Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About varun99
varun99
Path Finder
Member since:
02-06-2018
06-05-2020
Community Statistics
| Posts | 16 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 11 |
| Member Since | 02-06-2018 |
Activity Feed
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 11-03-2022 09:57 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 01-04-2022 09:46 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 11-05-2020 07:06 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 07-14-2020 01:30 PM
- Got Karma for Re: eval Not working with time functions while evaluating the tokens. 06-05-2020 12:49 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 06-05-2020 12:49 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 06-05-2020 12:49 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 06-05-2020 12:49 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 06-05-2020 12:49 AM
- Got Karma for Re: Can i assign a color to a string in a field if it is present in the field ?. 06-05-2020 12:49 AM
- Got Karma for Can you display a panel only if the user clicks on one specific column?. 06-05-2020 12:49 AM
- Posted Can you display a panel only if the user clicks on one specific column? on Splunk Search. 08-14-2018 08:51 PM
- Tagged Can you display a panel only if the user clicks on one specific column? on Splunk Search. 08-14-2018 08:51 PM
- Tagged Can you display a panel only if the user clicks on one specific column? on Splunk Search. 08-14-2018 08:51 PM
- Tagged Can you display a panel only if the user clicks on one specific column? on Splunk Search. 08-14-2018 08:51 PM
- Posted Re: eval Not working with time functions while evaluating the tokens on Dashboards & Visualizations. 04-17-2018 09:14 PM
- Posted Re: eval Not working with time functions while evaluating the tokens on Dashboards & Visualizations. 04-17-2018 07:34 PM
- Posted eval Not working with time functions while evaluating the tokens on Dashboards & Visualizations. 04-17-2018 07:03 PM
- Tagged eval Not working with time functions while evaluating the tokens on Dashboards & Visualizations. 04-17-2018 07:03 PM
- Tagged eval Not working with time functions while evaluating the tokens on Dashboards & Visualizations. 04-17-2018 07:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-14-2018
08:51 PM
1 Karma
The requirement is to display a panel only if the user clicks on a specific column in a previous panel. Kindly help.
... View more
04-17-2018
09:14 PM
1 Karma
It worked with the below:
<set token="JMS_ID">$row.JMSID$</set>
<set token="show_transaction">true</set>
<unset token="show_correlated"></unset>
<set token="StartTime">$row.StartTime$</set>
<eval token="token_starttime">relative_time(strptime($StartTime$,"%Y/%m/%dT%H:%M:%S"),"-5m")</eval>
<eval token="token_endtime">relative_time(strptime($StartTime$,"%Y/%m/%dT%H:%M:%S"),"+1h")</eval>
Set token first and then use that token in the eval command. I am using the below tokens in the drilldown panel.
token_starttime
token_endtime
Thanks all for your help.
... View more
04-17-2018
07:34 PM
Thanks for your reply.
The condition is fine as it is the ELSE part. Similar eval statements are there in the conditional part as well. I have updated the question to remove the condition statement as it may confuse other people.
And yes I am intentional using $row.StartTime$ for both Start and EndTime. Modification that have to be there are added in the questions above.
... View more
04-17-2018
07:03 PM
I have a panel which provides us a list of transactions along with the StartTime of the transactions. I want a drill down panel which searches for a specific transaction within the time range (StartTime - 5 minutes) to (StartTime + 1 hour).
Please note that the StartTime is a field listed in the first panel with the format. "YYYY/mm/dd HH:MM:SS.sss".
I tried eval the startTime and EndTime of the second panel in the tokens like below:
<set token="JMS_ID">$row.JMSID$</set>
<eval token="StartTime">strptime($row.StartTime$, "%Y/%m/%d %H:%M:%S.%3Q")-600</eval>
<set token="show_transaction">true</set>
<unset token="show_correlated"></unset>
<eval token="EndTime">strptime($row.StartTime$, "%Y/%m/%d %H:%M:%S.%3Q")+3600</eval>
I am providing the input to the second panel as below:
<earliest>$StartTime$</earliest>
<latest>$EndTime$</latest>
But it's not working. The search is not even starting. It says "Search is waiting for input..."
