×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- About jenniferhao
jenniferhao
Explorer
Member since:
12-11-2017
01-11-2024
Community Statistics
| Posts | 44 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 12-11-2017 |
Activity Feed
- Posted we need to setup alert for montoring java processes on Getting Data In. 01-11-2024 01:39 PM
- Karma Re: check log file was not updated for more than 5 mins for PickleRick. 06-13-2022 10:28 AM
- Posted Re: check log file was not updated for more than 5 mins on Monitoring Splunk. 06-13-2022 05:16 AM
- Posted Why check log file was not updated for more than 5 mins? on Monitoring Splunk. 06-09-2022 01:14 PM
- Posted How to get all values from a XML field? on Splunk Search. 03-03-2022 11:56 AM
- Tagged How to get all values from a XML field? on Splunk Search. 03-03-2022 11:56 AM
- Posted Re: how to deal with the 2 conflict conditions on where on Splunk Search. 07-13-2021 08:02 AM
- Posted how to deal with the 2 conflict conditions on where on Splunk Search. 07-12-2021 02:55 PM
- Posted How to make 2 windows to compare the values in these 2 windows on Splunk Enterprise. 06-21-2021 12:38 PM
- Posted Re: Is there any possible to modify raw data in Splunk on Splunk Enterprise. 05-27-2021 01:44 PM
- Posted Is there any possible to modify raw data in Splunk on Splunk Enterprise. 05-27-2021 12:02 PM
- Posted Re: how to clean the splunk alarm? on Splunk Search. 05-18-2021 08:22 AM
- Posted how to clean the splunk alarm? on Splunk Search. 05-18-2021 07:39 AM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-09-2021 02:05 PM
- Posted Re: How can make every 2 columns of table as same colour? on Splunk Search. 04-09-2021 01:47 PM
- Posted Re: How can make every 2 columns of table as same colour? on Splunk Search. 04-07-2021 08:57 AM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-07-2021 07:19 AM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-06-2021 07:12 PM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-06-2021 03:08 PM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-06-2021 02:07 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-11-2024
01:39 PM
we need to set up an alert if a server no java process for 15mins, only one alert was sent until the issue was solved. Do we need to create 2 windows for this? | mstats count(os.cpu.pct.used) as c where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) by host_ip | join host type=left [| mstats avg(ps_metric.pctMEM) as avg_mem_java avg(ps_metric.pctCPU) as avg_cpu_java count(ps_metric.pctMEM) as ct_java_proc where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) sourcetype=ps_metric COMMAND=java by host host_ip COMMAND USER ] | fields - c | eval is_java_running = if(ct_java_proc>0, 1, 0)
... View more
Labels
- Labels:
-
monitor
06-13-2022
05:16 AM
Thanks for helping, this works.
... View more
06-09-2022
01:14 PM
I have a log file which should be updated in every min, but some time service hung, so the file cannot get update. Need to send an alert: if the file wasn't updated more than 5mins. But tried with the following different ways, the results seems not accurate. Any idea? Thanks.
I did:
index=abcapp source=abc.log" | sort _time |streamstats window=2 range(_time) as timediff |table timediff _time |eval alert=if(timediff>=5,1,0) |where alert=1
OR index=abcapp source="abc.log" | sort _time | delta _time as timediff | eval alert = if(timediff>5,1,0) |where alert =1
OR index=abcapp source="abc.log" earliest=-5m latest=now |stats count as num | eval alert = if(num=0,1,0) |where alert =1
... View more
- Tags:
- log
- monitoring
Labels
- Labels:
-
search head
-
splunkd
03-03-2022
11:56 AM
