Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About sh254087
sh254087
Communicator
Member since:
10-24-2017
06-02-2025
Community Statistics
| Posts | 78 |
| Solutions | 4 |
| Karma Given | 108 |
| Karma Received | 7 |
| Member Since | 10-24-2017 |
Activity Feed
- Karma Re: How to add a new column to a row? for kdimaria. 06-02-2025 07:43 AM
- Karma Re: Automating the installation of the Splunk Add-on for Amazon Web Services, how do we encrypt the password in password for rasikmhetre. 07-03-2024 02:37 AM
- Karma Re: Automating the installation of the Splunk Add-on for Amazon Web Services, how do we encrypt the password in passwords.conf? for Jeremiah. 07-03-2024 02:36 AM
- Posted Re: Split one field values to set one each value to subsequent rows on All Apps and Add-ons. 04-03-2024 03:19 AM
- Posted Split one field values to set one each value to subsequent rows on All Apps and Add-ons. 03-28-2024 08:28 AM
- Karma Re: Where are alerts stored in Linux directory structure? for BrendanCO. 02-07-2024 01:55 AM
- Karma Re: Where are alerts stored in Linux directory structure? for somesoni2. 02-07-2024 01:52 AM
- Karma Re: How to find find my reports and alert coming from which directory for gcusello. 02-07-2024 01:52 AM
- Got Karma for Re: Token substitues value with double quotes | unable to use panel token values in DB connect query to compare string values as they need single quotes. 12-14-2023 07:48 AM
- Posted Getting "Unexpected error downloading update: Connection reset by peer" while trying to install add-on from splunkbase on All Apps and Add-ons. 12-14-2023 02:45 AM
- Tagged Getting "Unexpected error downloading update: Connection reset by peer" while trying to install add-on from splunkbase on All Apps and Add-ons. 12-14-2023 02:45 AM
- Tagged Getting "Unexpected error downloading update: Connection reset by peer" while trying to install add-on from splunkbase on All Apps and Add-ons. 12-14-2023 02:45 AM
- Karma How to remove the search and export options in the new Dashboard Studio? for thomas_art. 08-09-2023 03:04 AM
- Karma Re: In the new Dashboard Studio, How can i remove the search and export options. for elizabethl_splu. 08-09-2023 03:04 AM
- Posted Re: restrict user from seeing panel query in dashboard on Dashboards & Visualizations. 08-09-2023 02:49 AM
- Posted Re: Unable to find percentage of two values stored in two separate fieldnames on Splunk Search. 07-28-2023 03:31 AM
- Karma Re: Unable to find percentage of two values stored in two separate fieldnames for ITWhisperer. 07-28-2023 03:29 AM
- Karma How can I produce a timechart with 1 month span the average of count per day? for morethanyell. 07-28-2023 03:26 AM
- Posted Unable to find percentage of two values stored in two separate fieldnames on Splunk Search. 07-28-2023 03:11 AM
- Karma Re: Unable to create License Pool for alacercogitatus. 07-03-2023 06:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-03-2024
03:19 AM
@RichfezThanks for the response, Rich. Since mvexpand/mkemv are basics when it comes to splitting a field value, I had given it a try and tried again now as well. Like you've mentioned, trying this on the example data gives me 13 rows output. But once I'm there, I do not know how to pick one pair of values for a row from the expanded list of values, spread across multiple rows. Time parameter value x a x1 x c x1 x b x1 x a x2 x c x2 x b x2 x a x3 x c x3 x b x3 y d y1 y e y1 y d y2 y e y2 After this, I'm unsure how to achieve the expected output: Time parameter value x a x1 x c x2 x b x3 y d y1 y e y2
... View more
03-28-2024
08:28 AM
I have OS log data coming from Windows/linux into splunk. I have a particular field with values unseparated. Sample log data representation. _time parameter value x a c b x1 x a c b x2 x a c b x3 y d e y1 y d e y2 I would want to splint the parameter field's values in such a way that each parameter field will have one of the group values, in same order. Sample output : _time parameter value x a x1 x c x2 x b x3 y d y1 y e y2 Can someone please help?
