Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About shankarananth
shankarananth
Builder
Member since:
07-14-2015
06-17-2020
Community Statistics
| Posts | 155 |
| Solutions | 9 |
| Karma Given | 10 |
| Karma Received | 8 |
| Member Since | 07-14-2015 |
Activity Feed
- Posted Re: How to use foreach with search filter? on Splunk Search. 06-17-2020 08:44 AM
- Posted How to use foreach with search filter? on Splunk Search. 06-17-2020 02:35 AM
- Tagged How to use foreach with search filter? on Splunk Search. 06-17-2020 02:35 AM
- Karma Re: Need to add a value before a panel? for niketnilay. 06-05-2020 12:50 AM
- Karma Re: HOw to setup alerts for 2 differnt condition in single saves search? for ashanka. 06-05-2020 12:50 AM
- Karma Re: Need to add a value before a panel? for gcusello. 06-05-2020 12:50 AM
- Got Karma for Re: How to count number of days a Store in is RED?. 06-05-2020 12:50 AM
- Karma Re: Extract string from text based on character position for niketnilay. 06-05-2020 12:49 AM
- Karma Re: how to customize a report or dashboard as i mentioned below? for poete. 06-05-2020 12:49 AM
- Karma Re: How to remove a token name when the token has no value? for niketnilay. 06-05-2020 12:49 AM
- Karma Re: How to rewite a query to change the columns to rows and the rows to columns? for niketnilay. 06-05-2020 12:49 AM
- Karma Re: How can I extract values starting with a specific name using regex? for niketnilay. 06-05-2020 12:49 AM
- Karma Re: How can I extract values starting with a specific name using regex? for DalJeanis. 06-05-2020 12:49 AM
- Got Karma for How to continuously monitor a file from a shared folder or path?. 06-05-2020 12:49 AM
- Got Karma for Re: How to display count of related events in a column?. 06-05-2020 12:49 AM
- Got Karma for Re: How to display count of related events in a column?. 06-05-2020 12:49 AM
- Got Karma for Re: How can I extract values starting with a specific name using regex?. 06-05-2020 12:49 AM
- Got Karma for Re: How can I extract values starting with a specific name using regex?. 06-05-2020 12:49 AM
- Got Karma for Re: How can I extract values starting with a specific name using regex?. 06-05-2020 12:49 AM
- Got Karma for Re: Creating a join when first search contains multiple values for a single field. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-17-2020
08:44 AM
@richgalloway. Thanks for your reply. Now i have 3 field with prefix values of 192345_Employeestatus,207754_Employeestatus,158345_Employeestatus. In future we will get some more fileds with XXXXXX_Employeestatus. We dont know wht will be that prefix numbers. So now while writing query itself. We are looking for the solution to get the fields(192345_Employeestatus,207754_Employeestatus,158345_Employeestatus,XXXXXX_Employeestatus etc) in for loop and check them in search filter. Im trying to use search filter with same values with different fields in foreach loop. Thanks..
... View more
06-17-2020
02:35 AM
Hi All, I have a requirement to use foreach with search filter. Example fileds 192345_Employeestatus,207754_Employeestatus,158345_Employeestatus | foreach *_Employeestatus [search <<MATCHSTR>>_Employeestatus='<<FIELD>>'
(('<<FIELD>>'="") OR ('<<FIELD>>'="new") OR ('<<FIELD>>'="Working") OR ('<<FIELD>>'="exit")
OR ('<<FIELD>>'="IND") OR ('<<FIELD>>'="Aus") OR ('<<FIELD>>'="relocated") OR ('<<FIELD>>'="yettojoin")
OR ('<<FIELD>>'="Manager") OR ('<<FIELD>>'="AsstManager") OR ('<<FIELD>>'="SeniorAss")) ] But search filter is not filtering the data as expected. Need your help .. Thanks in advance.. Learner ...
... View more
04-18-2020
11:29 PM
@vnravikumar,
Thanks for your input..
Yes, i achieved the above one with help of splunk doc. Now the problem, When the dropdown is hidden. I don't want that dropdown token to be used in the panel query. How to achieve it. Token need to be active in panel query of dashboard, when dropdown is visible ..
Thanks ...
... View more
04-17-2020
07:35 AM
Hi Friends,
I have a drop-down filter in dashboard. If that filter is not populating any value, then while loading the dashboard itself that filter shouldn't be visible in dashboard and tokens used in the panel query(dashboard) for that filter shouldn't be active..
