Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tenyang
tenyang
New Member
Member since:
06-03-2015
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-03-2015 |
Activity Feed
- Posted eval wildcard on All Apps and Add-ons. 01-05-2016 10:55 PM
- Tagged eval wildcard on All Apps and Add-ons. 01-05-2016 10:55 PM
- Tagged eval wildcard on All Apps and Add-ons. 01-05-2016 10:55 PM
- Tagged eval wildcard on All Apps and Add-ons. 01-05-2016 10:55 PM
- Posted Re: How do I display shops performance data with Google Maps? on Splunk Search. 06-17-2015 06:54 AM
- Posted Re: How do I display shops performance data with Google Maps? on Splunk Search. 06-16-2015 11:46 PM
- Posted How do I display shops performance data with Google Maps? on Splunk Search. 06-16-2015 03:14 AM
- Tagged How do I display shops performance data with Google Maps? on Splunk Search. 06-16-2015 03:14 AM
- Tagged How do I display shops performance data with Google Maps? on Splunk Search. 06-16-2015 03:14 AM
- Tagged How do I display shops performance data with Google Maps? on Splunk Search. 06-16-2015 03:14 AM
- Posted Re: how to set priority for each server based on their performance on Splunk Search. 06-09-2015 10:49 PM
- Posted how to set priority for each server based on their performance on Splunk Search. 06-09-2015 10:18 PM
- Tagged how to set priority for each server based on their performance on Splunk Search. 06-09-2015 10:18 PM
- Tagged how to set priority for each server based on their performance on Splunk Search. 06-09-2015 10:18 PM
- Tagged how to set priority for each server based on their performance on Splunk Search. 06-09-2015 10:18 PM
- Posted Re: How to write a search to find which tablets have a latest status of Error or Corrupted? on Splunk Search. 06-07-2015 11:08 PM
- Posted How to write a search to find which tablets have a latest status of Error or Corrupted? on Splunk Search. 06-07-2015 06:49 PM
- Tagged How to write a search to find which tablets have a latest status of Error or Corrupted? on Splunk Search. 06-07-2015 06:49 PM
- Tagged How to write a search to find which tablets have a latest status of Error or Corrupted? on Splunk Search. 06-07-2015 06:49 PM
- Posted Re: How to edit my search to find the name of each server that has not reported in the last 4 hours? on Splunk Search. 06-04-2015 11:05 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-05-2016
10:55 PM
hi all,
i used eval wildcard to create a new field with below command:
*|eval product=case (match(shop_tags,"pen"), "pen", match(shop_tags,"pencil"), "pencil")
i have many tags under shop_tags, but now i have a new product book, it has two types, i want to create a new name "book_west" if it both match book and west, "book_east" if it match book and east. i am not sure how to deal with if i need match two tags to create a new one,
*|eval product=case (match(shop_tags,"pen"), "pen", match(shop_tags,"pencil"), "pencil",match(shop_tags,"book","west"), "book_west") is not working, could any one help me on this?
thanks a lot.
... View more
06-17-2015
06:54 AM
Thanks for your reply Fdi01, currently my search command is below:
interaction_count | stats sum(interaction_count) as interactions by shop_name | lookup singapore.csv shop_name OUTPUT latitude AS lat longitude AS lon | search lat="" lon="" | geostats maxzoomlevel=11 globallimit=0 sum(interactions) by shop_name
it can show open street map, but the colour is quite hard to identify, could you pls let me how to set the display colour of map?
Thanks again.
... View more
06-16-2015
11:46 PM
Could anyone help me on this question?
... View more
06-16-2015
03:14 AM
Hi all,
I am new to the Splunk world. Currently, I want to display performance of shops with google maps, and I am not sure how to finish this.
I have all the events of performance from spunk server, and the event is like below. I also uploaded a lookup table for all information of the shops. Now i want to show the mount_name with Red if there is no data report for latest 24 hours and normal ones with a green color. Since every event is sent by mount, and event is including shop_name also, I want to use the lookup table to indicate the shop location. May I know if it is possible? if yes, how to achieve this goal?
Thanks in advance.
Event:
Jun 16 2015 09:00:00 app_id="84acfc1640a14da8a9c3b2a898940ac9" app_name="KungFu_Lifebuoy" app_version="26.0.0" attract_duration="5" attract_exit_by_menu_button="0" campaign_end="2037-03-31" campaign_id="2e7c105a0b5e47aca1142b0eaeba411e" campaign_name="Guardian_all_Lifebuoy" campaign_start="2015-02-01" display_count="18" display_duration="625" game_lost="0" game_win="1" geoloc_city="Singapore" geoloc_country="Singapore" interaction_count="2" loading_duration="137" mount_description="MountLocation-Dental Care /S1" mount_id="05df45400f8c11e5870e0647ae8d6515" mount_name="Guardian 1KM 1" mount_tags="MountLocation-Dental, Singapore, Release_Batch_4" phone_input_count="0" phone_input_duration="0" play_count="2" play_duration="35" record_duration="3600" reward_exit_by_menu_button="1" reward_exit_by_sms_send="0" reward_idle_duration="14" reward_interaction_count="1" reward_interaction_duration="9" router_count="0" score_duration="6" shop_description="Add: 11 Tanjong Katong Road B1-19_20 S437157" shop_id="f7aa03e5d88811e4a4510a3fe87d2201" shop_name="Guardian 1KM (1KM)" shop_tags="Guardian-1KM, xwalk-library, AreaLocation-Commercial-Area, OutletLocation-Shopping-Mall, MassRebootTarget, Guardian, ZoneLocation-East, LIVE" skipped_score_count="1" started_by_menu="1" sum_game_progression="192" timezone_id="Asia/Singapore" timezone_offset="28800000" tutorial_duration="9"
Seach for no data reporting:
interaction_count="*" |stats latest(_time) AS lastReportTime BY mount_name| eval silenceSeconds = now() - lastReportTime |eval silenceHour = silenceSeconds/3600| where silenceHour > 24 |table mount_name, silenceHour |eval silenceHour =round(silenceHour,1) |sort -silenceHour
Lookup table:
shop_name No. of Tablets latitude longitude
Guardian 1KM (1KM) 1 1.31523 103.894722
Guardian Amara Hotel Tower (AMH) 2 1.275149 103.84357
Guardian Ang Mo Kio Blk 449 (A449) 1 1.368107 103.856057
Guardian Ang Mo Kio Blk 531 (A531) 1 1.373705 103.85437
... View more
- Tags:
- google-maps
- map
- search
06-09-2015
10:49 PM
hi Lguinn,
Priority is defined by the performance of command2. According to the second command, i can get the interaction count for each tablet, so those who has higher performance, will get higher priority, so command1 can display according to that .