... View more
Labels
- Labels:
-
dashboard
-
development
-
search
12-14-2023
02:45 AM
Getting "Unexpected error downloading update: Connection reset by peer" while trying to install add-on from splunkbase (via 'Find more apps) Internet is connected, I'm able to access splunk application as well. Only the installation is failing. Earlier to this, I was getting SSL error when I try to open this page. Then I set sslVerifyServerCert to false, after which the page started loading. I'm not sure if some SSL related blocking still exists. Any suggestions around getting through this?
... View more
Labels
- Labels:
-
configuration
-
installation
-
upgrade
08-09-2023
02:49 AM
I know it's an old question, but still trying to answer just in case if it helps someone who'd come here. In this scenario there are two options - A drilldown table (I know you mentioned link to search, but still mentioning this as this is the most suited approach than a link to search) Select manage tokens from drilldown options, instead of open in search. Set a token value for on-click. ex. showDetails="true" (also, here you can either show a common data/table or show separate data based on the clicked value, set the token value accordingly) In the next row, add a table with your query and specify depends="$showDetails$" in the row element. In step b, if you've decided for a specific value based tables or queries, you will have to modify the query in step c to use that token value in your query so that the data shows up in relation to the value clicked / passed. Likewise, you can add one more token and one more table with different token value. To hide the table that shows up after the on-click action on the main table, edit drill down on the sub-table and select manage token. Here unset the used tokens. Now whenever the user clicks on this sub-table, it'll disappear. With this, you need not navigate the user to a different page, also, need not worry about showing up the query behind your subsearch. 2. A saved report or a separate dashboard a. run a search with your query for the drill down which you want to show on-click. b. save it as a report or a separate dashboard c. from the edit drill down option on the main dashboard table, map this report/dashboard. this was it'll not show up the search query. In any case, make sure to specify the link.visible=false in your all dashboards/panels, like mentioned in the solution of the main question in this page. Without this, the user will still be able to open the query in a new search window.
... View more
07-28-2023
03:31 AM
This just worked perfectly. Thank you very much, @ITWhisperer . I had never used eventstats practically. Will check more on it.
... View more
07-28-2023
03:11 AM
I'm facing a weird issue. I'm not able to calculate percentage value when I use two variables/fields. I have a lookup file which looks something like - sl,Service,x_value 1,X,0.211 2,other,0.190 3,Y,0 4,X,0.200 5,other,0.220 I'm trying to get two columns in my resultant table to show total by service and percentage by service, respectively. I've tried this - percentage needs to be calculated using 2 fields whereas perc1 and perc2 are substituted with one of those two field values. While the perc1 and perc2 gets processed and displayed, percentage doesn't show up. I'm not sure what is that I'm doing wrong here. Can somebody please help?
... View more
06-06-2023
06:57 AM
I was getting similar error while trying to start the splunk service - "Operation "ospath_fopen" failed in /opt/splunk/src/libzero/conf-mutator-locking.c:338, conf_mutator_lock(); Permission denied" and the service start was failing. Following your suggestion, tried - "<splunk_home>/bin/splunk clean locks" and tried starting the service. It worked without issues; service was started, and the Web UI came up as well. Many thanks to you. Splunk Enterprise Version: 9.0.4.1
... View more
05-29-2023
04:49 AM
To keep it simpler, just trying with AWS cloud, to begin with. Here's how my region_coordinates.csv which has the region, latitude and longitude and other fields looks like - I have services and their respective cost consumption data which looks like this (on a trellis-pie visualization, just used this to convey better)- I am trying to get thispie visualization on a map something like this - (referring to 'sample dashboard example' app) - Tried geom and geostats command but did not get expected output.
... View more
05-28-2023
10:28 PM
I have the cloud consumption information indexed in real-time. I do not (or can not) have the consumption information in a csv. I want this map to showcase the cloud consumption data across different regions in real-time. I can come up with a csv having long and lat values for each cloud-regions. I'm unsure how to link these two to come up with the map visualization.
