About timrich66

timrich66 · ‎02-07-2022

Hi, I have a dashboard that works out the percentage of builds that complete inside SLO. I would like to be able to compare this month's results to those of last month and show a trend line as to how much this percentage has improved (or not). I appreciate that 'count' and timechart are normally used to show the trendline on a single value visualisation. Is there a solution that allows a trendline from a single value that is achieved via eval? Many thanks

timrich66 · ‎01-04-2022

Thank you. I had started to use the <change> parameter, but your answer gave me all I needed to complete.

timrich66 · ‎01-04-2022

@ITWhisperer Apologies, I still don't understand and may not have explained myself properly. This is my original code - <row> <panel> <title>Historical data</title> <input type="dropdown" token="field1"> <label>Time Period</label> <default>-7d@d</default> <choice value="-7d@d">Last 7 days</choice> <choice value="-14d@d">Last 14 days</choice> <choice value="-30d@d">Last 30 days</choice> <choice value="-90d@d">Last 90 days</choice> <initialValue>-7d@d</initialValue> </input> <input type="dropdown" token="task" searchWhenChanged="true"> <label>Batch Task</label> <choice value="Roylink_IAF">Roylink IAF</choice> <choice value="Roylink_FE">Roylink FE</choice> <choice value="Roylink_Upload">Roylink Upload</choice> <choice value="*">All</choice> </input> <table> <search> <query>index=sr_prd sourcetype=batch_roylink earliest=$field1$ | eval s=strptime(Scheduled_Batch_StartTime, "%Y-%m-%d %H:%M:%S.%Q") | eval e=strptime(Scheduled_Batch_Endtime, "%Y-%m-%d %H:%M:%S.%Q") | eval s=round(s,2) | eval e=round(e,2) | eval r=tostring(e-s, "duration") | rename "Scheduled_Batch_StartTime" as "Start Time", "Scheduled_Batch_Endtime" as "End Time", r as "Runtime (H:M:S)" | stats list("Start Time") as "Start Time",list("End Time") as "End Time", list("Runtime (H:M:S)") as "Runtime (H:M:S)" by Task_Object | search Task_Object = $task$</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <sampleRatio>1</sampleRatio> </search> chart options removed to save space </table> </panel> </row> <row> <panel> <chart> <search> <query>index=sr_prd sourcetype=batch_roylink earliest=$field1$ | mvexpand Task_Object | search Task_Object= $task$ | eval s=strptime(Scheduled_Batch_StartTime, "%Y-%m-%d %H:%M:%S.%Q") | eval e=strptime(Scheduled_Batch_Endtime, "%Y-%m-%d %H:%M:%S.%Q") | eval r=round(e - s,3) | timechart span=1d values(r) as "Runtime (seconds)" by Task_Object</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <sampleRatio>1</sampleRatio> </search> chart options removed to save space </chart> </panel> </row> This is what I have so far for the updated dashboard - <row> <panel> <title>Historical data</title> <input type="time" token="field1"> <label>Time Period</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="report" searchWhenChanged="true"> <label>Batch Task</label> <choice value="roylink_task_times task=Roylink_IAF">Roylink IAF</choice> <choice value="roylink_task_times task=Roylink_FE">Roylink FE</choice> <choice value="roylink_task_times task=Roylink_Upload">Roylink Upload</choice> <choice value="roylink_task_times task=*">All</choice> <choice value="roylink_total_time">Total</choice> </input> <table> <search> <query>| savedsearch $report$</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> chart options removed to save space </table> </panel> </row> <row> <panel> <chart> <search> <query>| savedsearch $what goes here?$</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> charting options removed to save space </chart> </panel> </row> As you can see, the second chart needs a different search to produce the timechart. Originally, I could use the $task$ variable as this was common between searches. With the update, I need to call a different search and specify the task appropriate to the choice from the dropdown. Thanks for your patience.

timrich66 · ‎01-04-2022

Thank you, that is perfect. (I've removed 's' from the final table as not required).

