About hxa27

hxa27 · ‎10-17-2014

So, what would be a better option to run multiple queries ?

hxa27 · ‎10-15-2014

Thanks for the comment that helps somehow. Do you know if there is a way I can run multiple queries at the same time in db connect ?

hxa27 · ‎10-15-2014

Hi, I am trying to use Splunk to monitor my process by using the db connect. My problem is I am using the following query: Select * from My_table where proc >= today-2 and user_id= ' ' into temp My_temp_table with no log; which has a temp table to insert records into. Is it possible to query this? whenever I query this it gives me this error "command="dbquery", A database error occurred: Method only for queries" or this if I run the whole query "command="dbquery", A database error occurred: The specified table (My_temp_table) is not in the database." Also, at the end of the query, I am dropping the temp table Note: I am running this against informix database Any help is appreciated Thanks

hxa27 · ‎09-29-2014

Thanks for the explanation. I am going to try this . Thanks again

hxa27 · ‎09-29-2014

There should be files for each dashboard in this directory Splunk\etc\apps\My_App_Name\default\data\ui\views. So I copied the same directory of the new app ,but in my case not all of them have it and did not work with me

hxa27 · ‎09-29-2014

Well, we have so many dashboards on Production and we are trying to combine all of them in one application. So, copying each code to another it's kind of waste of time. So, I was trying to find an easy way to do it. I tried to copy the dashboard from the app itself but did not work for me; and it's possible that I did something wrong.... Any thought or idea. Thanks for the response

hxa27 · ‎09-29-2014

is there another way? Because I know this one but it does not work on my case . . .

hxa27 · ‎09-26-2014

Hi, I have different apps with different dashboards and alerts. The goal is to all the app's dashboards in one app which contains all the dashboards and alerts. Is there away to do that. (Note: I am not talking about packaging the apps because I know how to do that). For example, I have Apps called A, B and C with dashboards and alerts; I want all these to be in an App called ex. My_App ? Thanks

hxa27 · ‎08-21-2014

Thanks that actually helps and now it's working. I was on the page but I thought only the set up which I know but I missed that step 🙂 Thanks again you saved the day

hxa27 · ‎08-21-2014

Hi, I am trying to connect Splunk Db Connect to informix database but I always get an error when I am saving the connection. I installed the Informix JDBC driver but did not work. I always get this error: Encountered the following error while trying to save: In handler 'databases': Error connecting to database: java.sql.SQLException: INFORMIXSERVER does not match either DBSERVERNAME or DBSERVERALIASES. I do not know why it does not see any match. Any help is appreciated. Thanks guys

hxa27 · ‎05-21-2014

Hi, I am trying to populate a search in dropdown option. I tried a couple things but I do not know why it is not working. my XML code looks like that: <fieldset autoRun="true" submitButton="true"> <input type="dropdown" token="name" searchWhenChanged="true"> <label>Select a Catergory:</label>  <populatingSearch fieldForValue="name" fieldForLabel="name"> |dbquery My_Database_Name "select distinct Name from Table1_Name e INNER JOIN Database_name..Table2_name r on My_ReportID1=My_ReportID2 where Name='My_condition '" </populatingSearch> </input> </fieldset> I used the same populating search in a different query and it was work just fine. I don't know why this is not working.. Thanks in advance

hxa27 · ‎05-15-2014

UCM monitoring |dbquery UCM "select name from DimCategory where name like '%'" Select a Catergory: * All |dbquery UCM "select name from DimCategory where name like '%'" This code does what I want. Yeeeeeees

hxa27 · ‎05-15-2014

Hi, I am trying to populate my dropdown from my search but I am not sure about my syntax or something else is missing. My code looks like : form> UCM monitoring || dbquery UCM "select * from DimCategory where Name="" " Select a Catergory:  <![CDATA[index=_internal|stats count by Name]]> <choice value="">Any The query is run against a database. So, I am not indexing any data. any help is appreciated.

