Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jenniferhao
jenniferhao
Explorer
Member since:
12-11-2017
06-13-2022
Community Statistics
| Posts | 43 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 12-11-2017 |
Activity Feed
- Karma Re: check log file was not updated for more than 5 mins for PickleRick. 06-13-2022 10:28 AM
- Posted Re: check log file was not updated for more than 5 mins on Monitoring Splunk. 06-13-2022 05:16 AM
- Posted Why check log file was not updated for more than 5 mins? on Monitoring Splunk. 06-09-2022 01:14 PM
- Posted How to get all values from a XML field? on Splunk Search. 03-03-2022 11:56 AM
- Tagged How to get all values from a XML field? on Splunk Search. 03-03-2022 11:56 AM
- Posted Re: how to deal with the 2 conflict conditions on where on Splunk Search. 07-13-2021 08:02 AM
- Posted how to deal with the 2 conflict conditions on where on Splunk Search. 07-12-2021 02:55 PM
- Posted How to make 2 windows to compare the values in these 2 windows on Splunk Enterprise. 06-21-2021 12:38 PM
- Posted Re: Is there any possible to modify raw data in Splunk on Splunk Enterprise. 05-27-2021 01:44 PM
- Posted Is there any possible to modify raw data in Splunk on Splunk Enterprise. 05-27-2021 12:02 PM
- Posted Re: how to clean the splunk alarm? on Splunk Search. 05-18-2021 08:22 AM
- Posted how to clean the splunk alarm? on Splunk Search. 05-18-2021 07:39 AM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-09-2021 02:05 PM
- Posted Re: How can make every 2 columns of table as same colour? on Splunk Search. 04-09-2021 01:47 PM
- Posted Re: How can make every 2 columns of table as same colour? on Splunk Search. 04-07-2021 08:57 AM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-07-2021 07:19 AM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-06-2021 07:12 PM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-06-2021 03:08 PM
- Posted Re: on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-06-2021 02:07 PM
- Posted on Simple XML with colorPalette to select the color by comparing 2 fields numbers on Splunk Search. 04-06-2021 12:37 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-13-2022
05:16 AM
Thanks for helping, this works.
... View more
06-09-2022
01:14 PM
I have a log file which should be updated in every min, but some time service hung, so the file cannot get update. Need to send an alert: if the file wasn't updated more than 5mins. But tried with the following different ways, the results seems not accurate. Any idea? Thanks.
I did:
index=abcapp source=abc.log" | sort _time |streamstats window=2 range(_time) as timediff |table timediff _time |eval alert=if(timediff>=5,1,0) |where alert=1
OR index=abcapp source="abc.log" | sort _time | delta _time as timediff | eval alert = if(timediff>5,1,0) |where alert =1
OR index=abcapp source="abc.log" earliest=-5m latest=now |stats count as num | eval alert = if(num=0,1,0) |where alert =1
... View more
- Tags:
- log
- monitoring
Labels
- Labels:
-
search head
-
splunkd
03-03-2022
11:56 AM