timrich66 · ‎01-04-2022

Hi @ITWhisperer could you expand on that please? Or point me to documentation. Thank you

timrich66 · ‎01-04-2022

I am running this search to return batch job run times. index=sr_prd sourcetype=batch_roylink earliest=-7d@d | eval s=strptime(Scheduled_Batch_StartTime, "%Y-%m-%d %H:%M:%S.%Q") | eval e=strptime(Scheduled_Batch_Endtime, "%Y-%m-%d %H:%M:%S.%Q") | eval s=round(s,2) | eval e=round(e,2) | eval r=tostring(e-s, "duration") | rename "Scheduled_Batch_StartTime" as "Start Time", "Scheduled_Batch_Endtime" as "End Time", r as "Runtime (H:M:S)" | stats list(s) as "s", list("Start Time") as "Start Time",list("End Time") as "End Time", list("Runtime (H:M:S)") as "Runtime (H:M:S)" by Task_Object | search Task_Object = Roylink_Upload | sort s Even though 's' is a numeric string, the results are not returning in search order - Any ideas why this is happening? Thanks

timrich66 · ‎01-04-2022

Hi All, I currently have a dashboard that is used to review batch run times. It allows the user to use a dropdown to select and view the run times for each task within the batch process. I have subsequently been asked to add the option to view total batch time taken. To do this requires a different search to that used for the individual batch jobs. I have been able to use saved searches to achieve this. However, the original dashboard dropdown was linked to two searches which used the task name to produce a table and a timechart. My question is, can this be done with saved searches? As far as I can see, the dropdown only allows a link to one saved search. As always, any assistance is gratefully received.

timrich66 · ‎12-13-2021

Hi, I too have a similar issue. Disabling via the _internal call does not work for me. Thanks

timrich66 · ‎11-18-2021

Thanks @PickleRick , I will talk with our infra team and admins to get the UF set up to use an AD account. I'll reply to let you know the result.

timrich66 · ‎11-18-2021

Hi clever people, Does anyone have any suggestions? Thanks

timrich66 · ‎11-10-2021

Hello all, I'm not sure what I have been asked to do is achievable. I'm hoping that someone can advise. We have a Windows 2003 server that cannot have a UF installed as it is not compatible with our current environment (8.1.6). Anyway, that aside, I have managed to ingest data using 'open' shares from a UF on a Windows 2016 server to the 2003 server. I now have a request to ingest data from a restricted share on the 2003 server. I have tried setting up a share from the 2016 server to the 2003 server, but this does not work. I guess because the UF is not using the same account as the share has been set up under? Can anyone tell me how I can create a share for the Splunk UF to use? Thanks

timrich66 · ‎09-21-2021

Thanks @PickleRick I have found that querying the master.sys.availability_groups used in the second INNER JOIN returns no results. I have removed all the 'ag' references and the query runs ok. I've passed it back to the DBA to investigate.

timrich66 · ‎09-21-2021

Hi Knowledgeable People 😊 I have been provided a query which works successfully when run by the DBA on the server itself. However, when run using DB Connect, 'no results' are found. Please can someone advise why this may be? Thanks This is the query - SELECT ar.replica_server_name, adc.database_name, ag.name AS ag_name, drs.is_local, drs.is_primary_replica, drs.synchronization_state_desc, drs.is_commit_participant, drs.synchronization_health_desc, drs.recovery_lsn, drs.truncation_lsn, drs.last_sent_lsn, drs.last_sent_time, drs.last_received_lsn, drs.last_received_time, drs.last_hardened_lsn, drs.last_hardened_time, drs.last_redone_lsn, drs.last_redone_time, drs.log_send_queue_size, drs.log_send_rate, drs.redo_queue_size, drs.redo_rate, drs.filestream_send_rate, drs.end_of_log_lsn, drs.last_commit_lsn, drs.last_commit_time FROM master.sys.dm_hadr_database_replica_states AS drs INNER JOIN master.sys.availability_databases_cluster AS adc ON drs.group_id = adc.group_id AND drs.group_database_id = adc.group_database_id INNER JOIN master.sys.availability_groups AS ag ON ag.group_id = drs.group_id INNER JOIN master.sys.availability_replicas AS ar ON drs.group_id = ar.group_id AND drs.replica_id = ar.replica_id ORDER BY ag.name, ar.replica_server_name, adc.database_name;

timrich66 · ‎09-06-2021

Thanks @PickleRick , I had tried using "eval myId=tonumber(recordId,26)" not realising I had to use base 36 to include 0-9. I am using strftime on the date and combining the date and recordId to give me one SNow ID per day for each record. This gives me the solution I require.

