Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sarfarajsayyad
sarfarajsayyad
New Member
Member since:
06-10-2015
06-05-2020
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-10-2015 |
Activity Feed
- Posted Re: Search query taking ages to finish in Splunk 7.0.1 on Splunk Search. 05-21-2018 11:08 PM
- Posted Re: Search query taking ages to finish in Splunk 7.0.1 on Splunk Search. 05-21-2018 10:25 PM
- Posted Re: Search query taking ages to finish in Splunk 7.0.1 on Splunk Search. 03-05-2018 02:20 AM
- Posted Re: Search query taking ages to finish in Splunk 7.0.1 on Splunk Search. 03-05-2018 01:31 AM
- Posted Re: Search query taking ages to finish in Splunk 7.0.1 on Splunk Search. 03-05-2018 12:35 AM
- Posted Re: Search query taking ages to finish in Splunk 7.0.1 on Splunk Search. 03-04-2018 10:19 PM
- Posted Why does my dashboard shows labels in column chart for X-axis but when we exported to pdf it does not? on Dashboards & Visualizations. 02-08-2017 11:18 AM
- Tagged Why does my dashboard shows labels in column chart for X-axis but when we exported to pdf it does not? on Dashboards & Visualizations. 02-08-2017 11:18 AM
- Tagged Why does my dashboard shows labels in column chart for X-axis but when we exported to pdf it does not? on Dashboards & Visualizations. 02-08-2017 11:18 AM
- Tagged Why does my dashboard shows labels in column chart for X-axis but when we exported to pdf it does not? on Dashboards & Visualizations. 02-08-2017 11:18 AM
- Tagged Why does my dashboard shows labels in column chart for X-axis but when we exported to pdf it does not? on Dashboards & Visualizations. 02-08-2017 11:18 AM
- Tagged Why does my dashboard shows labels in column chart for X-axis but when we exported to pdf it does not? on Dashboards & Visualizations. 02-08-2017 11:18 AM
- Posted Re: How do I extract these fields and corresponding values parsing while JSON data? on Splunk Search. 12-07-2016 12:56 AM
- Posted Re: How do I extract these fields and corresponding values parsing while JSON data? on Splunk Search. 12-06-2016 07:21 PM
- Posted How do I extract these fields and corresponding values parsing while JSON data? on Splunk Search. 12-06-2016 06:00 PM
- Tagged How do I extract these fields and corresponding values parsing while JSON data? on Splunk Search. 12-06-2016 06:00 PM
- Tagged How do I extract these fields and corresponding values parsing while JSON data? on Splunk Search. 12-06-2016 06:00 PM
- Tagged How do I extract these fields and corresponding values parsing while JSON data? on Splunk Search. 12-06-2016 06:00 PM
- Tagged How do I extract these fields and corresponding values parsing while JSON data? on Splunk Search. 12-06-2016 06:00 PM
- Posted How to edit search to find the amount time an event is in multi states? on Splunk Search. 11-18-2016 09:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-21-2018
11:08 PM
In my case I have added "| noop search_optimization=false" at the end of the line to resolve the issue. It worked for me, you can give a try.
... View more
05-21-2018
10:25 PM
In my case, I have added "| noop search_optimization=false" at the last line which makes my query fast. You can give a try.
... View more
03-05-2018
02:20 AM
If I use "|noop search_optimization=false" at the end of my query its giving me result very fast. After cross-checking I got the same result.
Is there any impact of "|noop search_optimization=false" ?
... View more
03-05-2018
01:31 AM
I see lot of below messages
02-22-2018 04:06:41.512 INFO SearchPipeline - Command='eval' doesnt have raw field
02-22-2018 04:06:41.512 INFO SearchPipeline - Command='inputlookup' doesnt have raw field
02-22-2018 04:06:41.512 INFO SearchPipeline - Command='inputlookup' doesnt have raw field
02-22-2018 04:06:41.512 INFO SearchPipeline - Command='eval' doesnt have raw field
02-22-2018 04:06:41.512 INFO SearchPipeline - Command='search' doesnt have raw field
02-22-2018 04:06:41.512 INFO SortOperator - maxmem = 209715200
... View more
03-05-2018
12:35 AM
That query is having some customer specific info. Cant share here.
My point is, the same query is running fine on 6.5.2 and not on 7.0.2. Believe me, I have installed 7.0.2 Splunk enterprise on a new machine without data. Still, it's taking more time. Looks like its nothing related to data. Something is changed in 7.0.x.
JFYI - In my query, I have 20+ joined on various indexes/lookup.
... View more
03-04-2018
10:19 PM
Same behavior I see on my setup. My query was running fine on 6.5.2 (within 2 mins) and now it is taking more time (90 mins) on 7.0.2. Is there any change happened on 7.0.x? I don't see any error msg on splunkd log too. There is no clue.
... View more
12-07-2016
12:56 AM
Thank you ! Is there any way to do it in index time ?
... View more
12-06-2016
07:21 PM
Dear, I have added that already.
By default its giving me columns like StartTime.@item , StartTime.#text. But i need only StartTime having value of StartTime.#text. Something like StartTime="2016/11/21 09:35:25".
... View more
12-06-2016
06:00 PM
I have a following JSON input.
{
"StartTime": {
"@item": "1",
"#text": "2016/11/21 09:35:25"
},
"Encryption": {
"@item": "1",
"#text": "None"
},
"Duration": {
"@item": "1",
"#text": "13"
},
"DisplayName": {
"@item": "1",
"#text": "80081"
},
"device_id": 1
}
I need to extract fields like below and ignore the rest (@item) from JSON.
device_id = 1
DisplayName=80081
Duration=13
Encryption=None
StartTime="2016/11/21 09:35:25"
Can it be done writing a single Regex to extract all the fields, or do I need to write separate regex for each field in TRANSFORMS.CONF ?
Any example will help.
/Sarfaraj
... View more
11-18-2016
09:58 AM
I have an index with 30+ fields. One of the field is state. I want to find amount of time an event is in a particular states (comma separated states).
I have a macro like below
[TimeInState(1)]
args = States
join type=left data_id [search index="data_log" log_msg="State Established: $States$" | dedup log_id | sort 0 _time by id | delta _time as "offclock" p=1 | ......remaining search query
iseval = 0
This macro is working fine with single input (States="Open") . What changes i need to do to work with multiple comma separated states(States="Open,Working") ?
I have tried using | makemv delim="," states | top states | but no success
and another issue is i want to do this before first pipe ( | ). i.e search index="datat_log" log_msg="State Established: $TicketStates$" Some logic here
Any advice and suggestions will be greatly appreciated
/Sarfaraj
... View more
12-21-2015
04:30 AM
No its not working
... View more
12-20-2015
08:01 PM
Here is the query which is not working
*index="device" | dedup device_id | join device_id [search index=“asset" | rename assoc_device_id as device_id |dedup device_id] | table _time, **
but if i use left join it worked properly
*index="device" | dedup device_id | join type=left device_id [search index=“asset" | rename assoc_device_id as device_id |dedup device_id] | table _time, **
... View more
12-17-2015
11:33 PM
We have an inner join on two indexes. When we are querying with time controller its not showing data properly with Today, Yesterday. Only All Time is working fine(Most probably its using *). But if i use left join its showing data correctly with left table _time.
My requirement is we need inner join and work with time controller properly.
/Sarfaraj
... View more
06-10-2015
04:18 AM
We are not able to create DB lookup in Splunk DB Connect 2 app. I clicked on "Save" button, but there is no action happening after that.
FYI - I have latest Splunk 6.2.3 and 6.1 Splunk DB Connect 2.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
