About tkwaller_2

tkwaller_2

Hello I have 2 searches that i want to do math on the results. Each search looks for a specific string and dedups based on an id. The first search: index=anon_index source="*source.log" "call to ODM at */file_routing" | dedup MSGID | stats count the second search: index=anon_index source="*source.log" "message was published to * successfully" | dedup MSGID | append [search index="index2" "ROUTING failed. Result sent to * response queue tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log | dedup MSGID] | stats count What I'd like to be able to do is take the results from the first set and subtract the second. for example if the first set was 1000 and the second was 500 I'd like to be able to show the difference. At some point I'd like to be able to show the id's that were in the first set that were not in the second and show that in a panel. Thanks for the assistance!

tkwaller_2 · ‎12-20-2018

I figured this out. What I did was have the search for the dropdown break apart the mv field. Then dedup and table the value. Then I had the prefix "* and a suffix of *" added to the value. Then in the search I added Tags=$tag_tok$ so the wildcarded value returns all results.

tkwaller_2 · ‎12-19-2018

Hello I have a Pivot report that contains a multivalue field called Tags. I have created a dropdown selector that uses mvindex to separate the values of the field. What I would like to do is be able to have the report display results based on the value of the dropwdown selection BUT the problem is that if I dont use the multivalues in the dropdown I cant get the results since they dont match. Currently my pivot looks like this: | pivot trackerv2 trackerv2 values(WorkflowStep01) AS "WorkflowStep01" values(WorkflowStep001) AS "WorkflowStep001" values(WorkflowStep002) AS "WorkflowStep002" values(WorkflowStep02) AS "WorkflowStep02" values(WorkflowStep003) AS "WorkflowStep003" values(WorkflowStep03) AS "WorkflowStep03" values(WorkflowStep004) AS "WorkflowStep004" values(WorkflowStep04) AS "WorkflowStep04" values(WorkflowStep005) AS "WorkflowStep005" values(WorkflowStep05) AS "WorkflowStep05" values(WorkflowStep006) AS "WorkflowStep006" values(WorkflowStep06) AS "WorkflowStep06" values(WorkflowStep07) AS "WorkflowStep07" values(WorkflowStep08) AS "WorkflowStep08" values(WorkflowStep09) AS "WorkflowStep09" values(SIGFINAL) AS "SIGFINAL" values(SECSUPPFINAL) AS "SECSUPPFINAL" SPLITROW ID AS ID SPLITROW Name AS Name SPLITROW Type AS Type SPLITROW LOB AS LOB SPLITROW TechDept AS TechDept SPLITROW OperatingCo AS OperatingCo SPLITROW AssessmentPurpose AS AssessmentPurpose SPLITROW AssignedToUser AS AssignedToUser SPLITROW Status AS Status SPLITROW CurrentWorkflowStep AS CurrentWorkflowStep SPLITROW NextResponsibleParty AS NextResponsibleParty SPLITROW DueDate-pendingaction AS "DueDate-pendingaction" SPLITROW DateEstCompleted AS DateEstCompleted SPLITROW ActualCompletionDate AS ActualCompletionDate SPLITROW Notes AS Notes SPLITROW LastUpdated AS LastUpdated SPLITROW Tags AS Tags SORT 100000 ID ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 |search Tags=$tag_tok$ So a sample value of the Tags field would be like: LEGAL, PILOT, Findings The dropdown has single values of: ALL LEGAL PILOT Findings but if I choose anything other than ALL I get nothing because the single values dont match the multivalues within the Tags field. How can I make the values match without having the dropdown be multivalued? Something similar to(I know this isnt right): |search Tags=if(like('Tags', "%$tag_tok$%"), 'Tags', "")

tkwaller_2 · ‎12-19-2018

Hello I will mark your comment as the answer, Im sure its something thats caused by us and not Splunk. Not sure why though. It still deletes all apps that arent deployed via the deployment server, including the default apps. This may not work for my sue case but I thought it would so it was worth trying. Thanks for the assistance