timrich66 · ‎09-03-2021

Thanks @maciep , unfortunately our install is still on v7.3.2 so I cannot use 'mvmap'. I will have to push the provider for an upgrade 🙂

timrich66 · ‎09-03-2021

Hi all, I have an alert that looks for a specific message that includes the record ID. I would like to be able to create a numeric value for that ID that could be used to create a unique ID when raising a ServiceNow ticket. Therefore, all alerts for the same record ID would write to the same SNow ticket. The record ID is a string of 7 alphanumerics - e.g. abc4efg I would like to be able to change "abc4efg" to "1234567". Thus the number does not change, but the letters are all the equivalent 1-26 number. The only constant is the length of the record ID which is 7 characters. I've looked at many answers, sadly none provide exactly what I am looking for. Is this something that could be achieved using SED? Thanks in advance.

timrich66 · ‎08-02-2021

I also have this issue. Are there any solutions? Thanks

timrich66 · ‎07-30-2021

Hi, I need to track the number of times and duration where the CPU used percent is above a threshold number. The search below shows a server that exceeds the threshold for 3 periods over the last 3 days. What I want to get is a result that shows me the number of times the threshold has been exceeded and for how long. I have tried using 'streamstats' and 'bin' but am not entirely sure how to achieve my goal. Thanks

timrich66 · ‎07-05-2021

To add - This does not happen on any other ingestion. The servers are still phoning home and sending infra metrics to ITSI. I have redeployed inputs.conf to the servers. One is prod, one non-prd.

timrich66 · ‎07-05-2021

At the beginning of February this year we started ingesting events from Autosys prod and non-prd servers. All was going well until the end of the month. At 23:59 on 28th Feb, events stopped appearing in the index to which they are being ingested. A few days later they started again at midnight. None of the missed events were collected. The log files for Autosys roll over at midnight so I would not expect events during the missing time period to be collected as the files would have been renamed. This has happened every month since. In March the events started coming in on 3rd, April it was 4th, May on 5th and June they appeared again on the 6th. The only pattern I can see is that events reappear on the day of the month that equals the number of the month - ie 3/3, 4/4, 5/5 and 6/6. If that is the case, then events will not appear in July until 7th. How can this be? I can see no _internal messages that help. Can someone shed some light on this? Thanks

timrich66 · ‎06-23-2021

You've cracked it! Thank you very much 😃

timrich66 · ‎06-23-2021

hi @ITWhisperer thanks for this. It is one of the variations I tried before posting. In my environment, 'RT' is not being calculated or displayed using that search -

timrich66 · ‎06-23-2021

Hi @kamlesh_vaghela Both Start and End Time use _time which is in the format %d/%m/%Y %H:%M:%S e.g. 23/06/2021 09:05:05 The strftime format to return to human readable is - "%Y-%m-%d %H:%M:%S.%Q" Is that what you need?

timrich66 · ‎06-22-2021

That works for me - I have tried adding the eval to my original search but no results found

timrich66 · ‎06-22-2021

@kamlesh_vaghela That search returns no results in my environment Here is the (partially) working search

Posts	59
Solutions	3
Karma Given	6
Karma Received	2
Member Since	‎11-27-2017

Online Status	Offline
Date Last Visited	‎05-30-2022 04:43 AM

How to create dashboard with trend line to show pe...

Why does this search not sort

Run two saved searches from one dropdown

Accessing restricted Windows share

"Inner Join" works in query, not DB Connect

Replace letters with numbers

Calculate time server CPU above alert percentage

The curious case of missing events

Calculate elapsed time from two events

Timechart woes

How to create dashboard with trend line to show pe...

Re: Run two saved searches from one dropdown

Re: Run two saved searches from one dropdown

Re: Why does this search not sort

Re: Run two saved searches from one dropdown

Why does this search not sort

Run two saved searches from one dropdown

Re: Splunk DB Connect rest schedule

Re: Accessing restricted Windows share

Re: Accessing restricted Windows share

Accessing restricted Windows share

Re: "Inner Join" works in query, not DB Connect

"Inner Join" works in query, not DB Connect

Re: Replace letters with numbers

Re: Replace letters with numbers

Replace letters with numbers

Re: sendmodalert - action=risk STDERR - ERROR: [E...

Calculate time server CPU above alert percentage

Re: The curious case of missing events

The curious case of missing events

Re: Calculate elapsed time from two events

Re: Calculate elapsed time from two events

Re: Calculate elapsed time from two events

Re: Calculate elapsed time from two events

Re: Calculate elapsed time from two events

Are you a member of the Splunk Community?