About IRHM73

a1bg503461 · ‎11-14-2024

Hello all, This thread was very helpful to me and i described my picked time period in the dashboard panel description . I used the progress tag : <eval token="a1_jobEarliest">strptime($job.earliestTime$,"%Y-%m-%d_%H:%M:%S")</eval> <eval token="a1_jobLatest">strptime($job.latestTime$,"%Y-%m-%d_%H:%M:%S")</eval> <set token="a1_jobEarliest">$job.earliestTime$</set> <set token="a1_jobLatest">$job.latestTime$</set> However I still get formatting details that I dont need ( underlined in blue are miliseconds) :

laduran · ‎07-29-2022

Thanks for the reply. But... I gotta say, the syntax for doing multiple joins is very convoluted and not intuitive compared with SQL.

sideview · ‎06-29-2022

This is a pretty complex problem - part of the puzzle is in the audit log's info="granted" event, another part is in the audit log's info="completed" event, even more of it is over in the introspection index. Then of course for jobs that still exist on the filesystem there is a wealth more info you can get from the rest command or by a custom search command that inspects info.csv and status.csv. I recommend checking out an app that we released recently called Sideview UI - specifically the view within that app called "user_activity". This will do all of this for you, sidestep pretty thorny autokv problems in the audit data, and not just give you all of this per search, but also present stats and rollups by user, app, dashboard, even by sourcetypes-that-were-actually-searched it also has a macro called "calculate pain" that will score a "pain" number for each search, and then sum up all the "pain" in the by-user, by-app, by-sourcetype rollups etc. So that admins can try and pick off the worst offenders first. it's up on SB here and approved for both Cloud and onprem - https://splunkbase.splunk.com/app/6449/ and there's a #sideview_ui channel for it in the community slack.

singhr_citec · ‎05-16-2021

Thanks Hegga, This worked for me too. Quick and easy, exactly the way i wanted.

niketn · ‎08-25-2020

@Ashwini008 refer to another answer by me with couple of workarounds to set the required tokens based on time input selection. One of the uses input change event handler and other one which is more dynamic uses an independent search: https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/td-p/364411

MuS · ‎09-06-2019

You are welcome! Sometimes you have to think out of the box to get where you want to be 😉 Feel free to accept this answer and help others 🙂 cheers, MuS

IRHM73 · ‎07-18-2019

Hi, I wonder if someone could help me please. We're using Enterprise V6.5.7 and we have issues in updating summary indexes using both the 'fill summary' command and scheduled searches (via cron jobs). The jobs are shown as being run successfully but, the data is not being ingested into the Summary Index, and this is affecting multiple Summary Indexes. However, when we run the same search in the UI using the 'collect' command, an example of which is: collect index=summary_dg_allcode marker="report=CoDE2019Data" The data is ingested correctly into the Summary Index. I appreciate that the details are sketchy, basically I'm not even sure where to start looking, but I just wondered whether someone may be able to offer some guidance if they've experienced similar issues, and how they've resolved this, and /or whether they can suggest areas to look into, in greater depth? Many thanks and kind regards Chris

IRHM73 · ‎05-23-2019

Hi @FrankVl. Thank you for taking the time to reply to my message and for the confirmation. Kind Regards Chris

harsmarvania57 · ‎05-16-2019

Great, earlier I thought that you want area code as number after 350 and 44 & that's why I deleted my answer earlier.

kamlesh_vaghela · ‎04-10-2019

@IRHM73 Great. Please accept your answer.

bwlm · ‎04-23-2020

I have been struggling with the same issue... cannot seem to get another panel search to be disabled and stop running. Even when all of the "searchWhenChanged" fields are set to false. https://answers.splunk.com/answers/231685/how-to-disable-a-search-for-a-dashboard-panel.html

IRHM73 · ‎04-03-2019

Hi @vnravikumar , Thank you for coming back to me with this. The problem is that this needs to have an element which separates the events. At the moment it's putting them all one one row and goes from Field1 Field10 Field 100, whereas I'd like them to be sequential if possible please? Many thanks and kind regards Chris

tmurata_splunk · ‎08-21-2019

I saw a similar message below [splunk-idx1] Failed to parse templatized search for field 'tag::eventtype' This error was caused by following forearch command. | foreach * [ eval <<FIELD>> = if(isnull(<<FIELD>>),"",<<FIELD>>)] I think the <> template cannot handle fields contains special characters. I worked around this by adding | fields - tag::eventtype just before the foreach. You can probably work around by adding | fields - 'clientHeaders.test-client-device-id{}'

IRHM73 · ‎03-02-2019

Hi @richgalloway . That makes a huge difference. I now have the columns I want.....it's great. I just now need to work out had to incorporate the counts but I think I can work with that. Thank you so much for all your time and trouble, it's sincerely appreciated. Kind Regards Chris

mstjohn_splunk · ‎03-01-2019

@tiagofbmm Thanks so much!

