Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About samwatson45
samwatson45
Path Finder
Member since:
01-30-2018
06-05-2020
Community Statistics
| Posts | 56 |
| Solutions | 0 |
| Karma Given | 13 |
| Karma Received | 0 |
| Member Since | 01-30-2018 |
Activity Feed
- Karma Re: In my dashboard, can four tables be joined into one? for harishalipaka. 06-05-2020 12:49 AM
- Karma Re: Timing multiple event actions in IIS logs for somesoni2. 06-05-2020 12:49 AM
- Karma Re: Is there a way to use a different value as _time field? for jcoates. 06-05-2020 12:49 AM
- Karma Re: How can I get the time difference between two events? for jlanders. 06-05-2020 12:49 AM
- Karma Re: How can I get the time difference between two events? for mayurr98. 06-05-2020 12:49 AM
- Karma Re: How to find the first alphabetical value? for maciep. 06-05-2020 12:49 AM
- Karma Re: Using two seperate inputlookups for elliotproebstel. 06-05-2020 12:49 AM
- Karma Re: Using two seperate inputlookups for 493669. 06-05-2020 12:49 AM
- Karma Re: How to add a flat, single value line to a graph? for niketn-deceased. 06-05-2020 12:49 AM
- Karma Re: How to join two time stamps with different counts? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How to convert values in a table column to column headers? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: How to display percentage rather than count of a field with multiple values on a timechart? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How do I concatenate two fields into a string? for ftk. 06-05-2020 12:45 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-10-2018 02:43 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-10-2018 02:38 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-06-2018 04:34 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-06-2018 03:09 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-06-2018 03:09 AM
- Posted Why are scheduled searches not working in our newly created index? on Reporting. 12-06-2018 02:24 AM
- Posted Why is my scheduled Alert not throttling correctly? on Alerting. 10-08-2018 05:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-10-2018
02:43 AM
Okay thanks I shall go and check this.
... View more
12-10-2018
02:38 AM
How would I ensure the index is on all indexers?
... View more
12-06-2018
04:34 AM
Essentially I am trying to do what I would do to a summary index but on a fresh one, is it not the same principle? Where I enable summary indexing in the search and then select and index?
There is no error, the search runs as normal (even gives results) but does not write anything to the index I request.
... View more
12-06-2018
03:09 AM
However, I have also tried just doing a simple one, like this:
index=iis a_app=<app> a_action=<action>
| fields + a_customer a_customer_code sc_status c_ip cs_host sc_bytes a_version _time time_taken date_month date_mday date_hour
... View more
12-06-2018
03:09 AM
Hi,
It looks like this:
index=iis a_app=<app> a_action=<action>
| eventstats count min(time_taken) as min_tt max(time_taken) as max_tt avg(time_taken) as a_tt perc90(time_taken) as p_tt by a_customer a_customer_code date_month date_mday date_hour sc_status c_ip cs_host sc_bytes a_version
| sistats max(_time) max(count) max(a_tt) max(p_tt) max(min_tt) max(max_tt) by a_customer a_customer_code date_month date_mday date_hour sc_status c_ip cs_host sc_bytes a_version
| fields + psrsvd_nx__time psrsvd_nx_a_tt psrsvd_nx_count psrsvd_nx_min_tt psrsvd_nx_max_tt psrsvd_nx_p_tt a_customer a_customer_code date_month date_mday date_hour sc_status c_ip cs_host sc_bytes a_version
| rename psrsvd_nx_a_tt AS "AverageTimeTaken"
| rename psrsvd_nx_count AS "CountOfEvents"
| rename psrsvd_nx_max_tt AS "MaxTimeTaken"
| rename psrsvd_nx_p_tt AS "90thPercentileTimeTaken"
| rename psrsvd_nx_min_tt AS "MinTimeTaken"
... View more
12-06-2018
02:24 AM
Why am I unable to write to a new index
I have created a new index through the UI, by going to:
Settings > Data > Indexes > New Index
Filling out the name and then essentially leaving everything else as default.
I then wrote a scheduled search to write to this index. The search produces results when I run it in the search bar, and also works when I set it to write to other previously existing indexes. It only doesn't work when I try to write to a newly created index (I have tried with a few).
Is there a step I need to do to allow data to be written into a new index? What am I missing here?
Thanks,
Sam
... View more
10-08-2018
05:53 AM
Hi,
I have a scheduled alert looking at a certain specific event type, which is set to trigger if the 90th percentile time taken goes over a certain amount. As this can happen fairly often, I have set the throttle so that if the alert triggers, it does not do it again for three hours. However, the alert simply ignores the throttle and triggers whenever it wants.
The alert has the following conditions:
Search:
<base search> | eval time_taken_s=time_taken/1000 |stats perc90(time_taken_s) as response_percentile, count as Count
Time range:
Earliest: rt-60m
Latest: rt-0m
Condition: If custom condition if met
Custom Condition Search: search response_percentile > 20 AND Count > 30
Alert mode: Once per search
Throttling: Yes
After triggering the alert, don't trigger it again for: 3 Hour(s)
If anyone can see what I am doing wrong that would be greatly appreciated.