... View more
05-26-2023
09:34 AM
I am trying to understand how I can plot my multi-cloud subscription/service consumption data from different geo regions, on a clustered choropleth map visualization. I have multi-cloud subscriptions with services provisioned and consumed from different regions. I want to know where to start with - from reading articles and documentation, I understand I should have longitude, latitude information in my data for each of the regions that I want to plot data for(at least, if not for all). None of my CSP data in respective indexes have this information. If I have to come up with a CSV, unsure how I'll link them to get this to working. Anyone came across similar use-case? Any help would be appreciated.
... View more
04-11-2023
08:58 AM
I have a column that holds OS Name along with it's version details.
os_full_name
CentOS Linux release 7.1.1503 (Core)
CentOS Linux release 7.2.1511 (Core)
CentOS Linux release 7.4.1708 (Core)
Fire Linux OS 6.2.0-42
Microsoft Windows Server 2008 R2 Enterprise Version 6.1.7601 Build 7601
Microsoft Windows Server 2012 R2 Datacenter Version 6.3.9600 Build 9600
Microsoft Windows Server 2012 R2 Standard Version 6.3.9600 Build 9600
Microsoft Windows Server 2016
Red Hat Enterprise Linux Server release 6.3 (Santiago)
Red Hat Enterprise Linux Server release 6.9 (Santiago)
SUSE Linux Enterprise Server 11 (x86_64) VERSION = 11 PATCHLEVEL = 4
SUSE Linux Enterprise Server 12 (x86_64) VERSION = 12 PATCHLEVEL = 3
Ubuntu 14.04.3 LTS
Ubuntu 16.04 LTS
Ubuntu 16.04.3 LTS
VMware ESXi vmnix-x86 5.5.0
I want to split this column so that I get OS name and Version details in separate fields to get something like -
os_full_name
os_name
os_version
CentOS Linux release 7.1.1503 (Core)
CentOS Linux
release 7.1.1503 (Core)
CentOS Linux release 7.2.1511 (Core)
CentOS Linux
release 7.2.1511 (Core)
CentOS Linux release 7.4.1708 (Core)
CentOS Linux
release 7.4.1708 (Core)
Fire Linux OS 6.2.0-42
Fire Linux OS
6.2.0-42
Microsoft Windows Server 2008 R2 Enterprise Version 6.1.7601 Build 7601
Microsoft Windows Server 2008 R2 Enterprise
Version 6.1.7601 Build 7601
Microsoft Windows Server 2012 R2 Datacenter Version 6.3.9600 Build 9600
Microsoft Windows Server 2012 R2 Datacenter
Version 6.3.9600 Build 9600
Microsoft Windows Server 2012 R2 Standard Version 6.3.9600 Build 9600
Microsoft Windows Server 2012 R2 Standard
Version 6.3.9600 Build 9600
Microsoft Windows Server 2016
Microsoft Windows Server 2016
Red Hat Enterprise Linux Server release 6.3 (Santiago)
Red Hat Enterprise Linux Server
release 6.3 (Santiago)
Red Hat Enterprise Linux Server release 6.9 (Santiago)
Red Hat Enterprise Linux Server
release 6.9 (Santiago)
SUSE Linux Enterprise Server 11 (x86_64) VERSION = 11 PATCHLEVEL = 4
SUSE Linux Enterprise Server 11 (x86_64)
VERSION = 11 PATCHLEVEL = 4
SUSE Linux Enterprise Server 12 (x86_64) VERSION = 12 PATCHLEVEL = 3
SUSE Linux Enterprise Server 12 (x86_64)
VERSION = 12 PATCHLEVEL = 3
Ubuntu 14.04.3 LTS
Ubuntu
14.04.3 LTS
Ubuntu 16.04 LTS
Ubuntu
16.04 LTS
Ubuntu 16.04.3 LTS
Ubuntu
16.04.3 LTS
VMware ESXi vmnix-x86 5.5.0
VMware ESXi
vmnix-x86 5.5.0
Can someone please help with this?
