkemv are basics when it comes to splitting a field value, I had given it a try and tried again now as well. Like you've mentioned, trying this on the example data gives me 13 rows output. But once I'm there, I do not know how to pick one pair of values for a row from the expanded list of values, spread across multiple rows. Time parameter value x a x1 x c x1 x b x1 x a x2 x c x2 x b x2 x a x3 x c x3 x b x3 y d y1 y e y1 y d y2 y e y2 After this, I'm unsure how to achieve the expected output: Time parameter value x a x1 x c x2 x b x3 y d y1 y e y2

sh254087 · ‎03-28-2024

I have OS log data coming from Windows/linux into splunk. I have a particular field with values unseparated. Sample log data representation. _time parameter value x a c b x1 x a c b x2 x a c b x3 y d e y1 y d e y2 I would want to splint the parameter field's values in such a way that each parameter field will have one of the group values, in same order. Sample output : _time parameter value x a x1 x c x2 x b x3 y d y1 y e y2 Can someone please help?

sh254087 · ‎12-14-2023

Getting "Unexpected error downloading update: Connection reset by peer" while trying to install add-on from splunkbase (via 'Find more apps) Internet is connected, I'm able to access splunk application as well. Only the installation is failing. Earlier to this, I was getting SSL error when I try to open this page. Then I set sslVerifyServerCert to false, after which the page started loading. I'm not sure if some SSL related blocking still exists. Any suggestions around getting through this?

sh254087 · ‎08-09-2023

I know it's an old question, but still trying to answer just in case if it helps someone who'd come here. In this scenario there are two options - A drilldown table (I know you mentioned link to search, but still mentioning this as this is the most suited approach than a link to search) Select manage tokens from drilldown options, instead of open in search. Set a token value for on-click. ex. showDetails="true" (also, here you can either show a common data/table or show separate data based on the clicked value, set the token value accordingly) In the next row, add a table with your query and specify depends="$showDetails$" in the row element. In step b, if you've decided for a specific value based tables or queries, you will have to modify the query in step c to use that token value in your query so that the data shows up in relation to the value clicked / passed. Likewise, you can add one more token and one more table with different token value. To hide the table that shows up after the on-click action on the main table, edit drill down on the sub-table and select manage token. Here unset the used tokens. Now whenever the user clicks on this sub-table, it'll disappear. With this, you need not navigate the user to a different page, also, need not worry about showing up the query behind your subsearch. 2. A saved report or a separate dashboard a. run a search with your query for the drill down which you want to show on-click. b. save it as a report or a separate dashboard c. from the edit drill down option on the main dashboard table, map this report/dashboard. this was it'll not show up the search query. In any case, make sure to specify the link.visible=false in your all dashboards/panels, like mentioned in the solution of the main question in this page. Without this, the user will still be able to open the query in a new search window.

sh254087 · ‎07-28-2023

This just worked perfectly. Thank you very much, @ITWhisperer . I had never used eventstats practically. Will check more on it.

sh254087 · ‎07-28-2023

I'm facing a weird issue. I'm not able to calculate percentage value when I use two variables/fields. I have a lookup file which looks something like - sl,Service,x_value 1,X,0.211 2,other,0.190 3,Y,0 4,X,0.200 5,other,0.220 I'm trying to get two columns in my resultant table to show total by service and percentage by service, respectively. I've tried this - percentage needs to be calculated using 2 fields whereas perc1 and perc2 are substituted with one of those two field values. While the perc1 and perc2 gets processed and displayed, percentage doesn't show up. I'm not sure what is that I'm doing wrong here. Can somebody please help?

sh254087 · ‎06-06-2023

I was getting similar error while trying to start the splunk service - "Operation "ospath_fopen" failed in /opt/splunk/src/libzero/conf-mutator-locking.c:338, conf_mutator_lock(); Permission denied" and the service start was failing. Following your suggestion, tried - "<splunk_home>/bin/splunk clean locks" and tried starting the service. It worked without issues; service was started, and the Web UI came up as well. Many thanks to you. Splunk Enterprise Version: 9.0.4.1

sh254087 · ‎05-29-2023

To keep it simpler, just trying with AWS cloud, to begin with. Here's how my region_coordinates.csv which has the region, latitude and longitude and other fields looks like - I have services and their respective cost consumption data which looks like this (on a trellis-pie visualization, just used this to convey better)- I am trying to get thispie visualization on a map something like this - (referring to 'sample dashboard example' app) - Tried geom and geostats command but did not get expected output.