... View more
03-06-2018
05:36 PM
Hi,
I have the data like below:
TransactionID1 TransactionID2
aaaaaaaaaaaa aaaaaaaaaaaa
aaaaaaaaaaaa bbbbbbbbbbb
bbbbbbbbbbb
ccccccccccccc ccccccccccccc
ccccccccccccc ccccccccccccc
ccccccccccccc
I need to group some records based on the above two fields in a way that the first three records come together and last three come together based on the fact that any of the TransactionID1 or TransactionID2 are same. It is a bit easy to group the last three. However, I am finding it difficult to group the 1st three. Kindly help.
... View more
02-25-2018
03:28 PM
If I see the file on the server, it has the data. But in splunk, I am able to see all the data except for a few lines. Kindly let me know why it could be happening and what can I do to resolve this kind of behavior.
I am using a simple query like source="filePATH"
... View more
02-15-2018
04:08 PM
I have a list of services. I want to create a kind of a health check report for all the services.
The problem is I am not very sure if all the Service logs are being consumed in splunk. That is the reason I don't want to create a list from the data already present in SPLUNK. Requirement would be to list down the Name of the services and status of the services. If those service logs are not found in SPLUNK, I want to highlight something like 'Service Logs not being consumed as of now'.
Kindly help.
... View more
02-07-2018
10:53 PM
9 Karma
Worked with the below:
<format type="color" field="Status">
<colorPalette type="expression">if (like(value,"%Error%"),"#FF5733","#247bc1")</colorPalette>
</format>
... View more
02-07-2018
10:52 PM
Worked with the below:
if (like(value,"%Error%"),"#FF5733","#247bc1")
Thanks anyways 🙂
... View more
02-07-2018
09:54 PM
Already tried this, but it's not working. Please note that the Status field contains a big string like :
"Request received. Sent to Provider. Error. Received response from Provider."
"Error" is just a part of the string.
... View more
02-07-2018
09:38 PM
My requirement is to highlight the "Error" string in red colour if it is present in the extracted field "Status".
Note: I am using stats command.
... View more
02-06-2018
10:26 PM
I just tried with the Dropdown and it worked. Thanks a lot.
... View more
02-06-2018
08:56 PM
I want to add a checkbox input which just concatenates my search with something like " | search Error" if I check that. Is it possible ?
... View more
02-06-2018
04:50 PM
As a workaround, I concatenated the JobIDThread with the Status 🙂
... View more
02-06-2018
04:24 PM
No, it doesn't. It's sorting the rows depending on the JobIDThread, not the Status field.
... View more
02-06-2018
04:08 PM
PFB the search query that I am using for my panel. PFA the view of th dashboard as well.
index=scampservices OSIT4 sourcetype=RA* OR sourcetype=RIM* OR sourcetype=LMLo*| rex "(?ms)(?.?)\" | rex "(?ms)(?.?)\" | rex "^(?P\d+\s+\w+\s+\d+\s+\d+:\d+:\d+)" | rex "(?ms).(?.?)\" | rex "^(?:[^-\n]-){5}(?P\d+)" | rex "^(?:[^-\n]-){5}(?P[^ ]+)" | rex "[\s][TransactionD:][\s\n][#=]+[\n](?.?)[-#]+\n" | rex "[\s]Data:[\s\n][=]+\n*(?.?)[\s]-" | eval Status=coalesce(RIMStatus, RAStatus) | stats values(JobIDThread) as JobIDThread values(Status) as Status values(Resource) as Resource values(Timestamp) as Timestamp values(SoapAction) as SoapAction values(Consumer) as Consumer values(sourcetype) as ESFComponent by JobID | search Resource=$Resource_Email$
The Status values are being displayed sorted in alphabetical order. I want to sort them according to the JobThreadID values.
Kindly help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