I have a xml _raw="2022-03-02 21:22:39.417 [MESSAGE] [default-threads - 8] [re_messages] - <?xml version="1.0" encoding="UTF-8"?><al:EnvEventDatagram xmlns:mex="http://xxxx" xmlns:bdm="http://xxxx" xmlns:al="http://xxxx" xmlns:xsi="http://www.w3.org/xxxx" xsi:schemaLocation="http://xxxx.xsd"><mex:ManagedApp><mex:IssuerId>com1</mex:IssuerId><mex:Code>abc</mex:Code><mex:DeployedUnitId>123</mex:DeployedUnitId><mex:DxmVersion>1.10</mex:DxmVersion></mex:ManagedApp><mex:ID>456</mex:ID><mex:AID>1</mex:AID><al:SvcEventDatagram><mex:MessageID>aaa</mex:MessageID><al:Alert><al:DA><al:ASQ><al:IssuerId>bbb</al:IssuerId><al:Value>ccc</al:Value></al:ASQ><al:CU><bdm:B><bdm:IssuerId>888</bdm:IssuerId><bdm:Value>ddd</bdm:Value></bdm:B></al:CU><al:YYY><al:LLL>89</al:LLL><al:BNum>28</al:BNum><al:NUM>6</al:NUM></al:YYY><al:FAUTQ><al:Value>vvv</al:Value></al:FAUTQ><al:BA><bdm:TypeQcd><bdm:IssuerId>kkk</bdm:IssuerId><bdm:Value>ABC</bdm:Value></bdm:TypeQcd><bdm:Ccyamt><bdm:MM>88</bdm:MM></bdm:Ccyamt></al:BA><al:BA><bdm:TypeQcd><bdm:IssuerId>abc</bdm:IssuerId><bdm:Value>NNN</bdm:Value></bdm:TypeQcd><bdm:Ccyamt><bdm:MM>22</bdm:MM></bdm:Ccyamt><al:ReasonQcd><al:IssuerId>vvv</al:IssuerId><al:Value>FF</al:Value></al:ReasonQcd></al:BA><al:DATypeQcd><al:Value>mmm</al:Value></al:DATypeQcd><al:OverLimitInd>ii</al:OverLimitInd><al:Qcd><al:Value>N/A</al:Value></al:Qcd></al:DA><al:QQQ><bdm:DescriptionTxt><bdm:Text>HH</bdm:Text></bdm:DescriptionTxt><bdm:StartDttm>2022-03-02</bdm:StartDttm><bdm:ATQ><bdm:IssuerId>77</bdm:IssuerId><bdm:Value>TTT</bdm:Value></bdm:ATQ><bdm:Status><bdm:TypeQcd><bdm:IssuerId>55</bdm:IssuerId><bdm:Value>PPP</bdm:Value></bdm:TypeQcd></bdm:Status><bdm:Ccyamt><bdm:MM>12</bdm:MM></bdm:Ccyamt><bdm:DebitCreditQcd><bdm:IssuerId>AAA</bdm:IssuerId><bdm:Value>GGG</bdm:Value></bdm:DebitCreditQcd><al:TED>2022-03-02</al:TED><al:ProcessDt>2022-03-02</al:ProcessDt></al:QQQ></al:Alert></al:SvcEventDatagram></al:EnvEventDatagram>"
any way can get all <bdm:Value>'s vallues(ddd, ABC etc.) by regex?
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
07-13-2021
08:02 AM
Thanks. The problem becomes how can get a list values with the condition? for example, I need to get some values lists where alarm=1, but I also need to deal with alarm=0 | where alarm=1 OR alarm=0 |eventstats list(create_session) as create_session list(Dn) as Dns by _time //ONLY alarm==1 |evenststa list (IPs) as IPs by _time //ONLY alarm==0 |table IPs create_session DNs
... View more
07-12-2021
02:55 PM
I have a query to send an alert, which have 2 conflict conditions: |where alarm=1 generate some sum information only for alarm happens |where alarm=0 do something for cleaning the alarm |table * But I only can do one of them, If I put where alarm=1 first, then I only can generate the alarm, otherwise, only can do clean alarm. If I put where alarm=1 OR alarm=0, it cannot generate some sum information for the alarm data. For example |eventstats list(x) etc. Any suggestion? Thanks in advance.
... View more
Labels
- Labels:
-
stats
06-21-2021
12:38 PM
We need to set up a dynamic thresholds to compare the values on current week with the week before, should generate alarm when the value out of the range of + - 5%. Do you have any idea to do this more effective? for example: index="abc" sourcetype="def" earliest=-12h latest=now |bucket _time span=15m stats max(x1) as x1 max(y1) as y1 by _time [search index="abc" sourcetype="def" earliest=-24h latest=-12h |bucket _time span=15m stats max(x2) as x2 max(y2) as y2 by _time |eval alarm=if ((x1-x2)/x2 >=abs(0.5) OR (y1-y2)/y2>=abs(0.5),1,0)
... View more
- Tags:
- 2 windows
Labels
- Labels:
-
using Splunk Enterprise
05-27-2021
01:44 PM
Thanks. But the issue not all of "SMT" in April was wrong. Only part of them need to be update. Anyway, thanks for your reply.