sh254087 · ‎05-28-2023

I have the cloud consumption information indexed in real-time. I do not (or can not) have the consumption information in a csv. I want this map to showcase the cloud consumption data across different regions in real-time. I can come up with a csv having long and lat values for each cloud-regions. I'm unsure how to link these two to come up with the map visualization.

sh254087 · ‎05-26-2023

I am trying to understand how I can plot my multi-cloud subscription/service consumption data from different geo regions, on a clustered choropleth map visualization. I have multi-cloud subscriptions with services provisioned and consumed from different regions. I want to know where to start with - from reading articles and documentation, I understand I should have longitude, latitude information in my data for each of the regions that I want to plot data for(at least, if not for all). None of my CSP data in respective indexes have this information. If I have to come up with a CSV, unsure how I'll link them to get this to working. Anyone came across similar use-case? Any help would be appreciated.

sh254087 · ‎04-11-2023

I have a column that holds OS Name along with it's version details. os_full_name CentOS Linux release 7.1.1503 (Core) CentOS Linux release 7.2.1511 (Core) CentOS Linux release 7.4.1708 (Core) Fire Linux OS 6.2.0-42 Microsoft Windows Server 2008 R2 Enterprise Version 6.1.7601 Build 7601 Microsoft Windows Server 2012 R2 Datacenter Version 6.3.9600 Build 9600 Microsoft Windows Server 2012 R2 Standard Version 6.3.9600 Build 9600 Microsoft Windows Server 2016 Red Hat Enterprise Linux Server release 6.3 (Santiago) Red Hat Enterprise Linux Server release 6.9 (Santiago) SUSE Linux Enterprise Server 11 (x86_64) VERSION = 11 PATCHLEVEL = 4 SUSE Linux Enterprise Server 12 (x86_64) VERSION = 12 PATCHLEVEL = 3 Ubuntu 14.04.3 LTS Ubuntu 16.04 LTS Ubuntu 16.04.3 LTS VMware ESXi vmnix-x86 5.5.0 I want to split this column so that I get OS name and Version details in separate fields to get something like - os_full_name os_name os_version CentOS Linux release 7.1.1503 (Core) CentOS Linux release 7.1.1503 (Core) CentOS Linux release 7.2.1511 (Core) CentOS Linux release 7.2.1511 (Core) CentOS Linux release 7.4.1708 (Core) CentOS Linux release 7.4.1708 (Core) Fire Linux OS 6.2.0-42 Fire Linux OS 6.2.0-42 Microsoft Windows Server 2008 R2 Enterprise Version 6.1.7601 Build 7601 Microsoft Windows Server 2008 R2 Enterprise Version 6.1.7601 Build 7601 Microsoft Windows Server 2012 R2 Datacenter Version 6.3.9600 Build 9600 Microsoft Windows Server 2012 R2 Datacenter Version 6.3.9600 Build 9600 Microsoft Windows Server 2012 R2 Standard Version 6.3.9600 Build 9600 Microsoft Windows Server 2012 R2 Standard Version 6.3.9600 Build 9600 Microsoft Windows Server 2016 Microsoft Windows Server 2016 Red Hat Enterprise Linux Server release 6.3 (Santiago) Red Hat Enterprise Linux Server release 6.3 (Santiago) Red Hat Enterprise Linux Server release 6.9 (Santiago) Red Hat Enterprise Linux Server release 6.9 (Santiago) SUSE Linux Enterprise Server 11 (x86_64) VERSION = 11 PATCHLEVEL = 4 SUSE Linux Enterprise Server 11 (x86_64) VERSION = 11 PATCHLEVEL = 4 SUSE Linux Enterprise Server 12 (x86_64) VERSION = 12 PATCHLEVEL = 3 SUSE Linux Enterprise Server 12 (x86_64) VERSION = 12 PATCHLEVEL = 3 Ubuntu 14.04.3 LTS Ubuntu 14.04.3 LTS Ubuntu 16.04 LTS Ubuntu 16.04 LTS Ubuntu 16.04.3 LTS Ubuntu 16.04.3 LTS VMware ESXi vmnix-x86 5.5.0 VMware ESXi vmnix-x86 5.5.0 Can someone please help with this?

