Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About jackpal
jackpal
Path Finder
Member since:
02-08-2012
05-07-2025
Community Statistics
| Posts | 27 |
| Solutions | 3 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 02-08-2012 |
Activity Feed
- Karma Re: Ignore null values for richgalloway. 10-14-2020 07:11 AM
- Posted Ignore null values on Splunk Search. 10-14-2020 06:09 AM
- Got Karma for Re: How do you access SII reports directly?. 06-05-2020 12:49 AM
- Got Karma for Re: How do you access SII reports directly?. 06-05-2020 12:49 AM
- Posted Calculate disk space growth over time on Splunk Search. 05-27-2020 05:08 AM
- Tagged Calculate disk space growth over time on Splunk Search. 05-27-2020 05:08 AM
- Posted How do I get top values based on eval? on Splunk Search. 10-08-2018 01:04 PM
- Tagged How do I get top values based on eval? on Splunk Search. 10-08-2018 01:04 PM
- Tagged How do I get top values based on eval? on Splunk Search. 10-08-2018 01:04 PM
- Posted Re: How do you access SII reports directly? on Reporting. 09-07-2018 05:22 AM
- Posted Re: How do you access SII reports directly? on Reporting. 09-06-2018 11:04 AM
- Posted How do you access SII reports directly? on Reporting. 09-06-2018 10:12 AM
- Tagged How do you access SII reports directly? on Reporting. 09-06-2018 10:12 AM
- Posted Re: How to plot max system load against the actual load? on Splunk Search. 07-03-2018 08:32 AM
- Posted Re: How to plot max system load against the actual load? on Splunk Search. 07-03-2018 08:28 AM
- Posted How to plot max system load against the actual load? on Splunk Search. 07-03-2018 08:21 AM
- Tagged How to plot max system load against the actual load? on Splunk Search. 07-03-2018 08:21 AM
- Tagged How to plot max system load against the actual load? on Splunk Search. 07-03-2018 08:21 AM
- Posted Re: How to sort by field? on Splunk Search. 06-27-2018 10:39 AM
- Posted How to sort by field? on Splunk Search. 06-27-2018 08:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-14-2020
06:09 AM
I am using the nix agent to gather disk space. I only collect "df" information once per day. I want to be able to present a statistics table that only shows the rows with values. When I do the query below I get alot of empty rows. I'd like to only show the rows with data. index=os sourcetype=df host=hostname filesystem=*mapper*lim* | eval LIM_PROD_DISK=case( filesystem LIKE "%limproda1%", "limproda1", filesystem LIKE "%limproda2%", "limproda2", filesystem LIKE "%limprodwide0%", "limprodwide0", filesystem LIKE "%limprodwide1%", "limprodwide1", filesystem LIKE "%limprodwide2%", "limprodwide2", filesystem LIKE "%limtoolsvol%", "limptoolsvol" ) | bin _time span=1d | timechart max(storage_used_percent) by LIM_PROD_DISK
... View more
Labels
- Labels:
-
table
05-27-2020
05:08 AM
I am providing summarized reports on disk space over several hosts using this query:
index=os sourcetype=df host=host1 OR host=host2
| eval CPD_Disk=case(
filesystem LIKE "%gas%", "Gas Volume",
filesystem LIKE "%cadbas%", "CMS Volume",
filesystem LIKE "%spg%", "SPG Volume",
filesystem LIKE "%gen%", "Generator Volume",
filesystem LIKE "%stm%", "Steam Volume"
)
| chart eval(sum(UsedMBytes)/1024/1024) as TerraBytes by CPD_Disk| addcoltotals TerraBytes labelfield=CPD_Disk label=Total
I would like to provide the total amount of growth over the past 30 days. How could I add something like this ?
