Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About CarmineCalo
CarmineCalo
Path Finder
Member since:
01-04-2018
06-05-2020
Community Statistics
| Posts | 42 |
| Solutions | 1 |
| Karma Given | 6 |
| Karma Received | 4 |
| Member Since | 01-04-2018 |
Activity Feed
- Karma Re: CSV numbers imported as strings... and tonumber() returning null for p_gurav. 06-05-2020 12:49 AM
- Karma Re: Incremental average over the time for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Lookup with variable Output for somesoni2. 06-05-2020 12:49 AM
- Karma Re: Lookup with variable Output for 493669. 06-05-2020 12:49 AM
- Karma Re: How to "join" two different searches with no common fields? for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Converting [h]:mm:ss into hour, minutes and seconds for JordanPeterson. 06-05-2020 12:49 AM
- Got Karma for Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Dashboard - FY18" to PDF.. 06-05-2020 12:49 AM
- Got Karma for Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Dashboard - FY18" to PDF.. 06-05-2020 12:49 AM
- Got Karma for Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Dashboard - FY18" to PDF.. 06-05-2020 12:49 AM
- Got Karma for Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Dashboard - FY18" to PDF.. 06-05-2020 12:49 AM
- Posted Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Dashboard - FY18" to PDF. on Dashboards & Visualizations. 02-22-2018 05:24 AM
- Tagged Bailing out of Integrated PDF Generation. Exception raised while preparing to render "Dashboard - FY18" to PDF. on Dashboards & Visualizations. 02-22-2018 05:24 AM
- Posted Re: Splunk Machine Learning Toolkit(SMLT) - Different predictions algorithms based on same data on All Apps and Add-ons. 02-22-2018 04:04 AM
- Posted Re: Splunk Machine Learning Toolkit(SMLT) - Different predictions algorithms based on same data on All Apps and Add-ons. 02-21-2018 10:49 AM
- Posted Splunk Machine Learning Toolkit(SMLT) - Different predictions algorithms based on same data on All Apps and Add-ons. 02-21-2018 03:09 AM
- Tagged Splunk Machine Learning Toolkit(SMLT) - Different predictions algorithms based on same data on All Apps and Add-ons. 02-21-2018 03:09 AM
- Posted Re: How to calculate the "Moving" sum of the last 52 weeks? on Splunk Search. 01-31-2018 03:58 AM
- Posted How to calculate the "Moving" sum of the last 52 weeks? on Splunk Search. 01-31-2018 12:30 AM
- Posted Re: Duration of a single event on Splunk Search. 01-29-2018 02:21 PM
- Posted Duration of a single event on Splunk Search. 01-29-2018 12:33 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 4 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-22-2018
05:24 AM
4 Karma
Splunkers!
While, trying to export a dashboard into a pdf, i got this error message.
I'm running the dashboard on Splunk 7.0
I understood that I've to update something on pdfgen_endpoint.py, what is not clear to me is how...
Any support?
Tks!
Carmine
... View more
02-22-2018
04:04 AM
Mmm, agree with you.... few data and relation not really clear (i was trying to apply ML to come up with some statistical proven weights to apply to we model we created in a standard way).
Tks!
Carmine
... View more
01-31-2018
03:58 AM
This option works, great 🙂
Tks!
Carmine
... View more
01-24-2018
10:02 PM
hey, you do not need to extract hour minute and sec and write eval for conversion, as there is already a ready-made conversion command called convert . If you do not have field which is in HH:MM:SS format then you can write | eval time=strftime(strptime(time,"%Y/%m/%d %H:%M:%S"),"%H:%M:%S") OR you can use regex which you already have and then write convert command.
Try this run anywhere search
| makeresults
| eval time="14:50:40"
| convert dur2sec(time) as duration
In your environment, you should write
<your_base_search>
| convert dur2sec(time) as duration
For more information, have a look at this doc:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Convert
let me know if it helps!
... View more
01-24-2018
12:28 PM
Great, it works!
The second requirement was related to the need to avoid multivalue fields in the following case
CI ReqWeekAva Cluster_Ava_Code
App1 10 CAC1
App1 40 CAC2
App1 30 CAC3
App1 40 CAC2
I mean avoid output like
App1 40 CAC1
40 CAC1
But your solution it's fine, so no issue 🙂
... View more
01-25-2018
02:48 AM
Awesome to hear that 🙂
... View more
01-19-2018
12:10 AM
I am glad that my solution helped you to get the desired results. I am converting my comment to an answer. Accept/upvote it if this is an answer to your question!
... View more
01-18-2018
10:27 AM
Great! It works now 🙂
... View more
01-18-2018
02:33 AM
1 Karma
yes, so you can write as
your current search giving fields date, AppID, "Availability Cluster"...| lookup lookupfile.csv Date as Date, Cluster as "Availability Cluster" OUTPUTNEW Value
... View more
01-15-2018
06:40 AM
This will give an average of averages, which is probably not really what you want.
... View more
01-15-2018
12:41 AM
Correct, AppIDs and Timerange are in two different tables.
How can i combine the two domains?
I've no clue about the function to be called...
Tks!
Carmine
... View more
01-14-2018
12:45 AM
1 Karma
hey
looking at your comments section you can try
| eval dateyearweek=strftime(_time,"%Y-%U") | stats sum(incident_duration) as Weekly_Inc_duration BY AppID dateyearweek
Depending of your country, you have 2 variations :
%U is replaced by the week number of the year (Sunday as the first day of the week) as a decimal number [00,53].
%V is replaced by the week number of the year (Monday as the first day of the week) as a decimal number [01,53]. If the week containing 1 January has four or more days in the new year, then it is considered week 1. Otherwise, it is the last week of the previous year, and the next week is week 1.
Let me know if this helps!
... View more
01-12-2018
07:34 AM
Great! Glad you got it solved. It's best if you accept your answer so it shows the question as solved. 🙂
... View more
01-09-2018
12:08 AM
Tks for the feedback.
This help, it could be a backup solution in case the layout I'm looking is not possible.
By now thanks!
... View more
01-04-2018
09:12 PM
1 Karma
Hi,
try using convert command with auto() function. Please refer following document:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Convert
... View more