sh254087 · ‎04-11-2023

I have two data sources - 1. Discovered data. Can be either a lookup file or a db table. Let's assume db table. I'm pulling data from table using splunk app for DB connect. 2. A lookup file. Scenario: I will have two columns OS_name and OS_Version coming from the discovery_data db table. I will also have a os_latest_release.csv lookup file which will have three columns - OperatingSystem, Existing_OSType, Latest_Available_Version. OperatingSystem ExistingOSType Latest_Available_Version AIX any 7.3 HP-UX any 11i v3 Linux any RHEL 9.1 Linux SuSE Enterprise Server 11 (3.0.101-108.2 SUSE Linux Enterprise Server 15 Linux ubuntu_12_04 Ubuntu 22.10 Linux Oracle Linux Server 7.9 Oracle Linux 9.1 Linux Debian any Debian version 11 Linux Lincase any LINUX Lincase SL 7.9 Other other TBC Solaris any Solaris 11.4 SunOS/Solaris any Solaris 11.4 VMware any vSphere ESXi 8.0 Windows Windows 10 Windows 11 version 22H2 Win2012R2 6.3.9600 any Windows Server 2022 Windows any Windows Server 2022 For every OS_name and OS_version there will be a matching combination/entry in the lookup file. The ExistingOSType column in lookup file will either have the version details similar (not necessarily same, strings may not match as-is) to discovered data or will have 'any' as field value (i.e., no matter which discovered version or os type be, the latest version will be same for the given OS_name). Now I have to come up with latest Latest_Available_Version column for each row of data coming from db table. Conditions to be considered - 1. if db.OS_name=L.OperatingSystem and db.OS_version=L.Existing_OSType then Latest_Available_Version . if there's no match, then 2. set db.Latest_Available_Version =l.Latest_Available_Version where db.OS_name=L.OperatingSystem and L.Existing_OSType=any Any help, please?

sh254087 · ‎03-15-2023

I'm sorry I missed your message. If you're still looking out for a workaround, please refer gurlest's response

sh254087 · ‎03-15-2023

This is right. We also have applied the same as a temporary fix. As a result - 1. The XML issue will be resolved. 2. There will be an error/warning message showing up at the startup, related to PYTHONHTTPSVERIFY having set to 0 (where the expected value is 1). We can, perhaps, only ignore this for now!

sh254087 · ‎03-03-2023

I was, but, just trying different possibilities while I took the screenshot. I had tried keeping it as is, but the comparison that I tried hadn't worked. Was getting like this - Even if I change this limit like - 'time<1625' instead of 'time<1630', the downtime doesn't change. It just don't display those rows, but are somehow being considered for the downtime calculation.

sh254087 · ‎03-03-2023

Tried something like this using this but no luck. Even after I exclude the events (downtime beginning and downtime end timestamps) the downtime calculation didn't change. | eval time=strftime(_time,"%H:%M") | search time != 16:30 AND time != 01:35 AND time != 01:40 | eval up=if(SampleCount >= 5, 1, null()) | streamstats window=2 global=f range(_time) as diff by up | eval downtime=if(diff-300>0,diff-300,null()) | eval uptime=if(up=1, 300,0) | table timestamp time up diff downtime uptime After excluding Before excluding

sh254087 · ‎03-02-2023

Working with date and time is very new to me and I'm not able to figure this up.

sh254087 · ‎03-02-2023

This is in continuation to my query(resolved) here - Solved: How to check time difference between a series of e... - Splunk Community Here I was able to get the overall downtime for any selected time range by using SUM() and AVG() after teh suggested solution. In continuation to the sample scenario explained in the aforementioned query, I have to now handle a scheduled downtime. We have a process which turns our servers down at 4:30 pm and brings them up at 1:30am UTC time , automatically on a schedule, every day. The 9 hrs 10mins downtime which is shown in the sample is of the same. In this case I was able to come up with unplanned downtime by subtracting 9:10 from total downtime as it was a specific selected time range : 2023-02-21T16:00:00Z to 2023-02-22T02:25:00Z and as there was only one record of 9hrs 10min downtime. However, we have noticed few other scenarios which are a bit complex, like - 1. When the time range selected is 24 hrs or yesterday (3/1/23 12:00:00.000 AM to 3/2/23 12:00:00.000 AM), assuming the system was up all the time outside the scheduled downtime, the total downtime will be shown as empty/null as the first event for the day will be at 1:35 and last one at 16:30 and no other downtime in between. (this is still okay, as I just have to handle the null downtime with a zero) 2. When the time range selected is anything more than a day, say 7days or 30 days or even a random custom date time range, I'm not sure how to calculate the actual downtime. Can this be handled somehow?

sh254087 · ‎03-02-2023

@ITWhisperer This just did it for me. Thanks a lot.