I have a xml _raw="2022-03-02 21:22:39.417 [MESSAGE] [default-threads - 8] [re_messages] - <?xml version="1.0" encoding="UTF-8"?><al:EnvEventDatagram xmlns:mex="http://xxxx" xmlns:bdm="http://xxxx" xmlns:al="http://xxxx" xmlns:xsi="http://www.w3.org/xxxx" xsi:schemaLocation="http://xxxx.xsd"><mex:ManagedApp><mex:IssuerId>com1</mex:IssuerId><mex:Code>abc</mex:Code><mex:DeployedUnitId>123</mex:DeployedUnitId><mex:DxmVersion>1.10</mex:DxmVersion></mex:ManagedApp><mex:ID>456</mex:ID><mex:AID>1</mex:AID><al:SvcEventDatagram><mex:MessageID>aaa</mex:MessageID><al:Alert><al:DA><al:ASQ><al:IssuerId>bbb</al:IssuerId><al:Value>ccc</al:Value></al:ASQ><al:CU><bdm:B><bdm:IssuerId>888</bdm:IssuerId><bdm:Value>ddd</bdm:Value></bdm:B></al:CU><al:YYY><al:LLL>89</al:LLL><al:BNum>28</al:BNum><al:NUM>6</al:NUM></al:YYY><al:FAUTQ><al:Value>vvv</al:Value></al:FAUTQ><al:BA><bdm:TypeQcd><bdm:IssuerId>kkk</bdm:IssuerId><bdm:Value>ABC</bdm:Value></bdm:TypeQcd><bdm:Ccyamt><bdm:MM>88</bdm:MM></bdm:Ccyamt></al:BA><al:BA><bdm:TypeQcd><bdm:IssuerId>abc</bdm:IssuerId><bdm:Value>NNN</bdm:Value></bdm:TypeQcd><bdm:Ccyamt><bdm:MM>22</bdm:MM></bdm:Ccyamt><al:ReasonQcd><al:IssuerId>vvv</al:IssuerId><al:Value>FF</al:Value></al:ReasonQcd></al:BA><al:DATypeQcd><al:Value>mmm</al:Value></al:DATypeQcd><al:OverLimitInd>ii</al:OverLimitInd><al:Qcd><al:Value>N/A</al:Value></al:Qcd></al:DA><al:QQQ><bdm:DescriptionTxt><bdm:Text>HH</bdm:Text></bdm:DescriptionTxt><bdm:StartDttm>2022-03-02</bdm:StartDttm><bdm:ATQ><bdm:IssuerId>77</bdm:IssuerId><bdm:Value>TTT</bdm:Value></bdm:ATQ><bdm:Status><bdm:TypeQcd><bdm:IssuerId>55</bdm:IssuerId><bdm:Value>PPP</bdm:Value></bdm:TypeQcd></bdm:Status><bdm:Ccyamt><bdm:MM>12</bdm:MM></bdm:Ccyamt><bdm:DebitCreditQcd><bdm:IssuerId>AAA</bdm:IssuerId><bdm:Value>GGG</bdm:Value></bdm:DebitCreditQcd><al:TED>2022-03-02</al:TED><al:ProcessDt>2022-03-02</al:ProcessDt></al:QQQ></al:Alert></al:SvcEventDatagram></al:EnvEventDatagram>"
any way can get all <bdm:Value>'s vallues(ddd, ABC etc.) by regex?
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
07-13-2021
08:02 AM
Thanks. The problem becomes how can get a list values with the condition? for example, I need to get some values lists where alarm=1, but I also need to deal with alarm=0 | where alarm=1 OR alarm=0 |eventstats list(create_session) as create_session list(Dn) as Dns by _time //ONLY alarm==1 |evenststa list (IPs) as IPs by _time //ONLY alarm==0 |table IPs create_session DNs
... View more
07-12-2021
02:55 PM
I have a query to send an alert, which have 2 conflict conditions: |where alarm=1 generate some sum information only for alarm happens |where alarm=0 do something for cleaning the alarm |table * But I only can do one of them, If I put where alarm=1 first, then I only can generate the alarm, otherwise, only can do clean alarm. If I put where alarm=1 OR alarm=0, it cannot generate some sum information for the alarm data. For example |eventstats list(x) etc. Any suggestion? Thanks in advance.
... View more
Labels
- Labels:
-
stats
06-21-2021
12:38 PM
We need to set up a dynamic thresholds to compare the values on current week with the week before, should generate alarm when the value out of the range of + - 5%. Do you have any idea to do this more effective? for example: index="abc" sourcetype="def" earliest=-12h latest=now |bucket _time span=15m stats max(x1) as x1 max(y1) as y1 by _time [search index="abc" sourcetype="def" earliest=-24h latest=-12h |bucket _time span=15m stats max(x2) as x2 max(y2) as y2 by _time |eval alarm=if ((x1-x2)/x2 >=abs(0.5) OR (y1-y2)/y2>=abs(0.5),1,0)
... View more
- Tags:
- 2 windows
Labels
- Labels:
-
using Splunk Enterprise
05-27-2021
01:44 PM
Thanks. But the issue not all of "SMT" in April was wrong. Only part of them need to be update. Anyway, thanks for your reply.
