Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ambujhbti
ambujhbti
New Member
Member since:
06-25-2015
06-05-2020
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-25-2015 |
Activity Feed
- Posted Re: Color in a table based on values on Splunk Search. 07-21-2015 11:45 AM
- Posted Re: Color in a table based on values on Splunk Search. 07-21-2015 11:43 AM
- Posted Re: Color in a table based on values on Splunk Search. 07-21-2015 11:41 AM
- Posted Re: Color in a table based on values on Splunk Search. 07-21-2015 11:28 AM
- Posted Re: Show colors in dashboard based on values. on Dashboards & Visualizations. 07-20-2015 07:51 AM
- Posted Re: Show colors in dashboard based on values. on Dashboards & Visualizations. 07-20-2015 07:48 AM
- Posted Show colors in dashboard based on values. on Dashboards & Visualizations. 07-17-2015 09:30 AM
- Tagged Show colors in dashboard based on values. on Dashboards & Visualizations. 07-17-2015 09:30 AM
- Posted Re: Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-16-2015 08:51 AM
- Posted Re: Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-15-2015 02:26 PM
- Posted Re: Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-15-2015 02:25 PM
- Posted Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-15-2015 02:15 PM
- Tagged Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-15-2015 02:15 PM
- Tagged Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-15-2015 02:15 PM
- Tagged Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-15-2015 02:15 PM
- Tagged Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-15-2015 02:15 PM
- Tagged Why are milliseconds getting padded with multiple zeros when converting timestamps to epoch format to calculate time difference? on Splunk Search. 07-15-2015 02:15 PM
- Posted Re: How to calculate the difference between two time stamps in a single event? on Getting Data In. 07-10-2015 01:56 PM
- Posted Re: How to calculate the difference between two time stamps in a single event? on Getting Data In. 07-10-2015 01:56 PM
- Posted Re: How can I get a list of all hosts plus their sources from Splunk? on Getting Data In. 07-02-2015 10:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-21-2015
11:45 AM
Hello,
One doubt:
in this line of code:
td class="d" field="ScanStatus" data-value="Not up to date">Not up to date
do you mean to say that I can see code like this when I open XML source code of my dashboard? As I didn't find any. It might be possible that I missed this step somewhere? just wanted to let you know.
Thanks!
... View more
07-21-2015
11:28 AM
Hello,
Thank you. your approach is very simple and easy to understand. Although I am facing some trouble here.
I too want to achieve same result as you defined here. I followed below steps.
1- created an App.
2- Updated the .js and .css files in /appserver/static/ folder for my app.
Still I am not able to get the result. I have provided the search & code if you would be kind to look.
search:
host=XXXXX | eval state=case(Event_code=0,"passed",Event_code!=0,"failed") | table host _time state
Still the table cell is white , there is no color, I don't know what I am missing. Can you please tell me? I need to submit my work and I am hitting deal lock every time.
Thank you for you time.
... View more
07-20-2015
07:51 AM
Hello,
Thank you for your guidance.
My purpose is to show the state of Database,possible values are shown below:
DB_Name DBRole State
DB_1 Primary UP(Show this in GREEN color)
DB_2 StandBy UP(Show this in GREEN color)
DB_3 Primary DOWN(Show this in RED color)
DB_4 StandBy DOWN (Show this in RED color)
I think Single Value Visualization works with Numeric values only . I tried to use 0/1 for states in hope of getting colors through Heat Maps but I don't get colors like RED for 1 and White or gray for 0. Any suggestions?
Thank you for your time!
... View more
07-20-2015
07:48 AM
Hello,
Thank you.
My purpose is to show the state of Database,possible values are shown below:
DB_Name DBRole State
DB_1 Primary UP(Show this in GREEN color)
DB_2 StandBy UP(Show this in GREEN color)
DB_3 Primary DOWN(Show this in RED color)
DB_4 StandBy DOWN (Show this in RED color)
I can't make use of CSS as I dont' have access, moreover my team won't give me access since this is just a simple task of changing of color or values.
If you could suggest me any way of doing this using XML, it will really solve my purpose.
Thanks!
... View more
07-17-2015
09:30 AM
Hi All,
I want to show some colors based on values on my dashboard. like below
If count is >100 then i need to show RED color as a status.
If count >70 then i need to show YELLOW color
If count <50 then its green color
I have read some posts and it says about using apps or CSS and .Js files. I don't have access to Splunk app$home or I can't use any app to get this functionality due to restrictions in my team.
