Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jiaqya
jiaqya
Builder
Member since:
11-20-2017
12-20-2020
Community Statistics
| Posts | 316 |
| Solutions | 7 |
| Karma Given | 4 |
| Karma Received | 19 |
| Member Since | 11-20-2017 |
Activity Feed
- Got Karma for Re: Search factor vs Replication factor. 08-03-2022 06:58 AM
- Got Karma for Why is there a 10000 rows limit?. 07-15-2022 05:30 AM
- Posted Re: Drilldown to a specific panel on another dashboard. on Dashboards & Visualizations. 12-20-2020 08:21 PM
- Got Karma for Re: Search factor vs Replication factor. 11-08-2020 10:50 AM
- Got Karma for Search factor vs Replication factor-If I change my SF=2 , does this mean 2 copies are changed to primary?. 11-08-2020 10:50 AM
- Posted Re: Splunk server migration to another server on Installation. 10-12-2020 12:02 AM
- Posted Re: Splunk server migration to another server on Installation. 10-11-2020 11:44 PM
- Karma Re: Splunk server migration to another server for inventsekar. 10-11-2020 11:44 PM
- Posted Splunk server migration to another server on Installation. 10-09-2020 03:41 AM
- Got Karma for Re: Can you help me with my conditional search query involving a token?. 10-02-2020 08:54 AM
- Got Karma for Re: Eval field based on similar events or single event. 09-28-2020 10:02 AM
- Posted Re: Eval field based on similar events or single event on Splunk Search. 09-26-2020 12:09 AM
- Posted Re: Eval field based on similar events or single event on Splunk Search. 09-26-2020 12:08 AM
- Posted Re: Eval field based on similar events or single event on Splunk Search. 09-25-2020 10:25 AM
- Posted Re: Eval field based on similar events or single event on Splunk Search. 09-25-2020 09:49 AM
- Posted Eval field based on similar events or single event on Splunk Search. 09-25-2020 09:26 AM
- Posted Trellis and PDF delivery on Dashboards & Visualizations. 09-17-2020 09:22 AM
- Posted Need help with search based on values that are duplicated but have different status levels. on Splunk Search. 09-02-2020 11:31 AM
- Posted Re: increment count in a field based on field values.. on Splunk Search. 09-02-2020 11:22 AM
- Posted increment count in a field based on field values.. on Splunk Search. 08-27-2020 12:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-20-2020
08:21 PM
No Sir, we decided to use a dashboard instead of panel... thats it...
... View more
- Tags:
- o Sir
10-11-2020
11:44 PM
Hi, thanks for the steps. is it really necessary to run the splunk intsall on the new server , even when i detach and attach the disk... the disk with /opt/splunk has the full setup . i understand to change the server.conf and inputs.conf, which ill take care.. but wanted to know if the splunk install was necessary in this case... thanks
... View more
10-09-2020
03:41 AM
need guidance on situation below server1 with splunk install to be migrated to server2. plan is to detach the disk from server1 and attach it to server2. the server names will be different. do i need to run a install of same version on top of it on server2 , as the server.conf and other files will have the old servername i.e server1 in its conf files..
... View more
Labels
- Labels:
-
other
09-26-2020
12:09 AM
1 Karma
data is already unique when the below query is run, so it works perfectly fine for my case... | eval uniquefield = servername.data1.data2.data3 | eventstats count by uniquefield | eval occurence = if(count=1, "single","multiple") | fields - count, - uniquefield
... View more
09-26-2020
12:08 AM
Thanks, this works perfectly fine for my case.. im already coming up with unique values for those fields before i use your solution , so they will be similar in any case. thank you....
... View more
09-25-2020
10:25 AM
i tried ur suggestion, didnt work , below is the code i tried.. | makeresults | eval servername="one",data1="10",data2="20",data3="30",_time="09-02-2020" | append [| makeresults | eval servername="one",data1="10",data2="20",data3="30",_time="09-01-2020"] | append [| makeresults | eval servername="one",data1="10",data2="20",data3="30",_time="08-31-2020"] | append [| makeresults | eval servername="two",data1="1",data2="2",data3="3",_time="09-02-2020"] | append [| makeresults | eval servername="three",data1="1",data2="20",data3="30",_time="09-02-2020"] | table servername,data1,data2,data3,_time | cluster showcount=true | eval occurrence=if(cluster_count=1,"single","multiple")
... View more
09-25-2020
09:49 AM
except the _time field, rest all fields have same values . that is the criteria... or we can just ignore the _time field to determine similar rows . if there are more than 1 rows that are similar then i would like to mark or eval them as multiple rows of same data. else , if there are no multiple occurences of same data rows, then show them as single row... the last 2 are different , as one is server 2 and other is server 3 .... hope i was clear in my explanation... expected output: servername:data1:data2:data3:_time:occurence server1:10:20:30:25th Sep 2020:multiple server1:10:20:30:26th Sep 2020:multiple server1:10:20:30:27th Sep 2020:multiple server2:20:30:10:28thSep 2020:single server3:20:30:10:28thSep 2020:single
... View more
09-25-2020
09:26 AM
i have a case where i need to determine if a row has been repeated multiple times or not . it may have 4 common value columns, but time might differ. example below.. table: servername:data1:data2:data3:_time server1:10:20:30:25th Sep 2020 server1:10:20:30:26th Sep 2020 server1:10:20:30:27th Sep 2020 server2:20:30:10:28thSep 2020 I need output like below with a new eval field called occurrence which should have values "mulitple", or "single" based on occurrence at different times. can anyone help me with this, thanks.. servername:data1:data2:data3:_time:occurence server1:10:20:30:25th Sep 2020:multiple server1:10:20:30:26th Sep 2020:multiple server1:10:20:30:27th Sep 2020:multiple server2:20:30:10:28thSep 2020:single server3:20:30:10:28thSep 2020:single
... View more
Labels
- Labels:
-
field extraction
09-17-2020
09:22 AM
We have charts/line graphs on our reports and want to send them to email as pdf. but splunk does not seem to support pdf-delivery on form dashboards. Can you help on alternative for this OR if this is going to be supported in newer versions. We are running 726 version. I also happened to see "report sender" app on splunkbase, but it was third party. Is there anything out of the box from splunk OR supported app by splunk, so that we can send the trellis charts as PDF emails..
