About venky1544

venky1544 · ‎01-23-2024

i have a timechart query which is giving me the below result i want to exclude the columns with Zero like 02gdysjska2 ,2shbhsiskdf9 Not these names can change and or not fixed _time 003hfhdfs89huk 02gdysjska2 13hdgsgtsjwk 21dhsysbaisps 2shbhsiskdf9 5hsusbsosv 2024-01-23T09:45:00.000+0000 0 0 0 0 0 0 2024-01-23T09:50:00.000+0000 0 0 0 0 0 0 2024-01-23T09:55:00.000+0000 0 0 0 17961 0 0 2024-01-23T10:00:00.000+0000 0 0 1183 0 0 0 2024-01-23T10:05:00.000+0000 0 0 0 0 0 55 2024-01-23T10:10:00.000+0000 0 0 0 0 0 0 2024-01-23T10:15:00.000+0000 0 0 0 0 0 0 2024-01-23T10:20:00.000+0000 0 0 0 0 0 0 2024-01-23T10:25:00.000+0000 4280 0 0 0 0 0 2024-01-23T10:30:00.000+0000 0 0 0 0 0 0 2024-01-23T10:35:00.000+0000 0 0 0 0 0 0

venky1544 · ‎11-28-2023

Hello Everyone, I have a query where a user selects a time range in the timeticker Let say 10 november 08:30am to 10 novemeber 11:30am The user wants to only see the events for the last 5 minutes i.e from 10 novmeber 11:25am 10 novemeber 11:30am to look for errors in that 5 minutes He has two panels total errors in the the selected timeframe Total errors in the last 5mins of the selected timeframe I'm able to create panel 1 how to create panel 2 how Below search for panel 2 earliest=-5m latest=$info_max_time$ index=newdata sourcetype=oracle source="/u0/DATA_COUNT.txt" loglevel="ERROR" |bin span=5m _time |stats dc(loglevel) by INSTANCE_NAME

venky1544 · ‎09-12-2023

Hi @richgalloway did tried that not working 😞

venky1544 · ‎09-12-2023

Hi All i ahve a lookup file .csv where i have timestamp Name and USEDGB values i have been trying to run a time chart to see the total USEDGB per day Both lookup definition and lookup table file has app permissions |inputlookup ABC_DISK_UTILIZATION.csv |eval _time=Timestamp |timechart span=24h sum(USEDGB) the result only shows time but no values of USEDGB can you please help Timestamp NAME USEDGB 12/08/2023 22:04 RECO_A 48.61 12/08/2023 13:04 RECO_B 46.21 12/08/2023 03:04 RECO_C 46133.89 11/08/2023 20:01 RECO_A 164.11 11/08/2023 18:01 RECO_B 48.61 11/08/2023 16:01 RECO_C 46.21 10/08/2023 22:00 RECO_A 45327.22 10/08/2023 17:00 RECO_B 193.4 10/08/2023 08:00 RECO_C 48.61 09/08/2023 21:00 RECO_A 46.21 09/08/2023 13:00 RECO_B 45205.72 09/08/2023 06:00 RECO_C 132.57 08/08/2023 19:00 RECO_A 48.61 08/08/2023 12:00 RECO_B 46.21 08/08/2023 10:00 RECO_C 45203.77 07/08/2023 22:00 RECO_A 132.56 07/08/2023 14:00 RECO_B 48.61 07/08/2023 07:00 RECO_C 46.21 06/08/2023 22:04 RECO_A 45199.08 06/08/2023 13:04 RECO_B 123.85 06/08/2023 03:04 RECO_C 48.61 05/08/2023 20:01 RECO_A 46.21 05/08/2023 18:01 RECO_B 45196.12 05/08/2023 16:01 RECO_C 117.4

venky1544 · ‎08-10-2023

Hi @yuanliu @gcusello @richgalloway apologies for very late acknowledgement was down under the whether i kind of tweaked the data based on field values i did a total and then arranged them based on descending and then removed the total it kind of worked for me i added the below code after the timechart | addcoltotals labelfield=_time label="TOTAL" | transpose header_field="_time" 0 | sort - TOTAL | transpose header_field="column" 0 | rename column as _time| search _time != "TOTAL"