tkwaller_2 · ‎12-06-2018

Hello and thanks for the response. I understand how clusters work and have worked with very large cluster of search heads as well as indexers, of 100+ cluster members. I am however trying to get something else working. For this use case we have a standalone search head that we develop things on and we migrate that manually to a standalone search head prod environment. I would like to do this as a deployment push from a deployment server to the prod environment so it doesn't have to be manually touched. Users wont be able to edit any of the searches behind any of the dashboards they will have access to so things wont change unless changed by an admin and pushed out. The problem is that, when in the dev env, I add the non-default apps to the deployment server and push the apps out the default apps are removed, like the search app. Not sure why though. Thanks Todd

tkwaller_2 · ‎11-27-2018

Hello I have a single search head that uses 2 indexers as peers, I want to make the search head a deployment client since this environment will not grow. I moved the non-default apps out of the SPLUNKHOME/apps/ directory. Leaving the default apps(with some customizations, like knowledge objects in the search app). When I move the non-default apps to the deployment server and have the search head connect and download the apps, all the default apps are overwritten. How can I accomplish this task without overwriting the default apps? Is this possible? I know I could probably create a a few more SH's and then cluster them and give them a master but that kinda defeats what I am trying to do, as I have several small environments I'd like to do this to with a single deployment server. Essentially, several small environments that I only want to update the SH instance's app's from a single deployment server that uses seperate serverclasses depending on env. Thanks for the thoughts!

tkwaller_2 · ‎11-08-2018

HttpListener - Socket error from while accessing /services/streams/search: Broken pipe? Here's my ulimit info ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 31866 max locked memory (kbytes, -l) 64 max memory size (kbytes, -m) unlimited open files (-n) 10240 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 31866 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited Please help!

tkwaller_2 · ‎11-08-2018

Going to answer my own question: you cannot add an image/logo to a normal report

tkwaller_2 · ‎11-07-2018

Hello Looking for a way to add an image to a report. This report is not scheduled or on a dashboard. Meaning, in my nav menu I select Reports and then chose a report and then the report view is displayed. I have added logos to dashboards and to exports/emails but haven't found a way to get it on a simple report. Thanks for the assistance!