My goal is to get this done using Splunk query only or may be changing few lines of code in the underlining XML of the panel.
Can anybody tell me how to achieve it? Any suggestions would really appreciated.
Thank you for your time/help.
... View more
- Tags:
- color
07-16-2015
08:51 AM
Hello Martin,
Thank you so much!
... View more
07-15-2015
02:26 PM
Hello,
One more example
TimeDifference End_time WILY_Date
-.22 07/15/2015 16:21:09:343000000 07/15/2015 16:21:09:560000000
-.65 07/15/2015 16:21:09:299000000 07/15/2015 16:21:09:950000000
-.53 07/15/2015 16:21:08:269000000 07/15/2015 16:21:08:800000000
-.29 07/15/2015 16:21:08:155000000 07/15/2015 16:21:08:440000000
-.3 07/15/2015 16:21:21:550000000 07/15/2015 16:21:21:580000000
-.11 07/15/2015 16:21:21:505000000 07/15/2015 16:21:21:620000000
-.44 07/15/2015 16:21:21:400000000 07/15/2015 16:21:21:840000000
-.63 07/15/2015 16:21:21:347000000 07/15/2015 16:21:21:980000000
Thank you!
... View more
07-15-2015
02:25 PM
Hello ,
I am presenting one more example to show data.
TimeDifference End_time WILY_Date
-.22 07/15/2015 16:21:09:343000000 07/15/2015 16:21:09:560000000
-.65 07/15/2015 16:21:09:299000000 07/15/2015 16:21:09:950000000
-.53 07/15/2015 16:21:08:269000000 07/15/2015 16:21:08:800000000
-.29 07/15/2015 16:21:08:155000000 07/15/2015 16:21:08:440000000
-.3 07/15/2015 16:21:21:550000000 07/15/2015 16:21:21:580000000
-.11 07/15/2015 16:21:21:505000000 07/15/2015 16:21:21:620000000
-.44 07/15/2015 16:21:21:400000000 07/15/2015 16:21:21:840000000
-.63 07/15/2015 16:21:21:347000000 07/15/2015 16:21:21:980000000
Thank you.
... View more
07-15-2015
02:15 PM
Hello ,
I am trying to calculate time diff between two fields in a single event.
My current search:
sourcetype="XXXXXX" host="XXXXXX" |convert timeformat="%m/%d/%Y %H:%M:%S:%N" mktime(End_time)|convert timeformat="%m/%d/%Y %H:%M:%S:%N" mktime(WILY_Date)| eval diff=End_time-WILY_Date| where diff <0| eval eventid=index + "__" + _cd+"__" + splunk_server|table eventid diff End_time WILY_Date
I also tried
sourcetype="XXXXXX" host="XXXXXX" |eval diff= strptime(End_time,"%m/%d/%Y %H:%M:%S:%3N")- strptime(WILY_Date,"%m/%d/%Y %H:%M:%S:%3N") |where diff <0| eval eventid=index + "__" + _cd+"__" + splunk_server|table eventid diff End_time WILY_Date
But what I see is, when then the timestamp is converted to epoch format, the milliseconds field is padded with 0s.
For example:
WILY_Date: 06/25/2015 09:59:43:58
End_time: 06/25/2015 09:59:43:230
the above time is converted to
WILY_Date: 06/25/2015 09:59:43:5800000
End_time: 06/25/2015 09:59:43:23000000
So that difference between diff=End_time-WILY_Date results in negative values. For more clarity I have attached the screen-shot.
I don't know what to do about it. Can somebody help me? It's already eaten much of my time.
Thank you!
... View more
07-10-2015
01:56 PM
Thank you. I have checked it and found that the data was not extracted. Thank you again!
... View more
07-02-2015
10:58 AM
Thanks, it helped me!
... View more
06-25-2015
01:30 PM
Thank you. This help me with my work ! Cheers 🙂
... View more
06-25-2015
08:49 AM
Hello all,
This is my first post.
I am trying to calculate time diff between two fields in a single event.
For example:
Time_HTTP_Start: 06/25/2015 09:59:43:586
Time_HTTP_Sent: 06/25/2015 09:59:43:830
My current search:
sourcetype="XXXXXX" host="XXXXXX" |eval diff= strptime(Time_HTTP_Sent,"%m/%d/%Y %H:%M:%S:%3N")- strptime(Time_HTTP_Start,"%m/%d/%Y %H:%M:%S:%3N")|table diff
I only get an empty result. Can somebody tell me what I am missing? I am sure its very easy for you guys!
Thank you.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