sh254087 · ‎02-28-2023

Hello! I am trying to find system uptime and here's the scenario: The monitoring/status check log returns fields like - InstanceID, timestamp, Count. There's a status check event every 5mins. System is up when 'Count >=5' and down otherwise. Looking to know how I can come up with the Downtime value either in actual time as mentioned in sample data in the table or in seconds. Can someone please help with this? InstanceID timestamp SampleCount Difference Downtime insA 2023-02-21T16:00:00Z 5 0 insA 2023-02-21T16:05:00Z 4 0 insA 2023-02-21T16:10:00Z 2 00:05 insA 2023-02-21T16:15:00Z 5 00:10 00:10 insA 2023-02-21T16:20:00Z 5 0 insA 2023-02-21T16:25:00Z 5 0 insA 2023-02-21T16:30:00Z 4 0 insA 2023-02-22T01:35:00Z 2 09:05 insA 2023-02-22T01:40:00Z 5 09:10 09:10 insA 2023-02-22T01:45:00Z 5 0 insA 2023-02-22T01:50:00Z 5 0 insA 2023-02-22T01:55:00Z 5 0 insA 2023-02-22T02:00:00Z 5 0 insA 2023-02-22T02:05:00Z 5 0 insA 2023-02-22T02:10:00Z 4 0 insA 2023-02-22T02:15:00Z 3 00:05 insA 2023-02-22T02:20:00Z 5 00:10 00:10 insA 2023-02-22T02:25:00Z 5 0

sh254087 · ‎11-07-2022

Is there a way that I can accept two solutions?

sh254087 · ‎11-07-2022

@bowesmana Thank you too, for the refining tip. tried this and this as well worked perfectly. thank you very much, again. Appreciate it.

sh254087 · ‎11-07-2022

@kamlesh_vaghela KV, Thank you very much for putting an effort into sharing this. It is in detail and very helpful. It just works the way I wanted it to. Thank you very much, again. Appreciate it.

sh254087 · ‎11-04-2022

I have a table with 1 column and 6 rows which I'll be changing to 1 row and 6 columns using transpose and eventually hide the header using CSS, such that I only have a row of 6 different values, say - A, B, C, D, E, F. I want to display details related to each of those 6 values based on what value is clicked. The query for each of those 6 values are different and hence I have placed them in separate tables, something like - TableA, TableB,...,TableF. I have come across <condition/> option but I'm not able to make out how I can use that in this scenario. Any leads in achieving this will be of great help.

sh254087 · ‎09-15-2022

Getting the error "This XML file does not appear to have any style information associated with it." while trying to export search result. Getting this error within dashboards as well from search(.../search/search) page. This is stopping our ability to export/download search results in all available formats(csv/xml/json). Any possible solutions? Splunk Enterprise version 9.0.0.1

Posts	78
Solutions	4
Karma Given	107
Karma Received	7
Member Since	‎10-24-2017

Online Status	Offline
Date Last Visited	‎07-03-2024 08:42 AM

Split one field values to set one each value to su...

Getting "Unexpected error downloading update: Conn...

Unable to find percentage of two values stored in ...

How to plot choropleth data on maps? I have data f...

How to separate OS name and OS version values from...

How to compare fields between db and lookup file a...

How to calculate downtime or time difference with...

How to check time difference between a series of e...

How to display a table based on a clicked value of...

How to resolve error "This XML file does not appea...

Re: Split one field values to set one each value t...

Split one field values to set one each value to su...

Getting "Unexpected error downloading update: Conn...

Re: restrict user from seeing panel query in dash...

Re: Unable to find percentage of two values stored...

Unable to find percentage of two values stored in ...

Re: splunk list deploy-clients error ospath_fopen

Re: How to plot choropleth data on maps? I have da...

Re: How to plot choropleth data on maps? I have da...

How to plot choropleth data on maps? I have data f...

How to separate OS name and OS version values from...

How to compare fields between db and lookup file a...

Re: How to resolve error "This XML file does not a...

Re: How to resolve error "This XML file does not a...

Re: How to calculate downtime or time difference ...

Re: How to calculate downtime or time difference ...

Re: How to calculate downtime or time difference ...

How to calculate downtime or time difference with...

Re: How to check time difference between a series ...

How to check time difference between a series of e...

Re: How to display a table based on a clicked valu...

Re: How to display a table based on a clicked valu...

Re: How to display a table based on a clicked valu...

How to display a table based on a clicked value of...

How to resolve error "This XML file does not appea...