hxa27 · ‎05-13-2014

The time range picker does not work because of the time format differences between the database and Splunk. so, the answer you posted won't work in my case

hxa27 · ‎05-13-2014

Hi, I am trying to create a dashboard which I can show different dashboards in one by changing the date range and other parameters. Everything is working fine, but there is one problem am trying to solve. The problem is I want to have a default date of Today's date (for the End Date) and 30 days before today's date (for starting Date). My dashboard is calling a stored procedure in the database and it has three parameters to run successfully. Here is part of my XML: 04/01/2014 Select a Start Date: 05/01/2014 Select a End Date: So, how can I set up the EndDate to be Today's date and the StartDate to be 30 days before today's date?? Any help or suggestion is appreciated Thanks

hxa27 · ‎04-15-2014

Non of these worked not because they are wrong but I am not able to change anything in the particular column. Idea in how to fix this issue

hxa27 · ‎04-14-2014

Hi, I am using DB connect to fetch a table from the database which the table was imported as an Excel to the database. But, the problem is the time is showing like 1396760400.000 and tried different commands like convert, replace and other ones but the date is not changing. Also, when I tried just to rename the header of the field, I could not either. So, I have no idea what the problem is. Idea/ suggestion would be great Thanks

hxa27 · ‎03-11-2014

This is my search query index="test" sourcetype=NewIndex| eval timenew= now()- _time| eval TimeElapsed=tostring(timenew,"duration")|replace "C:\Users\hxa27\Desktop\NewIndexing\Test\" with ""|rename source as "File Name" |eval "File Create Date"=strftime(_time,"%m-%d-%Y %H:%M:%S")|table "File Name" TimeElapsed "File Create Date"

hxa27 · ‎03-11-2014

Hi, I have my search set and everything is work fine except the condition. In the search I have this condition in the end of my query search (where "Time Elapsed" > "03:00:00"), this condition does not work if it is like that and it shows all the file. However, if I have it like this( where TimeElapsed > "03:00:00"); it works just fine I don't know why?? Any idea Thanks

hxa27 · ‎03-07-2014

Hi, I actually, I have two questions on the same query search. 1- I was able to monitor the folder I want instead of the log files, but my problem is when I run the search again; I still see the files I deleted earlier plus the new files I added. I don't know why they still show???!!!!!! 2- On the same search, I sat up a real time alert to send me an email if the condition has met, which is what I get. That's great but the problem is I receive 19 to 20 emails for the same file because the real time alert runs every minute and it gives me all the files which met the condition even if it the same files. Is there a way to make splunk to send only one email for the new file ?? Any suggestion will be helpful Thanks in advance

hxa27 · ‎03-05-2014

I am trying to have kind of different configuration in order to monitor the folder but I don't have permission to do so. Is there another way to do it ? because when I try to add Data; I could not choose the folder I have to choose the file which I do not want to. Any suggestion will be helpful

hxa27 · ‎03-05-2014

Thanks for the response. I cannot collect the file names because they are changing all the times. So, I am just trying to monitor the folder without specifying any filenames.

hxa27 · ‎03-05-2014

Hi, I am trying to monitor a folder and send alert notification. The idea of this task is to monitor the folder and check the files in the folder are getting processed then the files are moved to another application. The task is to send an alert for the files which take longer than period of time which I set up. Any suggestion will be helpful Thanks

hxa27 · ‎02-20-2014

ok, and how can I do the minutes ?

hxa27 · ‎02-20-2014

Yes, and showing the time it takes as Y axis in minute ans second

Posts	29
Solutions	1
Karma Given	8
Karma Received	9
Member Since	‎02-07-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Is it possible to query a temp table using Splunk ...

How to copy dashboard from one App to another?

Why do I always get an error trying to connect Spl...

Populating Search

dropdown populated search

Default Date XML

Time format

Search Condition

Too many emails & data

Folder Monitoring and Alert

Re: Is it possible to query a temp table using Spl...

Re: Is it possible to query a temp table using Spl...

Is it possible to query a temp table using Splunk ...

Re: Copy Dashboard from one App to another

Re: Copy Dashboard from one App to another

Re: Copy Dashboard from one App to another

Re: Copy Dashboard from one App to another

How to copy dashboard from one App to another?

Re: Why do I always get an error trying to connect...

Why do I always get an error trying to connect Spl...

Populating Search

Re: dropdown populated search

dropdown populated search

Re: Default Date XML

Default Date XML

Re: Time format

Time format

Re: Search Condition

Search Condition

Too many emails & data

Re: Folder Monitoring and Alert

Re: Folder Monitoring and Alert

Folder Monitoring and Alert

Re: Make a graph

Re: Make a graph