... View more
Labels
- Labels:
-
trellis layout
09-02-2020
11:31 AM
In my data, there are duplicate rows for a server, but their status is "active" or "deleted".
Based on the field value I would like "Active" records to be returned at all times when both "active" and "deleted" are present.
If "active " is not present, then I want the "deleted" record to be shown.
Sample data result below. Please let me know how this can be done.
| makeresults
| eval server="one",column1="1",column2="2",column3="3",_time="09-02-2020",status="active"
| append [| makeresults | eval server="one",column1="1",column2="2",column3="3",_time="09-01-2020",status="deleted"]
| append [| makeresults | eval server="one",column1="1", column2="2",column3="3",_time="08-31-2020",status="deleted"]
| append [| makeresults | eval server="two",column1="3",column2= "2",column3="1",_time="09-02-2020",status="active"]
| append [| makeresults | eval server="three",column1="4", column2="5",column3="6",_time="09-01-2020",status="deleted"]
| table server,status,column1,column2,column3,_time
Output of the above makeresult is below:
server
status
column1
column2
column3
_time
one
active
1
2
3
9/2/2020
one
deleted
1
2
3
9/1/2020
one
deleted
1
2
3
8/31/2020
two
active
3
2
1
9/2/2020
three
deleted
4
5
6
9/1/2020
In this output, I would like to see the "active" record for server "one", active record for server "two", and "deleted" record for server "three".
... View more
- Tags:
- search
Labels
- Labels:
-
fields
09-02-2020
11:22 AM
Works perfectly fine, thank you...
... View more
08-27-2020
12:30 PM
Need help with a situation. Example table below: column1,column2,column3,_time 1,2,3,21st 1,2,3,22nd 1,2,3,23rd 3,2,1,23rd 4,5,6,23rd if on multiple days/times, column1 ,2 and 3 are same(4th column is _time ) , then add a new field(count) with incrementing numbers by _time , like below. how can this be done ? need help with query.. column1,column2,column3,_time,count 1,2,3,21st,1 1,2,3,22nd,2 1,2,3,23rd,3 3,2,1,23rd,1 4,5,6,23rd,1
... View more
Labels
- Labels:
-
field extraction
08-06-2020
06:23 AM
i also believe the peer would add itself , once it comes up... as there is no other changes being done on the downed peer...
... View more
08-06-2020
06:20 AM
Yes, we have a change windows that is at least 20 hours for each peer. We have SF=1 and RF=2, so when we use "stop", data is all available for search, while replication happens in background, so users are not seeing any data issues on report. but issue was, they are seeing yellow triangle indicating peer down in cluster.. so i had to remove the peer from cluster, only to add after 20 hours.. so wanted to know if that could cause any data issues. what i i know is, that cluster will perform remediation tasks if needed, and there will be excess buckets to clear.
... View more
08-06-2020
06:03 AM
Hi Ralph, i was looking at this document : https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Takeapeeroffline which has below details, which is why i was staying away from "offline" , as we are having SF=1. Note: If the cluster has a search factor of 1, the cluster does not attempt to reallocate primary copies before allowing the peer to go down. With a search factor of 1, the cluster cannot fix the primaries without first creating new searchable copies, which takes significant time and thus would defeat the goal of a fast shutdown.
... View more
- Tags:
- alph
08-06-2020
05:13 AM
Thanks for the expalanation. We have SF=1 and probably it will stay that way. So i think "Stop" is the correct way here. So, we just bring the peer online once activity is done , and it should re-connect back with cluster, with some bucket fixing activity on cluster side.. Since there is no data issues with this, this should be good for my question. thanks
... View more
08-06-2020
03:49 AM
would you still recommend offline command, in case we have SF=1 problem i have now is that dashboard shows yellow messages of peer down, when indexer is down... so i removed it from cluster so dashboards are clean , but will re-add the peer , would like to understand behavior when re-adding the peer..
... View more
- Tags:
- ou still
08-06-2020
01:11 AM
I need to take one peer down for maintenance, so i do splunk stop on it. cluster handles and brings cluster back to valid state with 1 indexer showing "down" or "Stopped" now the dashboards have all the data showing up, but there is a small yellow triangle indicating one peer is not searchable. so i removed this peer from cluster master , now the error is gone. i would be re-adding this after activity. so would like to understand what happens when i re-add it... will cluster master identify this peer was removed and was re-added ? will it treat it like it was down and it came back up now ?
... View more
Labels
- Labels:
-
other
04-24-2020
12:22 PM
this works if record does not exist, at times it ( column1=3) can exist as well..
... View more