... View more
10-08-2018
01:04 PM
I have a relatively simple query with which I am evaluating a new field. I'd like to get the top values of this new field however the results are not what I expect:
Base Query:
index=lisum_data vendord=* user_hash=* featurename=*
| stats count by user_hash
| eval TimeUsed=count*10/60
| where TimeUsed > .5
| sort TimeUsed desc
| fields - count
Attempted:
index=lisum_data vendord=* user_hash=* featurename=*
| stats count by user_hash
| eval TimeUsed=count*10/60
| where TimeUsed > .5
| sort TimeUsed desc
| fields - count
| top limit=25 TimeUsed
I want a table of the top 25 users (user_hash) by total time used(TimeUsed)
... View more
09-07-2018
05:22 AM
1 Karma
Well when the charts are displayed for a metric like user cpu time for example there are options to do a few things.
Create Alert
Open in Search
Save as Dashboard Panel
Save as Report
Clone this Panel
Export as PNG
Export as CSV
Based on the two options above (save as dashboard panel and save as report) I assumed I should be able to access them after creation and modify as needed. The normal dialog for permissions, scheduling, etc comes up after creation however unless I specify in permissions to share for all apps I am unable to access the report later to edit. That was basically my question.
So my workaround is just share with all apps when creating reports or panels or reports. This way if I need to edit the report I can access it in the search app and modify as needed. Like I mentioned earlier, I have an enterprise installation so I might probably have more abilities than somebody using the standalone version.
... View more
09-06-2018
11:04 AM
1 Karma
Thanks, I did not explain that I am integrating SII into an existing Enterprise installation. I am able to do what I need to at this point. Thanks.
... View more
09-06-2018
10:12 AM
I've saved a few charts in SII as reports so they could be embedded in another application. I've found no direct way of accessing these reports from SII. As a workaround, I've changed permissions to show in every app so they can be managed from the Search app. How does one access custom SII reports directly?
... View more
07-03-2018
08:32 AM
Some more details are probably in order. In the 30 day license report there is a dotted line for "Stack Size" I would like the max value plot to stand out more.
... View more
07-03-2018
08:28 AM
Thanks. Is there a way to label that line on the chart as MaxLoad. I'd like to point on on the chart that this is the maximum.
... View more
07-03-2018
08:21 AM
I have the following simple query:
index=os sourcetype=vmstat tag=dcv-na | eval MaxLoad = 28 | timechart max(loadAvg1mi) as LoadAvg,max(MaxLoad) as MaxLoad by host
This works well enough but when multiple hosts are involved its gets busy due to the fact that eval is a plot for each host. I'd like just one line across the chart showing the max value for all hosts. Similar to how the licensing reports work.
... View more
06-27-2018
08:08 AM
I am trying to get the highest used process percentage by user, however, I am unable to sort by the field I want to.
index=os sourcetype=top host=hostname
| chart sum(pctCPU) as CPU_USAGE by USER,COMMAND
| sort sum(pctCPU) desc
| head 5
This produces a table but I'd like the chart to only show the top 5 users and the commands they are running sorted by their CPU_USAGE
... View more
06-27-2018
07:27 AM
I have the need to deliver PDF reports externally. Is there a way to have report generated on a schedule and the resulting pdf file be written a location on a filesystem ?
... View more
- Tags:
- splunk-enterprise
04-19-2018
08:31 AM
We are tracking Linux process usage across several hosts which are tagged. I can get an overall usage by process across all hosts combined but I'd like to separate this out by host for alerting purposes.
My query so far:
index=os OR index=main sourcetype=ps tag=dcv COMMAND="gnome-shell" | stats sum(pctCPU) as pctCPU by _time,COMMAND | timechart avg(pctCPU) by COMMAND
... View more
- Tags:
- splunk-enterprise
11-14-2017
08:15 AM
I am tracking versions of Operating systems and I'd like to summarize since we have a few different release numbers. Currently I can get a summary with the following simple query :
index=test CURREL=ws* |stats count by ELC_VERSION
This produces a list similar to this:
I'd like to simplify but just having the ELC_VERSION field rolled up into RHEL6 and RHEL7
... View more
05-17-2017
08:05 AM
I understand the need for inputs but how do you interface to them ? Are these just files on the Ansible machine or are they feeds from the Ansible database ? There does not seem to be much documentation on this module and I think its needed.