Wise versa once the data is there in that filter, filter need to be shown in dashboard and tokens used in the panel query(dashboard) for that filter should be active..
Please help me on achieving it ..
Thanks in advance ..
... View more
04-06-2020
07:41 AM
HI @dindu
Thanks for ur reply. I forgot to mention one more thing for some case we need only values before 2nd _. Out of above sample data i need to extract value as mentioned below .
(checkme,DATA_ACE, FdTest@Labcatr, FG_sam, Check@#$values, D&*fuse,Data*now)
Thanks..
... View more
04-06-2020
07:12 AM
Dear Friends,
Need you're help on writing a rex. As per my requirement. what ever value comes before a space need to be considered as first value and need to be extracted. values need to extracted and stored in field (checkme,DATA_ACE, FdTest@Labcatr, FG_sam, Check@#$values, D&*fuse,Data*now)
Sample try (?P<Clu>DATA_ACE)
Sample data:
DATA_ACE_CHE_Team
FdTest@Labcatr
DATA_ACE_CADD_Team
DATA_ACE_CAM_Team
DATA_ACE
DATA_ACE_CSS_Team
FG_sam
Check@#$values
checkme Data
D&*fuse
Data*now
Thanks in advance ...
... View more
- Tags:
- rex
- splunk-enterprise
03-23-2020
04:20 AM
Hi All,
Can someone help me with query that gives the macro dependency(ex Dashboard, reports etc ). When I fire that query in search window, I need information like in what all dashboard, reports etc that macro is used.
Thanks in advance...
... View more
Labels
- Labels:
-
search macro
06-12-2019
03:06 AM
@usmsplunksme,
Can i see the extracted_field values.
what is the Error your getting, while running the query..
Thanks ..
... View more
06-12-2019
02:48 AM
@aknsun,
Hope below answer, will clear your doubt..
https://answers.splunk.com/answers/593547/what-is-the-difference-between-splunk-app-for-aws.html
Thanks ..
... View more
06-11-2019
09:34 PM
@davidirvine,
I believe below query may or mayn't help you. Can you elaborate in detail manner what exactly your requirement.
sourcetype="ping_input" back_up_packet_loss = 0%
| table dest, packet_loss
Thanks ..
... View more
06-11-2019
05:37 AM
@jip31,
If you wish to display the same event(result) from panel query and drill-down query. Then i believe, you need to add below filter in drill-down query ..
correct me if i misunderstand your requirement..
| search SITE=$tok_filtersite|s$
Thanks ..
... View more
06-11-2019
05:11 AM
@sarvesh_11,
Good to hear.. Glad to help you. Please upvote any comments which help you.
Happy Splunking
... View more
06-11-2019
02:42 AM
@ jip3,
Is above mentioned code latest one ..
can you display the complete code one more time ..
Thanks..
... View more
06-11-2019
02:04 AM
@sarit_s,
Hope below answer will help you very much ..
https://answers.splunk.com/answers/12313/splunk-performance-statistics.html
Thanks..
... View more
06-11-2019
02:01 AM
@sarit_s ,
Can you display the output format. which you need to achieve ..
Thanks ..
... View more
06-11-2019
12:31 AM
Dear @sarit_s,
Use below query and change index and by clause filed as per your need.
index=* pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused"
| stats count(pause_reason) as pause_reason , count(SerialNumber) as SerialNumber by sourcetype
| table sourcetype pause_reason SerialNumber
| sort -pause_reason -SerialNumber limit=5
While displaying in chart, choose Column chart so that both pause_reason SerialNumber top 5 values will be displayed..
you can try another approach also ..
index=* pauseReason: NOT "pauseReason: NotPaused" pauseReason: NOT "pauseReason: UserPaused"
| stats count(pause_reason) as pause_reason , count(SerialNumber) as SerialNumber by sourcetype
| table sourcetype pause_reason SerialNumber
| top limit=5 sourcetype pause_reason SerialNumber
Thanks..
... View more
06-11-2019
12:03 AM
Dear @jip31,
It's ok no problem..
Is below code are the one you're expecting to achieve..
Kindly provide the screen-shot of error, your getting while adding the below code to your query.
| search CycleCount<=85
| search HealthState<=85
In What manner you're going to pass the token value eg 85 or >85 or <85 or !85.
Thanks..
... View more
06-10-2019
11:14 PM
@corecomputetools,
Please try below query ..
index=* | chart count by sourcetype | sort limit=10 -count
index=* | chart count by sourcetype | sort -count | head 10
Thanks..
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-17-2020
09:17 AM
|
Karma from