Do you have any idea on this situation?
Thanks so much.
... View more
06-09-2015
10:18 PM
Hi all,
Currently I can search out the tablet name which has no data sent for more than 24 hours with below command 1. However, I also want to get the priority of them based on their performance (with command 2). Which means higher performance owns higher priority, even their silence hour may not be the highest.
could you please kindly guide me on how to combine these two commands together to get a final list, which is sorted by priority already.
Command 1:
shop_tags= "*wumart*" interaction_count="*" LIVE
|stats latest(_time) AS lastReportTime BY mount_name
| eval silenceSeconds = now() - lastReportTime
|eval silenceHour = silenceSeconds/3600
| where silenceHour > 24
|table mount_name, silenceHour
|eval silenceHour =round(silenceHour,1)
|sort -silenceHour
Command2:
shop_tags= "*wumart*" interaction_count="*" LIVE
|stats sum(interaction_count) AS sum_interaction_count BY mount_name
|sort -sum_interaction_count
Thanks again.
... View more
06-07-2015
11:08 PM
Thanks so much Woodcock, it is really helps.
Best Regards
Ten
... View more
06-07-2015
06:49 PM
Hi all,
I have an event sent with the information if a tablet downloaded app successfully or not. If it faces problem, the label shows (AppCorrupted OR Error), but some of them can automatically fix this issue. Fox example, for a tablet called ABC, if AppCorrupted occurred at 11 AM, but it is up at 12 PM, then it would send a new event as event2 below label="AppDownloaded".
Currently my search can only count the total times "Error" or "AppCorrupted", but what I want is get the latest tablet name which is still down. In the previous example, tablet ABC should not be shown as it has been up already.
Please kindly guide me how to fix this problem, thanks in advance.
Event 1:
Jun 05 2015 10:35:47 action="AppDownloaded" category="TabletSystem" geoloc_city="Beijing" geoloc_country="China" label="Error" mount_description="WM-SM-F3" mount_id="651" mount_name="WuMart-Shi-Men F3 石门店 F3" mount_tags="" router_count="0" shop_id="f9ed04cf07c443258e53d25d97b6e285" shop_name="WuMart-Shi-Men" shop_tags="WuMart-Shi-Men, xwalk-library, Tablet-PIPO, With_PowerPoint, WuMart, WM-SM, Pilot-Apr2015, MassRebootTarget, Install_Grp7, Beijing, LIVE, District-Shun-Yi-Qu, ABTest-HnS-Exposed, Hypermarket, China" timezone_id="Asia/Shanghai" timezone_offset="28800000" value="22689566"
Event 2:
Jun 05 2015 08:56:58 action="AppDownloaded" category="TabletSystem" geoloc_city="Singapore" geoloc_country="Singapore" label="AppDownloaded" mount_description="FP-BNA MountLocation-Dairy-Products" mount_id="779" mount_name="Fairprice Bedok North F2" mount_tags="MountLocation-Dairy-Products" router_count="0" shop_description="Blk 212 Bedok Nth St 1 #01-147 (460212)" shop_id="a4bba643726a4b3992eaba42e6413c19" shop_name="Fairprice Bedok North (BNA)" shop_tags="Tablet-FUGU, Supermarket, Install_May2015, xwalk-library, Singapore, Fairprice-Bedok-North, Campaign-Shared, MassRebootTarget, LIVE, Fairprice" timezone_id="Asia/Singapore" timezone_offset="28800000" value="-7750"
My search:
LIVE category="TabletSystem" (AppCorrupted OR Error) |stats count by mount_name
... View more
06-04-2015
11:05 PM
Thanks for your help Stephanefotso.
... View more
06-04-2015
11:04 PM
Thanks so much Woodcock, it works!!
... View more
06-03-2015
06:43 PM
One thing need mention is that, if there is no interaction in 1 hour, it still send a event, but the sum(interaction_count) is 0. Now I want to find out no data reporting screen, which shows blank not 0 if we show one day event by hour.
... View more
06-03-2015
06:38 PM
Hi all,
I am a new one to splunk. Now i am facing some problem to get the data as I want.
I have more than 250 servers forwarding data to splunk, and the events are updated every hour as a group. For example, each server will sent the total number of interaction for the last hour. now I want to find every server name which has not sent data for the last 4 hours.
When I search the event, if there is no data sending, then the server name will not display after search, so I can't get them. My question is how can I get all server names and then find out those who are no longer sending. Please kindly help me on this.
My base search:
interaction_count="*" LIVE| eval date = strftime(_time, "%Y-%m-%d")| stats sum(interaction_count) as sum_interaction_count by mount_name, date
Thanks in advance~~~
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