tkwaller_2 · ‎11-07-2018

I'll wait one more day and then take this down, since no answers

tkwaller_2 · ‎10-11-2018

SO I understand WHY I get the results I get but I am having a difficult time, most likely due to me, getting the results I want. So heres whats happening, I have a search that returns survey data. Each record returned has a bunch of data including a single QuestionID and QuestionAnswer. 1 question and answer per record. Most surveys have around 30 or so questions so 30 or so records per survey. I join in some other data to this. I get a table like this rrname md_id data_det_q1 data_det_q2 data_det_q3 PII QuestionID QuestionAnswer count Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR01 Temp Name, Inc Internal 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR01a ['Other (please describe in Additional Comments below)'] 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR01b 1- 10,000 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR01c Daily 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR02 Temp Name, Inc Internal 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR02a ['Other (please describe in Additional Comments below)'] 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR02b 1- 10,000 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR02c Daily 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR03 Yes 1 Temp Name, Inc. Not Found 07/24/2018 0000-0003-3609 TRUE TRUE TRUE FALSE RR04 Yes 0 I want to view this data horizontally in columns so I put it into pivot. So instead I get one row of all data split columns by QuestionID and column values of QuestionAnswer so I get a pivot table like(this is 1 row of the table): RR_Submission ID Created_By Created_On_Behalf_Of Temp Name_LOB Temp Name_Division Temp Name_Operating_Company Risk_Determination_Qu_1 Risk_Determination_Qu_2 Risk_Determination_Qu_3 Temp Name_Enterprise_Architect_Primary_Contact Temp Name_IT_Demand_Primary_Contact Temp Name_Procurement_Primary_Contact Temp Name_Project_Manager_Primary_Contact Temp Name_Security_Ambassador _Suite_Contract_ID Suite_Vendor Other_Contact_1 Other_Contact_2 Other_Contact_3 Other_Vendors Primary_Vendor_Contact_Email Primary_Vendor_Contact_Name Primary_Vendor_Contact_Phone Risk_Rank_Submit_Status Secondary_Vendor_Contact_Email Secondary_Vendor_Contact_Name Secondary_Vendor_Contact_Phone RR01 RR01a RR01b RR01c RR02 RR02a RR02b RR02c RR03 RR04 RR05 RR06 RR07 RR08 RR08a RR08b RR08c RR09 RR10 RR10a RR11 RR12 RR13 RR13a RR13b RR14 RR15 RR16 RR17 RR18 RR19 RR20 RR21 Temp Name, Inc 06/21/2018 0000-0000-1904 tasfasdf@srg.com NA NA NA NA FALSE TRUE FALSE NA NA Todd Peterman NA NA NA NA NA NA NA EPRI gsergfsdft@srr.com Ben Jammin Phillips 555-555-2728 Complete NA NA NA Temp Name Internal ['Other (please describe in Additional Comments below)'] 1- 10,000 Monthly Temp Name Internal ['Other (please describe in Additional Comments below)'] 10,001 - 100,000 Monthly Yes No Yes No No No N/A No > $1,000,000 No No Less than 4 Weeks No No No No 3-Jan 51% - 100% 1 Year - 5 Years there are 2 fields I need to add to this table but when I do I get duplicate records because of how the data works. I have 2 fields Inbound and Outbound that are Inbound = if (QuestionID = RR01a and QuestionAnswer="*PII*" ) then list the QuestionAnswer Outbound if(QuestionID = RR02a and QuestionAnswer="*PII*") then list the QuestionAnswer So what happens is all the surveys that dont have either one of those = true I get one line like I want but where those fields DO = an answer like PII I get 3 records: 1 record for Inbound, One record for Outbound and 1 record for the rest of the survey results. Heres an example: RR_Submission rg_Risk_Rank Created_By Created_On_Behalf_Of AllTempiD_LOB AllTempiD_Division AllTempiD_Operating_Company Risk_Determination_Qu_1 Risk_Determination_Qu_2 Risk_Determination_Qu_3 AllTempiD_Enterprise_Architect_Primary_Contact AllTempiD_IT_Demand_Primary_Contact AllTempiD_Procurement_Primary_Contact AllTempiD_Project_Manager_Primary_Contact Suite_Contract_ID Suite_Vendor Inbound Outbound Other_Contact_1 Other_Contact_2 Other_Contact_3 Other_Vendors Primary_Vendor_Contact_Email Primary_Vendor_Contact_Name Primary_Vendor_Contact_Phone Secondary_Vendor_Contact_Email Secondary_Vendor_Contact_Name Secondary_Vendor_Contact_Phone RR01 RR01a RR01b RR01c RR02 RR02a RR02b RR02c RR03 RR04 RR05 RR06 RR07 RR08 RR08a RR08b RR08c RR09 RR10 RR10a RR11 RR12 RR13 RR13a RR13b RR14 RR15 RR16 RR17 RR18 RR19 RR20 RR21 AllTempiD, Inc. - 9872345 0000-0000-1308 twall@sec.com dbcooper@sec.com BD and Delivery NA NA FALSE TRUE FALSE NA NA Don Johnson John Potts NA NA None None NA NA NA NA joe.frank@sec.com Joe Frank 555-555-2356 NA NA NA AllTempiD Confidential Special Handling 1- 10,000 Daily AllTempiD Confidential Special Handling 1- 10,000 Daily No No No No No No No Mobile Solution Available No > $1,000,000 No No Less than 5 Days Yes Yes No No 10-Apr 51% - 100% 1 Year - 5 Years AllTempiD, Inc. - 9872345 0000-0000-1308 twall@sec.com dbcooper@sec.com BD and Delivery NA NA FALSE TRUE FALSE NA NA Don Johnson John Potts NA NA None ['PII'] NA NA NA NA joe.frank@sec.com Joe Frank 555-555-2356 NA NA NA ['PII'] AllTempiD, Inc. - 9872345 0000-0000-1308 twall@sec.com dbcooper@sec.com BD and Delivery NA NA FALSE TRUE FALSE NA NA Don Johnson John Potts NA NA ['PII'] None NA NA NA NA joe.frank@sec.com Joe Frank 555-555-2356 NA NA NA ['PII'] Any ideas how I can get this to not split the records? I have tried all sorts of things, like a single field with a case statement but the issue is the Inbound/Outbound fields. Thanks!