... View more
05-27-2021
12:02 PM
hello, we have some raw data with one field wrong from April. But we cannot reload data from the source. Is there any way that we can modify only one field? for example: _time id name value: 20210406 1 "SMT" 60 to be 20210406 1 "Node" 60 20210416 100 "SMT" 80 to be 20210416 100 "Node" 80
... View more
- Tags:
- raw data
Labels
- Labels:
-
using Splunk Enterprise
05-18-2021
08:22 AM
Sorry, maybe I'm not descript clearly. The issue is if alarm happens in 5 mins before, then I need to test the threshold. If condition match then sent a clear alarm out, otherwise, I don't need to do anything.
... View more
05-18-2021
07:39 AM
Hello, expert, I set up an alarm as following, and run it as cronjob by 5mins. Do you have any idea on clean the alarm only after the alarm occurs to avoid sending alert every 5mins in normal situation? | eval alarm = if(value >= alarmTheashold,1,0) //if alarm==1, then tag=1 | eval clear = if(value < alarmTheashold,1,0) // clear=1 when value<alarmTheashold AND tag==1
... View more
Labels
- Labels:
-
eval
04-09-2021
02:05 PM
I tested same above code on different browsers and got same result. But when I tested with different Splunk versions and got the different results. Tested it on V7.3.3 and V8.1.2. The results are wrong which display the number with "RED". ONLY on Splunk V8.1.3. I got the correct result. Thank for help.
... View more
04-09-2021
01:47 PM
I tested it on the last Splunk(8.1.3). It works well. But our PROD version is Splunk Enterprise Version:7.3.3Build:7af3758d0d5e. But it doesn't work at all. Anyway thanks for help.
... View more
04-07-2021
08:57 AM
Sorry for reply late. I did the testing but it seems not working. <dashboard> <row> <panel depends="$stayhidden$"> <html> <style> #tableColumnPairs th:nth-child(4n+0), #tableColumnPairs td:nth-child(4n+0), #tableColumnPairs th:nth-child(4n+1), #tableColumnPairs td:nth-child(4n+1){ background: #cc0000 !important; } #tableColumnPairs th:nth-child(4n+2), #tableColumnPairs td:nth-child(4n+2), #tableColumnPairs th:nth-child(4n+3), #tableColumnPairs td:nth-child(4n+3){ background: #cc0000 !important; } </style> </html> </panel> <panel> <table id="tableColumnPairs"> <title>Table with Value and Color Combined </title> <search> <query>| makeresults | eval data= "C1 1 2 10 20 5 2 12 9 33 1 14 5;C2 3 2 5 4 11 2 32 5 44 1 88 2;C3 5 4 5 3 6 8 12 9 18 3 7 2;C4 6 4 8 2 77 5 45 3 12 5 87 9;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4),pre3=mvindex(data,5), post3=mvindex(data,6),pre4=mvindex(data,7), post4=mvindex(data,8),pre5=mvindex(data,9), post5=mvindex(data,10),pre6=mvindex(data,11), post6=mvindex(data,12) | fields - _time data |table pre1 post1 pre2 post2 pre3 post3 pre4 post4 pre5 post5 pre6 post6 </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard><dashboard> <row> <panel depends="$stayhidden$"> <html> <style> #tableColumnPairs th:nth-child(4n+0), #tableColumnPairs td:nth-child(4n+0), #tableColumnPairs th:nth-child(4n+1), #tableColumnPairs td:nth-child(4n+1){ background: #cc0000 !important; } #tableColumnPairs th:nth-child(4n+2), #tableColumnPairs td:nth-child(4n+2), #tableColumnPairs th:nth-child(4n+3), #tableColumnPairs td:nth-child(4n+3){ background: #cc0000 !important; } </style> </html> </panel> <panel> <table id="tableColumnPairs"> <title>Table with Value and Color Combined </title> <search> <query>| makeresults | eval data= "C1 1 2 10 20 5 2 12 9 33 1 14 5;C2 3 2 5 4 11 2 32 5 44 1 88 2;C3 5 4 5 3 6 8 12 9 18 3 7 2;C4 6 4 8 2 77 5 45 3 12 5 87 9;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4),pre3=mvindex(data,5), post3=mvindex(data,6),pre4=mvindex(data,7), post4=mvindex(data,8),pre5=mvindex(data,9), post5=mvindex(data,10),pre6=mvindex(data,11), post6=mvindex(data,12) | fields - _time data |table pre1 post1 pre2 post2 pre3 post3 pre4 post4 pre5 post5 pre6 post6 </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>