Many thanks,
Sam
... View more
09-21-2018
09:19 AM
Perfect thank you 🙂
... View more
09-21-2018
03:48 AM
Hi,
I have a field which produces a value like this example: DB=HR_10_7_3043_TGTHRLIVE
I am trying extract the number and write it in the following way: DB_Version=10.7.3043
How do I get Splunk to cut off before and after the number and then replace the _ with .
Note: The strings before and after the numbers can vary in length, and the number can vary too.
Many thanks,
Sam
... View more
08-07-2018
09:13 AM
Oh I see what you mean now, there's a setting called 'Specify Timestamp Column' within the 'Set Parameters' part where you can enter what column to use.
That's awesome and solved my problem perfectly ^^ Thanks for pointing this out 🙂
... View more
08-07-2018
08:08 AM
Thanks for responding!
I have done the conversion in my SQL data harvest rather than the DB Connection conversion.
Basically no matter how i bring it or calculate the timestamp I cannot make it work with the time/date selector. Is there any way to change which field this looks at or manually overwrite the _time field for this data source?
... View more
08-07-2018
03:04 AM
Hi all,
I have a dataset which I am bringing in from a SQL database (via Splunk DB Connect) that is quite large.
From this have a dashboard with a whole bunch of panels, some tables, figures and charts.
What I would like to do is use the a date field from this dataset to work with the time selector at the top of the page, so that when someone selects a certain month the data from that month is shown, rather than data extracted in that month (definitely not the same thing as it is not a live feed).
The date comes in the SQL format such as '2018-08-06', and I tried to change it but converting this timestamp to an unix/epoch format and renaming it as _time. This works for timecharts but for tables and figures it does not correspond to the time selector menu.
I also tried creating the unix timestamp in the SQL database, naming it _time and then bringing it in that way, but Splunk renames it as just 'time'. Then when I rename that as _time again it does not correctly correspond to the time selector for the page.
I am out of ideas, is there any way to get Splunk to use a foreign value as the _time field that works with the date selector on the dashboard?
Or some other way I can easily allow someone to manually select dates from another form of dropdown?
Many thanks,
Sam
... View more
07-19-2018
03:26 AM
Hmm this still starts it on a Thursday. If i change the number to, say, "@w4" or "@w5" it just skips to the following Thursday.
... View more
07-18-2018
08:21 AM
I'm plotting some data on a timechart, with a span of a couple of months, and using weeks as the data points. How can I make the chart so it takes a week from Monday-Sunday instead of Thursday-Wednesday?
Thanks,
Sam
... View more
06-26-2018
03:44 AM
Thanks! This works great.
Do you know how to get the additional column (a=query1, etc) to be at the left of the table rather than the right?
... View more
06-26-2018
03:14 AM
Hi,
I have a dashboard which in which one of the panels features a table, currently made out of 4 separate searches (technically 4 tables just next to each other), like so:
The searches for each one look like this:
base search... | stats latest(AvailabilityFlex) AS Availability latest(RollOutFlex) AS RollOut latest(LeadershipFlex) AS Leadership
Where for the other metrics the stats command looks for other metrics, i.e
base search ... | stats latest(AvailabilitySub) AS Availability latest(RollOutSub) AS RollOut latest(LeadershipSub) AS Leadership
Is there an easy way of combining these searches all into one table, with the same structure as it currently has? A table with 4 columns and 4 rows, the first column one being the 'metric' and the name of that for each row?
Thanks,
Sam
EDIT: The reason for this is because when you generate the PDF it really stretches out the table, making it look much less professional. If anyone knows how to keep panels all grouped together when doing this, that would also work!
... View more
05-29-2018
08:56 AM
The query is a bit odd, I am essentially using a manually uploaded csv to calculate the number of hours spent at certain locations for each month.
| inputlookup file.csv | eval hours=mondayhours + tuesdayhours+ wednesdayhours + thursdayhours + fridayhours+ saturdayhours + sundayhours | eval date=substr(date,4,len(date)-0) | chart sum(hours) by date, location | rename date AS "Month"
... View more
05-29-2018
08:47 AM
Thanks for your reply!
When you say the script needs to be placed in a folder, where do I go within the Splunk window to access this?
Thanks,
Sam
... View more
05-29-2018
05:50 AM
Hi,
If I have a stacked bar graph and I want to display two types of values for each one, how can I make the null (0) values not be displayed like below?
Thanks,
Sam
... View more
05-29-2018
01:11 AM
Hi,
I have created a dashboard which summaries some results for our customers, and we are interested in auto-generating some PDFs to send to them. In the dashboard we have a drop down where you can select the customer, however, I am aware that to schedule PDF delivery there need to be no drop down options. The issue is that we have over 100 customers and so I do not want to create a dashboard for each one as this would mean if I need to make any changes then it would likely cause some issues.
Is there any way to have one dashboard and use this along with a list of the emails and customer names where it can generate a PDF and send it to each customer individually?
Thanks,
Sam
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