tkwaller_2 · ‎09-18-2018

yep, edited again and got the results I was looking for, thanks again!

tkwaller_2 · ‎09-18-2018

I tried this but I still get the same results |eval tmpscore=(score * 2) |eval tmpscore=round(tmpscore) |eval "Maturity Level"=((tmpscore/count)/2) I still get values like: 1.3333333333333333 2 2.1666666666666665 1.5 1.625 3 1.75 1.8

tkwaller_2 · ‎09-18-2018

Hello, I have some values that are in the format of : 0, 0.5, 1, 1.5, 2, 2.5, 3, 3.5, 4, 4.5, 5 I am trying to find that average and only want whole and half numbers so nothing like 1.7 only avg's like 1, 2.5, 4, 3.5 etc. I thought maybe if I multiplied by 2 and then divided that by the count and then again in half that would work but its not quite right. |eval tmpscore=(score * 2) |eval "Maturity Level"=round(((tmpscore/count)/2),1) "score" being the sum of all the values of a field Any ideas how I could get this type of rounding to work? Thanks as always

tkwaller_2 · ‎09-14-2018

yep that worked, I just added "|fields Status" and then made it into a single value panel. Thanks for the help!

tkwaller_2 · ‎09-13-2018

Hello, I have a search that joins together data. The search works great, but the results that Im trying to get are proving a bit tricky. index=tsv |rename BOID AS id |dedup SurveyInstanceID QuestionID QuestionText QuestionAnswer QuestionAnswerWeight |join id [`init(assessments)` |rename info_name as assessmentName |dedup assessmentName |`fp_mvexpand(related_vendors)` |eval RV = mvindex(related_vendors,0) ] |join RV [ `init(vendors)` |rename id as RV info_name as Vendor |dedup Vendor] | search Vendor=$vendor$ |streamstats count(QuestionID) by SectionTitle |rename count(QuestionID) as total | eval "Section Status"=case(SectionTitle == "1.1" AND total == "3", "Completed", SectionTitle == "1.2 " AND total == "4", "Completed", SectionTitle == "1.3" AND total == "3", "Completed", true(), "Incomplete") |rename total as "Questions Answered" SectionTitle as "Section Title" The goal is that if "Section Status" == "Incomplete" AT ALL, return "Incomplete" otherwise its "Complete" . This causes every record to be evaluated which is not what Im trying to get. I only need it to return a single result. So if lets say SectionTitle == "1.1" AND total == "3" SectionTitle == "1.2 " AND total == "2" SectionTitle == "1.3" AND total == "3" The result would be "Incomplete" I plan on making this a single value panel on a dashboard Thanks for the assistance

tkwaller_2 · ‎09-07-2018

Hello So I have data in TSV format that I am indexing. Some of the fields are arrays in the format of ['23458567','234523456978090','234568957078654'] if the array is empty its simply filled with []. When we do searches we have to join tables and so some searches contain several joins to follow id's through the data flow. These ids are in the array format above and we sed out the single quotes, and the brackets, to get just values the mvexpand and join. The problem I have is that when we do the sed, it removes the records that contain the empty array value [] but those are valid values as well. I was trying to do a conditional eval with a macro but that won't work or is not valid. Something like: |eval RS=if(related_vendors == "[]", "[]", `fp_mvexpand(related_vendors)`) This is what the macro does: rex mode=sed field="$arg1$" "s/[][]//g" | rex mode=sed field="$arg1$" "s/'//g" | makemv delim="," $arg1$ We do this so we can join on the array values like: |`init("assessments")` | fields id,info_subType,related_vendors,info_severity | dedup id | `fp_mvexpand(related_vendors)` | eval RV = mvindex(related_vendors,0) |join type=left RV [ `init("vendors")` |fields id infor_name |rename id as RV info_name as Vendor| fillnull value="none" Vendor| dedup Vendor] | stats count(Vendor) by info_subType In this example, related_vendors in the the assessments table is the same as the id in the vendors table. So we strip out the brackets and single quotes and mvexpand, then mvindex and join to vendors But I don't get records where related_vendors = [] , and I assume it's because we stripped out the [] . Any thoughts on how I could accomplish this? Thanks for all the help everyone!