... View more
05-27-2021
12:02 PM
hello, we have some raw data with one field wrong from April. But we cannot reload data from the source. Is there any way that we can modify only one field? for example: _time id name value: 20210406 1 "SMT" 60 to be 20210406 1 "Node" 60 20210416 100 "SMT" 80 to be 20210416 100 "Node" 80
... View more
- Tags:
- raw data
Labels
- Labels:
-
using Splunk Enterprise
05-18-2021
08:22 AM
Sorry, maybe I'm not descript clearly. The issue is if alarm happens in 5 mins before, then I need to test the threshold. If condition match then sent a clear alarm out, otherwise, I don't need to do anything.
... View more
05-18-2021
07:39 AM
Hello, expert, I set up an alarm as following, and run it as cronjob by 5mins. Do you have any idea on clean the alarm only after the alarm occurs to avoid sending alert every 5mins in normal situation? | eval alarm = if(value >= alarmTheashold,1,0) //if alarm==1, then tag=1 | eval clear = if(value < alarmTheashold,1,0) // clear=1 when value<alarmTheashold AND tag==1
... View more
Labels
- Labels:
-
eval
04-09-2021
02:05 PM
I tested same above code on different browsers and got same result. But when I tested with different Splunk versions and got the different results. Tested it on V7.3.3 and V8.1.2. The results are wrong which display the number with "RED". ONLY on Splunk V8.1.3. I got the correct result. Thank for help.
... View more
04-09-2021
01:47 PM
I tested it on the last Splunk(8.1.3). It works well. But our PROD version is Splunk Enterprise Version:7.3.3Build:7af3758d0d5e. But it doesn't work at all. Anyway thanks for help.
... View more
04-07-2021
08:57 AM
Sorry for reply late. I did the testing but it seems not working. <dashboard> <row> <panel depends="$stayhidden$"> <html> <style> #tableColumnPairs th:nth-child(4n+0), #tableColumnPairs td:nth-child(4n+0), #tableColumnPairs th:nth-child(4n+1), #tableColumnPairs td:nth-child(4n+1){ background: #cc0000 !important; } #tableColumnPairs th:nth-child(4n+2), #tableColumnPairs td:nth-child(4n+2), #tableColumnPairs th:nth-child(4n+3), #tableColumnPairs td:nth-child(4n+3){ background: #cc0000 !important; } </style> </html> </panel> <panel> <table id="tableColumnPairs"> <title>Table with Value and Color Combined </title> <search> <query>| makeresults | eval data= "C1 1 2 10 20 5 2 12 9 33 1 14 5;C2 3 2 5 4 11 2 32 5 44 1 88 2;C3 5 4 5 3 6 8 12 9 18 3 7 2;C4 6 4 8 2 77 5 45 3 12 5 87 9;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4),pre3=mvindex(data,5), post3=mvindex(data,6),pre4=mvindex(data,7), post4=mvindex(data,8),pre5=mvindex(data,9), post5=mvindex(data,10),pre6=mvindex(data,11), post6=mvindex(data,12) | fields - _time data |table pre1 post1 pre2 post2 pre3 post3 pre4 post4 pre5 post5 pre6 post6 </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard><dashboard> <row> <panel depends="$stayhidden$"> <html> <style> #tableColumnPairs th:nth-child(4n+0), #tableColumnPairs td:nth-child(4n+0), #tableColumnPairs th:nth-child(4n+1), #tableColumnPairs td:nth-child(4n+1){ background: #cc0000 !important; } #tableColumnPairs th:nth-child(4n+2), #tableColumnPairs td:nth-child(4n+2), #tableColumnPairs th:nth-child(4n+3), #tableColumnPairs td:nth-child(4n+3){ background: #cc0000 !important; } </style> </html> </panel> <panel> <table id="tableColumnPairs"> <title>Table with Value and Color Combined </title> <search> <query>| makeresults | eval data= "C1 1 2 10 20 5 2 12 9 33 1 14 5;C2 3 2 5 4 11 2 32 5 44 1 88 2;C3 5 4 5 3 6 8 12 9 18 3 7 2;C4 6 4 8 2 77 5 45 3 12 5 87 9;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4),pre3=mvindex(data,5), post3=mvindex(data,6),pre4=mvindex(data,7), post4=mvindex(data,8),pre5=mvindex(data,9), post5=mvindex(data,10),pre6=mvindex(data,11), post6=mvindex(data,12) | fields - _time data |table pre1 post1 pre2 post2 pre3 post3 pre4 post4 pre5 post5 pre6 post6 </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>
... View more
04-07-2021
07:19 AM
<dashboard> <row> <panel> <title>Only SimpleXML no JS required</title> <html> <style> #tableWitColor table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableWitColor"> <title>Table with Value and Color Combined (With Simple XML Color Palette Expression)</title> <search> <query>| makeresults | eval data= "C1 1 2 10 20;C2 3 2 5 4;C3 5 4 5 3;C4 6 4 8 2;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4) | fields - _time data | eval post1=if( post1 > pre1,mvappend(post1,"RED"),post1) | eval post2=if( post2 > pre2,mvappend(post2,"RED"),post2) |table pre1 post1 pre2 post2 </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="post1"> <colorPalette type="expression">if(match(value,"RED"),"#FF0000", "#65A637")</colorPalette> </format> <format type="color" field="post2"> <colorPalette type="expression">if(match(value,"RED"),"#FF0000","#65A637")</colorPalette> </format> </table> </panel> </row> </dashboard> You can see the "RED" still on the table.