IRHM73 · ‎02-26-2019

Hi, I found the solution which is: sum(eval(if(signout="1", "1", ""))) Many thanks to all your suggestions and help. Kind Regards

ashajambagi · ‎02-22-2019

Summary indexing is mainly to speed up the searching by filtering the required data which will be fulfilled by using transforming command. Schedule a report and enable summary indexing on it. You can perform further search on the si data.

IRHM73 · ‎02-21-2019

Hi @woodcock. I've been working on this and have got this to work by tweaking the final few lines of the code to: | eval newtime = newtime . " Total" | streamstats dc(newtime) AS _serial | multireport [ rename newtime AS _newtime ] [ stats sum(*) AS * first(_serial) AS _serial BY newtime | rename newtime AS _newtime | eval ClientID = _newtime ] | sort 0 BY _serial | fields - newtime Many thanks for all your help. Kind Regards Chris

woodcock · ‎03-04-2019

I do not have your data so that line helps me fake it. If the solution works, be sure to click Accept to close it and also UpVote any answers or comments that were valuable.

IRHM73 · ‎07-17-2018

Hopefully he will, so can give him the credit aswell.

IRHM73 · ‎05-13-2018

Hi, I wonder whether someone could help me please. I'm using the following join query which extracts the data perfectly: `wso2_wmf(RequestCompleted)` request.detail.Context="individual-*" OR request.detail.Context="marriage" OR request.detail.Context="national" | rename request.detail.applicationClientId as clientId request.detail.Context as api | join clientId [ | search `application_wmf(RequestReceived)` detail.input="Request to /application" | spath output=developer input=detail.responseMessage path=name | rex field=tags.transactionName "clientId\=(?<clientId>[^\W]+)"] | stats count by developer api The problem I have is that I no that the Join command is inefficient and my results will be restricted to 50,000 rows. I know that the best alternative is to use the 'Stats Values' but after trying this using a multisearch and then as OR statement solution as shown below, I have difficulty in bringing together the developer name when using the stats count by api. (`wso2_wmf(RequestCompleted)`) request.detail.Context="individual-*" OR request.detail.Context="marriage" OR request.detail.Context="national") ( `application_wmf(RequestReceived)`) Could someone have a look at this please and let me know where I've gone wrong? Many thanks and kind regards Chris

IRHM73 · ‎05-10-2018

Hi, thank you for coming back to me with this. I didn't know about using the 'report' command in this way. Many thanks and kind regards Chris

IRHM73 · ‎04-26-2018

Hi @kmaron, yes thank you for this. I've now included the _time but I have issues over the Transpose. Kind Regards Chris

IRHM73 · ‎04-26-2018

All, I've come up with the following which resolves the issue highlighted in this ticket. (wso2_wmf(RequestCompleted)) OR (`auth_wmf(RequestReceived)`) | spath output=afin input=detail.responseMessage path=affinityGroup | eval requestid=coalesce('request.tags.X-Request-ID', 'tags.X-Request-ID') | stats values(afin) as afin, values(request.detail.apiContext) as api by requestid | search (api="benefits" OR api="employment" OR api="income") | stats count by afin, api | transpose 0 | fields - column Many thanks for all your help. Regards Chris

woodcock · ‎04-22-2018

It is still unclear what the "issue" is. It would be crystal clear if you exemplified it as I suggested.

Posts	554
Solutions	23
Karma Given	58
Karma Received	41
Member Since	‎07-08-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Automatic Role Removal

Summary Indexing Not Updating

PII In Splunk

Extract Area Code From Phone Numbers

Foreach Not Working

Disable Code From Running

How do you create new fields from the current fiel...

Failed to parse templatized search for field....

Foreach in Multisearch

Foreach in Multisearch

Re: Use Timepicker Token With Field

Re: How do I combine my three searches using multi...

Re: Splunk Searches Run By User

Re: Hide/Display Panels Using Multiselect

Re: Dynamic Dropdown Using Timepicker

Re: Automatic Role Removal

Summary Indexing Not Updating

Re: PII In Splunk

Re: Extract Area Code From Phone Numbers

Re: Foreach Not Working

Re: Disable Code From Running

Re: How do you create new fields from the current ...

Re: Failed to parse templatized search for field.....

Re: Foreach in Multisearch

Re: Foreach in Multisearch

Re: Stats Count Eval If

Re: Can you help me incorporate my search into a s...

Re: Subtotals with Sum

Re: In a table powered by a stats count search, ca...

Re: How to display zero count in a stats table?

Stats Values Multisearch

Re: Ingestion of Data in Summary Index

Re: Transpose and Timechart

Re: Transpose Multiple Column Headers

Re: FillNull In Timechart

Join the Conversation