tkwaller_2 · ‎08-29-2018

Found the issue. Well issues: If the search takes to long the sendemail will fail with this error The "Send emails as" field in the request sent to the relay server requires domain name to be within my domain. For example if my domain is google.com it will only allow emails from senders ending in @google.com Changed from noreply-splunkdev to noreply-splunkdev@gmail.com

tkwaller_2 · ‎08-29-2018

I am getting an error after settign up email alerting The error I get is: 08-29-2018 15:33:19.626 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://ourdomain.com/app/ourapp/@go?sid=scheduler__twaller__ourapp__ABC5980879bd671d6025_at_1535556780_96501" "ssname=Todds Test Email" "graceful=True" "trigger_time=1535556798" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__twaller__ourapp__ABC5980879bd671d6025_at_1535556780_96501/results.csv.gz"': ERROR:root:Connection unexpectedly closed while sending mail to: me@gmail.com My email settings are: Mail Server Settings Mail host smtp-relay.gmail.com:465 Email security =Enable SSL No username/pass Link hostname https://ourdomain.com Send emails as MyCompany Any ideas why I might be getting these errors about the closing connection? I get the same when searching and using sendemail like: index=main | head 5 | sendemail to=me@gmail.com server=smtp-relay.gmail.com:465 subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=raw sendpdf=true I appreciate the assistance as always

tkwaller_2 · ‎08-28-2018

Hello @DalJeanis my updated search like: index=dev_tsv "BO Type"="assessments" |dedup "Workflow Name" "Workflow Phase" "Workflow Process Due Date" "Workflow Process Name" "Workflow Process Sort Order" "Workflow Started Date" "Workflow Step Name" "Step Due Date" "Workflow Step Sort Order" | table "Workflow Name" "Workflow Phase" "Workflow Process Due Date" "Workflow Process Name" "Workflow Process Sort Order" "Workflow Started Date" "Workflow Step Name" "Step Due Date" "Workflow Step Sort Order" | convert timeformat="%Y-%m-%d %H:%M:%S.%6N" mktime("Step Due Date") AS cumulativeDueDate | eval dueDateRange=mvrange(cumulativeDueDate,now(),86400) | mvexpand dueDateRange | convert ctime(dueDateRange) timeformat="%+" | where NOT match(dueDateRange,"(Sun|Sat).*") AND NOT [ | inputlookup exclude_holidays | eval holiday_date=relative_time(strptime(holiday_date, "%Y-%m-%d %H:%M:%S"),"@d") | rename holiday_date as dueDateRange | eval dueDateRange=strftime(dueDateRange, "%+") ] but it still returns the same results, I still get records with dueDateRange = Wed Jul 4 07:35:35 GMT 2018 when it should be excluded since holiday_date = Wed Jul 4 00:00:00 GMT 2018 I just cant get it to ignore the time within the timestamp

Posts	88
Solutions	7
Karma Given	21
Karma Received	2
Member Since	‎12-22-2017

Online Status	Offline
Date Last Visited	3 weeks ago

Combine results of 2 searches to perform math on r...

Is there a way to conditionally match multivalue f...

How to move single search head to deployment clien...

Why am I getting these socket errors?

How can I add logo to a report?

Any way to combine these records?

How can I round to the nearest half with the eval ...

How can you get a single value based on eval resul...

Could you help me with arrays, expands and joins?

How to determine a sendmail issue?

Combine results of 2 searches to perform math on r...

Re: Is there a way to conditionally match multival...

Is there a way to conditionally match multivalue f...

Re: How to move single search head to deployment c...

Re: How to move single search head to deployment c...

How to move single search head to deployment clien...

Why am I getting these socket errors?

Re: How can I add logo to a report?

How can I add logo to a report?

Re: Any way to combine these records?

Any way to combine these records?

Re: How can I round to the nearest half with the e...

Re: How can I round to the nearest half with the e...

How can I round to the nearest half with the eval ...

Re: How can you get a single value based on eval r...

How can you get a single value based on eval resul...

Could you help me with arrays, expands and joins?

Re: How to determine a sendmail issue?

How to determine a sendmail issue?

Re: How can I get my inputlookup to ignore the tim...