... View more
04-06-2021
07:12 PM
A good catch. But it doesn't work. The "RED" still shows up.
... View more
04-06-2021
03:08 PM
The display:none; for data-mv-index="1" doesn't stop the color name being shown. See below: <dashboard> <row> <panel> <title>Only SimpleXML no JS required</title> <html> <style> #tableRowColorWithoutJS table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableWitColor"> <title>Table with Value and Color Combined (With Simple XML Color Palette Expression)</title> <search> <query>| makeresults | eval data= "C1 1 2 10 20;C2 3 2 5 4;C3 5 4 5 3;C4 6 4 8 2;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4) | fields - _time data | eval post1=if( post1 > pre1,mvappend(post1,"RED"),post1) | eval post2=if( post2 > pre2,mvappend(post2,"RED"),post2) |table pre1 post1 pre2 post2 </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="post1"> <colorPalette type="expression">if(match(value,"RED"),"#FF0000", "#65A637")</colorPalette> </format> <format type="color" field="post2"> <colorPalette type="expression">if(match(value,"RED"),"#FF0000","#65A637")</colorPalette> </format> </table> </panel> </row> </dashboard>
... View more
04-06-2021
02:07 PM
This is a very smart idea. But it's not what I want. I just want to post columns have red/green colors, but not compare every column. And the colors names cannot show up with the data.
... View more
04-06-2021
12:37 PM
Is there a way to get field's background color by compare with 2 fields numbers? for example: If "POST IPTV CALLS"'s value > "PRE IPTV CALLS"'s value, then its background become in red. As I know JS can do it, but somehow we need to keep the dashboard as Simple XML. Any idea?
... View more
Labels
- Labels:
-
table
03-26-2021
11:40 AM
I have a big table which is not easy to group on visualizations. Can I make each 2 columns as same color group so that can see them together immediately. For example:
... View more
Labels
- Labels:
-
table
08-14-2020
07:00 AM
is there any solution can automatically export reports to csv file and forward the files to third-party systems not by email?
... View more
- Tags:
- export
12-03-2019
07:00 AM
Thanks, it works for me.
... View more
11-28-2019
11:44 AM
I have the following fields: x, value, I want to get number that count by value of x.
for example : 267 is the smallest value of 101L1, then the number should be 1, the next one 268 is 2...
x value number
101L1 267 1
101L1 268 2
101L1 269 3
101L1 270 4
101L1 271 5
101L1 272 6
101L1 273 7
101L1 274 8
101L1 275 9
101L1 276 10
101L1 277 11
101L1 278 12
101L1 279 13
101L1 280 14
101L1 281 15
101L2 28 1
101L2 29 2
101L2 30 3
101L2 31 4
101L2 32 5
101L3 27.3 1
101L3 27.4 2
101L3 27.5 3
101L3 27.6 4
101L3 27.7 5
101L3 27.8 6
... View more
11-21-2019
07:29 AM
Hello,
I have a query to get the following lines:
element ID value temp (wanted)
ABC 1 false "false false false true true false"
ABC 4 true "false false false true true false"
ABC 2 false "false false false true true false"
ABC 3 false "false false false true true false"
ABC 5 true "false false false true true false"
ABC 6 false "false false false true true false"
Sort by ID and get their values list "false false false true true false" to a variable .
index="x" sourcetype="y"
| sort 0 element ID
| streamstats list(value) AS temp by element
How can I make the last list "false false false true true false" to temp as above?
Thanks
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-11-2024
05:21 PM
|