... View more
04-07-2021
07:19 AM
<dashboard> <row> <panel> <title>Only SimpleXML no JS required</title> <html> <style> #tableWitColor table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableWitColor"> <title>Table with Value and Color Combined (With Simple XML Color Palette Expression)</title> <search> <query>| makeresults | eval data= "C1 1 2 10 20;C2 3 2 5 4;C3 5 4 5 3;C4 6 4 8 2;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4) | fields - _time data | eval post1=if( post1 > pre1,mvappend(post1,"RED"),post1) | eval post2=if( post2 > pre2,mvappend(post2,"RED"),post2) |table pre1 post1 pre2 post2 </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="post1"> <colorPalette type="expression">if(match(value,"RED"),"#FF0000", "#65A637")</colorPalette> </format> <format type="color" field="post2"> <colorPalette type="expression">if(match(value,"RED"),"#FF0000","#65A637")</colorPalette> </format> </table> </panel> </row> </dashboard> You can see the "RED" still on the table.
... View more
04-06-2021
07:12 PM
A good catch. But it doesn't work. The "RED" still shows up.
... View more
04-06-2021
03:08 PM
The display:none; for data-mv-index="1" doesn't stop the color name being shown. See below: <dashboard> <row> <panel> <title>Only SimpleXML no JS required</title> <html> <style> #tableRowColorWithoutJS table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableWitColor"> <title>Table with Value and Color Combined (With Simple XML Color Palette Expression)</title> <search> <query>| makeresults | eval data= "C1 1 2 10 20;C2 3 2 5 4;C3 5 4 5 3;C4 6 4 8 2;" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval Client=mvindex(data,0), pre1=mvindex(data,1), post1=mvindex(data,2), pre2=mvindex(data,3), post2=mvindex(data,4) | fields - _time data | eval post1=if( post1 > pre1,mvappend(post1,"RED"),post1) | eval post2=if( post2 > pre2,mvappend(post2,"RED"),post2) |table pre1 post1 pre2 post2 </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="post1"> <colorPalette type="expression">if(match(value,"RED"),"#FF0000", "#65A637")</colorPalette> </format> <format type="color" field="post2"> <colorPalette type="expression">if(match(value,"RED"),"#FF0000","#65A637")</colorPalette> </format> </table> </panel> </row> </dashboard>
... View more
04-06-2021
02:07 PM
This is a very smart idea. But it's not what I want. I just want to post columns have red/green colors, but not compare every column. And the colors names cannot show up with the data.
... View more
04-06-2021
12:37 PM
Is there a way to get field's background color by compare with 2 fields numbers? for example: If "POST IPTV CALLS"'s value > "PRE IPTV CALLS"'s value, then its background become in red. As I know JS can do it, but somehow we need to keep the dashboard as Simple XML. Any idea?
... View more
Labels
- Labels:
-
table
03-26-2021
11:40 AM
I have a big table which is not easy to group on visualizations. Can I make each 2 columns as same color group so that can see them together immediately. For example:
... View more
Labels
- Labels:
-
table
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-13-2022
06:23 PM
|