... View more
04-11-2023
02:29 AM
I have two data sources - 1. Discovered data. Can be either a lookup file or a db table. Let's assume db table. I'm pulling data from table using splunk app for DB connect. 2. A lookup file.
Scenario: I will have two columns OS_name and OS_Version coming from the discovery_data db table. I will also have a os_latest_release.csv lookup file which will have three columns - OperatingSystem, Existing_OSType, Latest_Available_Version.
OperatingSystem
ExistingOSType
Latest_Available_Version
AIX
any
7.3
HP-UX
any
11i v3
Linux
any
RHEL 9.1
Linux
SuSE Enterprise Server 11 (3.0.101-108.2
SUSE Linux Enterprise Server 15
Linux
ubuntu_12_04
Ubuntu 22.10
Linux
Oracle Linux Server 7.9
Oracle Linux 9.1
Linux Debian
any
Debian version 11
Linux Lincase
any
LINUX Lincase SL 7.9
Other
other
TBC
Solaris
any
Solaris 11.4
SunOS/Solaris
any
Solaris 11.4
VMware
any
vSphere ESXi 8.0
Windows
Windows 10
Windows 11 version 22H2
Win2012R2 6.3.9600
any
Windows Server 2022
Windows
any
Windows Server 2022
For every OS_name and OS_version there will be a matching combination/entry in the lookup file.
The ExistingOSType column in lookup file will either have the version details similar (not necessarily same, strings may not match as-is) to discovered data or will have 'any' as field value (i.e., no matter which discovered version or os type be, the latest version will be same for the given OS_name).
Now I have to come up with latest Latest_Available_Version column for each row of data coming from db table. Conditions to be considered - 1. if db.OS_name=L.OperatingSystem and db.OS_version=L.Existing_OSType then Latest_Available_Version . if there's no match, then 2. set db.Latest_Available_Version =l.Latest_Available_Version where db.OS_name=L.OperatingSystem and L.Existing_OSType=any
Any help, please?
... View more
Labels
- Labels:
-
table
03-15-2023
09:27 AM
I'm sorry I missed your message. If you're still looking out for a workaround, please refer gurlest's response
... View more
03-15-2023
09:20 AM
This is right. We also have applied the same as a temporary fix. As a result - 1. The XML issue will be resolved. 2. There will be an error/warning message showing up at the startup, related to PYTHONHTTPSVERIFY having set to 0 (where the expected value is 1). We can, perhaps, only ignore this for now!
... View more
- Tags:
- Temporary fix
03-03-2023
05:49 AM
I was, but, just trying different possibilities while I took the screenshot. I had tried keeping it as is, but the comparison that I tried hadn't worked. Was getting like this - Even if I change this limit like - 'time<1625' instead of 'time<1630', the downtime doesn't change. It just don't display those rows, but are somehow being considered for the downtime calculation.
... View more
03-03-2023
04:32 AM
Tried something like this using this but no luck. Even after I exclude the events (downtime beginning and downtime end timestamps) the downtime calculation didn't change. | eval time=strftime(_time,"%H:%M") | search time != 16:30 AND time != 01:35 AND time != 01:40 | eval up=if(SampleCount >= 5, 1, null()) | streamstats window=2 global=f range(_time) as diff by up | eval downtime=if(diff-300>0,diff-300,null()) | eval uptime=if(up=1, 300,0) | table timestamp time up diff downtime uptime After excluding Before excluding
... View more
03-02-2023
11:59 PM
Working with date and time is very new to me and I'm not able to figure this up.