... View more
03-22-2016
01:25 PM
Sorry for the dumb question but where is this file that needs to be modified ?
... View more
03-22-2016
12:04 PM
With some extra help I was able to do the following. Thanks to all for their help on this thread.
index=os sourcetype=df host=aaaa OR host=bbbb
filesystem="/dev/mapper/tcpr*" |
eval CPD_Disk=case(
filesystem LIKE "/dev/mapper/tcprgas%", "Gas Volume",
filesystem LIKE "/dev/mapper/tcprcadbas%", "CADBAS Volume",
filesystem LIKE "/dev/mapper/tcprspg%", "SPG Volume",
filesystem LIKE "/dev/mapper/tcprgen%", "Generator Volume",
filesystem LIKE "/dev/mapper/tcprstm%", "Steam Volume"
)
| chart eval(sum(UsedMBytes)/1024/1024) as TerraBytes by CPD_Disk
... View more
02-22-2016
06:13 AM
main is still in there as a definition bu the path is: homePath = $SPLUNK_DB/defaultdb/db
Not really sure what it was called before or if it was always called this. I do know that main was always the "default" index
... View more
02-22-2016
05:51 AM
Thanks, I did install the Unix add on and app. However my split license usage does not show main anymore. It only shows default , os and one other that I created. Definitely new behavior since my upgrade.
... View more
02-22-2016
04:42 AM
It seems that since my upgrade to Splunk 6.3 from 6.1, a new index called "default" has appeared. Also, since then, my license usage has increased. I am not sure if they are related.
... View more
02-18-2016
09:59 AM
Sorry I thought you saw that in one of the above posts.
index=os OR index=main sourcetype=df host=aaaa OR host=bbbb OR host=cccc OR host=dddd Filesystem="/dev/mapper/gas"
Thanks for the help.
... View more
02-18-2016
08:09 AM
Thanks and understood but using Host_FileSystem now breaks out each volume when the point of the report is roll them all up under their own category. The resulting pie chart now has each individual volume listed (which is quite a bit of them)
Events sample now (too many to list:
1 aaaa/dev/mapper/tcprgas002vg-tcprgas002vol 94.000000
2 aaaa/dev/mapper/tcprgas003vg-tcprgas003vol 100.000000
3 aaaa/dev/mapper/tcprgas005vg-tcprgas005vol 60.000000
4 aaaa/dev/mapper/tcprgas006vg-tcprgas006vol 1.000000
Events sample before when broken out by event type:
1 CADBASVolume 1.000000
2 GasVolume 88.461538
3 GeneratorVolume 44.000000
4 SPGVolume 85.333333
5 SteamVolume 49.666667
6 df 81.698113
... View more
02-18-2016
04:44 AM
Event definition for one volume is as follows:
index=os OR index=main sourcetype=df host=aaaa OR host=bbbb OR host=cccc OR host=dddd Filesystem="/dev/mapper/gas"
... View more
02-18-2016
04:39 AM
using NOT eventtype=df excludes all of the data I am interested in so its not useful.
... View more
02-17-2016
12:47 PM
I need to track disk space over multiple servers in one pie chart. I want to match all volumes with terms in them according to product lines. In my case this is GAS, GEN, STM. The volumes are spread out across multiple machines. I created an event type for each volume match in "df". My search is below.
index=os OR index=main sourcetype=df host=aaaa OR host=bbbb OR host=cccc OR host=dddd eventtype=*Volume NOT eventtype=DBAVolume NOT eventtype=T4STempVolume | strcat host '@' Filesystem Host_FileSystem | chart avg(UsePct) by eventtype | rename avg(UsePct) as %Used
My issue is that "df" is an event type so it takes up a good part of the chart.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-07-2025
11:41 AM
|
