About jenniferhao

inventsekar · ‎01-11-2024

Hi @jenniferhao .. i am not much sure of whether two windows or one window, but lets do troubleshooting... could you pls update us what output you get.. from the results, you can decide about next steps.. thanks. | mstats count(os.cpu.pct.used) as c where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) by host_ip | join host type=left [| mstats avg(ps_metric.pctMEM) as avg_mem_java avg(ps_metric.pctCPU) as avg_cpu_java count(ps_metric.pctMEM) as ct_java_proc where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) sourcetype=ps_metric COMMAND=java by host host_ip COMMAND USER ] ```| fields - c commenting the above fields command for a testing``` | eval is_java_running = if(ct_java_proc>0, 1, 0)

fabiofox · ‎03-09-2023

what a trick! this is insane. Thank you so much!

jenniferhao · ‎06-13-2022

Thanks for helping, this works.

PickleRick · ‎03-05-2022

Values in that field could include (properly escaped) angle braces. So you'd have to either: 1) make sure that there aren't such cases 2) account for such cases in your regex 3) use spath instead of raw regex matching

jenniferhao · ‎07-13-2021

Thanks. The problem becomes how can get a list values with the condition? for example, I need to get some values lists where alarm=1, but I also need to deal with alarm=0 | where alarm=1 OR alarm=0 |eventstats list(create_session) as create_session list(Dn) as Dns by _time //ONLY alarm==1 |evenststa list (IPs) as IPs by _time //ONLY alarm==0 |table IPs create_session DNs

ITWhisperer · ‎06-21-2021

Assuming you mean to append the second search, this doesn't work anyway since each event will have a different time so x1 and x2 (and y1 and y2) will exist in different events and therefore you can't do calculations on them. You need to arrange it so that the events from both searches have a common value so you can gather the stats into the same event. Also, the timeframes you have used don't bear any relation to the requirement of comparing this week to the previous week.

jenniferhao · ‎05-27-2021

Thanks. But the issue not all of "SMT" in April was wrong. Only part of them need to be update. Anyway, thanks for your reply.

jenniferhao · ‎05-18-2021

Sorry, maybe I'm not descript clearly. The issue is if alarm happens in 5 mins before, then I need to test the threshold. If condition match then sent a clear alarm out, otherwise, I don't need to do anything.

ITWhisperer · ‎04-11-2021

Hi @jenniferhao It looks like 7.3.3 handles the hidden html slightly differently, so just add an empty div block to the html so it gets passed for rendering <html> <div/> <style> #tableCellColourWithoutJS table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html>

ITWhisperer · ‎04-09-2021

I don't have that build available (at the moment) but my guess would be that the HTML is constructed differently, perhaps the id is not passed in the same way or the table is built differently. If you can inspect the page, perhaps we can work out a fix or you upgrade production 🙂

richgalloway · ‎08-14-2020

The report can output its results to a CSV file using the outputcsv command, but Splunk will not automatically transfer that file to another system. You'll have to do the transfer using another method, such as scp within a cron job.

jenniferhao · ‎12-03-2019

Thanks, it works for me.

mayurr98 · ‎11-21-2019

try this: index="x" sourcetype="y" | sort 0 element ID | eventstats list(value) AS temp by element

jenniferhao · ‎11-14-2019

Is it any way in Splunk to do the for loop nesting. Above requirement likes: for raw in (raw1, raw2, raw3, raw4): for rule in (rule1,rule2,rule3,rule4,rule5,rule6): query(raw,rule)

jenniferhao · ‎08-22-2019

To provide further feedback to my original question. I need to create a Time chart type diagram i have various KPI's for 1 type of metric i want stacked. and then another type metric stacked beside it. but for 2 fields side by side are not stacked. similar to the image below.

kmorris_splunk · ‎08-13-2019

You could use the following syntax to count each (AAA, BBB, or CCC) then do any math you want using those counts. YOUR BASE SEARCH | stats count(eval(exception="AAA")) as aaacount count(eval(exception="BBB")) as bbbcount count(eval(exception="CCC")) as ccccount

somesoni2 · ‎06-18-2018

What kind of Splunk job are you running?

Richfez · ‎03-11-2018

I think valiquet's on the right track for finding out exactly what's going on. If you are Chrome, use a new Incognito window. For Firefox, use a Private window. Or switch that if I got them backwards. 🙂 Then log in, go to the same places as before, do the export and see how it behaves. Report back!

p_gurav · ‎01-22-2018

Hi, Did you search index=_internal logs for that client?

damien_chillet · ‎12-15-2017

Managed to get results using the following script: #!/bin/bash myquery='search index=_internal component=* earliest=-7d | stats sum(cpu_seconds) by component | fields * | fillnull' curl -k -u user:pass https://localhost:8089/services/search/jobs/export --data-urlencode "search=${myquery}" -d output_mode=csv -o res.csv

splunkyouverymu · ‎08-22-2018

I've created a help thread for this error in Splunk 7

Posts	44
Solutions	0
Karma Given	4
Karma Received	1
Member Since	‎12-11-2017

Online Status	Offline
Date Last Visited	‎01-11-2024 05:21 PM

we need to setup alert for montoring java processe...

Why check log file was not updated for more than 5...

How to get all values from a XML field?

how to deal with the 2 conflict conditions on wher...

How to make 2 windows to compare the values in the...

Is there any possible to modify raw data in Splunk

how to clean the splunk alarm?

on Simple XML with colorPalette to select the colo...

How can make every 2 columns of table as same colo...

Is there a way to export Splunk reports to csv fil...

Re: we need to setup alert for montoring java proc...

Re: How to transpose some rows to columns?

Re: check log file was not updated for more than 5...

Re: How to get all values from a xml field

Re: how to deal with the 2 conflict conditions on ...

Re: How to make 2 windows to compare the values in...

Re: Is there any possible to modify raw data in Sp...

Re: how to clean the splunk alarm?

Re: on Simple XML with colorPalette to select the ...

Re: How can make every 2 columns of table as same ...

Re: Is there a way to export Splunk reports to csv...

Re: how to get count numbers based on the values

Re: How to combine information to a list

Re: Can Splunk share memory data to different quer...

Re: How to create a column chart with line chart

Re: How to count pass of fail rate from all if con...

Re: any solution on splunk work with cron jobs wit...

Re: export csv GUI mess up

Re: How to get the job's log file from client by R...

Re: "ERROR" Search Factory: Unknown search comman...

Re: ERROR DispatchThread - Error reading runtime s...

Join the Conversation