... View more
03-02-2023
04:14 AM
This is in continuation to my query(resolved) here - Solved: How to check time difference between a series of e... - Splunk Community Here I was able to get the overall downtime for any selected time range by using SUM() and AVG() after teh suggested solution. In continuation to the sample scenario explained in the aforementioned query, I have to now handle a scheduled downtime. We have a process which turns our servers down at 4:30 pm and brings them up at 1:30am UTC time , automatically on a schedule, every day. The 9 hrs 10mins downtime which is shown in the sample is of the same. In this case I was able to come up with unplanned downtime by subtracting 9:10 from total downtime as it was a specific selected time range : 2023-02-21T16:00:00Z to 2023-02-22T02:25:00Z and as there was only one record of 9hrs 10min downtime. However, we have noticed few other scenarios which are a bit complex, like - 1. When the time range selected is 24 hrs or yesterday (3/1/23 12:00:00.000 AM to 3/2/23 12:00:00.000 AM), assuming the system was up all the time outside the scheduled downtime, the total downtime will be shown as empty/null as the first event for the day will be at 1:35 and last one at 16:30 and no other downtime in between. (this is still okay, as I just have to handle the null downtime with a zero) 2. When the time range selected is anything more than a day, say 7days or 30 days or even a random custom date time range, I'm not sure how to calculate the actual downtime. Can this be handled somehow?
... View more
Labels
- Labels:
-
development
-
troubleshooting
03-02-2023
03:30 AM
@ITWhisperer This just did it for me. Thanks a lot.
... View more
02-28-2023
08:08 AM
Hello! I am trying to find system uptime and here's the scenario: The monitoring/status check log returns fields like - InstanceID, timestamp, Count. There's a status check event every 5mins. System is up when 'Count >=5' and down otherwise. Looking to know how I can come up with the Downtime value either in actual time as mentioned in sample data in the table or in seconds. Can someone please help with this? InstanceID timestamp SampleCount Difference Downtime insA 2023-02-21T16:00:00Z 5 0 insA 2023-02-21T16:05:00Z 4 0 insA 2023-02-21T16:10:00Z 2 00:05 insA 2023-02-21T16:15:00Z 5 00:10 00:10 insA 2023-02-21T16:20:00Z 5 0 insA 2023-02-21T16:25:00Z 5 0 insA 2023-02-21T16:30:00Z 4 0 insA 2023-02-22T01:35:00Z 2 09:05 insA 2023-02-22T01:40:00Z 5 09:10 09:10 insA 2023-02-22T01:45:00Z 5 0 insA 2023-02-22T01:50:00Z 5 0 insA 2023-02-22T01:55:00Z 5 0 insA 2023-02-22T02:00:00Z 5 0 insA 2023-02-22T02:05:00Z 5 0 insA 2023-02-22T02:10:00Z 4 0 insA 2023-02-22T02:15:00Z 3 00:05 insA 2023-02-22T02:20:00Z 5 00:10 00:10 insA 2023-02-22T02:25:00Z 5 0
... View more
11-07-2022
03:24 AM
Is there a way that I can accept two solutions?
... View more
11-07-2022
03:23 AM
@bowesmana Thank you too, for the refining tip. tried this and this as well worked perfectly. thank you very much, again. Appreciate it.
... View more
11-07-2022
03:21 AM
@kamlesh_vaghela KV, Thank you very much for putting an effort into sharing this. It is in detail and very helpful. It just works the way I wanted it to. Thank you very much, again. Appreciate it.
... View more
11-04-2022
08:31 AM
I have a table with 1 column and 6 rows which I'll be changing to 1 row and 6 columns using transpose and eventually hide the header using CSS, such that I only have a row of 6 different values, say - A, B, C, D, E, F.
I want to display details related to each of those 6 values based on what value is clicked. The query for each of those 6 values are different and hence I have placed them in separate tables, something like - TableA, TableB,...,TableF. I have come across <condition/> option but I'm not able to make out how I can use that in this scenario.
Any leads in achieving this will be of great help.
... View more
09-15-2022
09:53 AM
Getting the error "This XML file does not appear to have any style information associated with it." while trying to export search result.
Getting this error within dashboards as well from search(.../search/search) page.
This is stopping our ability to export/download search results in all available formats(csv/xml/json).
Any possible solutions?
Splunk Enterprise version 9.0.0.1
... View more
- Tags:
- export
- search results
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-02-2025
07:43 AM
|
Karma from