venky1544 · ‎07-27-2023

Hi @lyndac i know its a very old question but did you found an answer for it

venky1544 · ‎07-27-2023

Hi @vinod743374 css hack worked for my query any tips on how can learn these CSS style formattings

venky1544 · ‎07-27-2023

hi @vinod743374 yes its a field name in the query results just an example below | makeresults | eval data=" Market=UK, Question=location, Answer=London; Market=USA, Question=location, Answer=New York; Market=UK, Question=PET, Answer=dog; Market=USA, Question=PET, Answer=cat" | makemv data delim=";" | mvexpand data | rename data as _raw | KV | stats count by Question, Answer | eval Answer=Answer."(".count.")" <dashboard> <label>TEST_DATSET</label> <row> <panel> <title>Trellis by Questions</title> <chart> <search> <query>| makeresults | eval data=" Market=UK, Question=location, Answer=London; Market=USA, Question=location, Answer=New York; Market=UK, Question=PET, Answer=dog; Market=USA, Question=PET, Answer=cat" | makemv data delim=";" | mvexpand data | rename data as _raw | KV | stats count by Question, Answer | eval Answer=Answer."(".count.")"</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="refresh.display">progressbar</option> <option name="charting.chart.showLabels">false</option> <option name="trellis.enabled">1</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </row> </dashboard>

venky1544 · ‎07-27-2023

hi @vinod743374 i already tried it's not working i can still see it

venky1544 · ‎07-26-2023

Hello Evryone i have a panel with piechart i want to remove the highlighted part in the panel its coming with the chart its not the title

venky1544 · ‎07-26-2023

Hello splunkers, i have a simple timechart query for avg USED_SPACE of disks for last 4 days index=abc sourectype=disk_data |timechart span=24h avg(USED_SPACE) by DISK limit=10 usenull=f useother=f below is the result TIME DATApoint MADOD MA_ODP MA_PD MA_PI MA_PSD MA_PSI MA_P_DBCI MA_P_DBIN MA_P_DCRED MA_P_DEMS MA_P_DFDB MA_P_DFDMS MA_P_DFDP 22/07/2023 01:00 476054.33 39856.33 20105.25 106848.78 23032.06 703847.03 74755.98 20326.13 28006.5 20959.31 21400.05 21921.19 76224.02 83074.48 23/07/2023 01:00 476054.33 39864.33 20104.81 106848.78 23032.06 703847.03 74755.98 20326.13 28006.5 20959.31 21400.05 21921.19 76224.02 83074.48 24/07/2023 01:00 476166.33 39872.33 20105.25 106855.78 23032.06 703847.03 74755.98 20326.13 28022.5 20975.31 21400.05 21937.19 76228.02 83074.48 25/07/2023 01:00 476238.33 39880.33 20105.19 106862.78 23032.06 703851.03 74757.05 20326.13 28038.5 20975.31 21400.05 21953.19 76232.02 83074.48 My question is i understand DATApoint Disk has highest value so its first column but why is MADOD column in 2nd place its should be on 7th or 8th column as other disk have higher used space and if ilimit to 5 it gives me wrong info because MA_PSD should be in 1st column and its in 7th any suggestion how can i rearrange the columns based on used_space after timechart i'm expecting something like below TIME MA_PSD DATApoint MA_PD MA_P_DFDP MA_P_DFDMS MA_PSI MADOD MA_P_DBIN MA_P_DFDB MA_P_DEMS MA_P_DCRED MA_P_DBCI MA_PI MA_ODP 22/07/2023 01:00 703847.03 476054.3 106848.8 83074.48 76224.02 74755.98 39856.33 28006.5 21921.2 21400.05 20959.31 20326.13 23032.06 20105.25 23/07/2023 01:00 703847.03 476054.3 106848.8 83074.48 76224.02 74755.98 39864.33 28006.5 21921.2 21400.05 20959.31 20326.13 23032.06 20104.81 24/07/2023 01:00 703847.03 476166.3 106855.8 83074.48 76228.02 74755.98 39872.33 28022.5 21937.2 21400.05 20975.31 20326.13 23032.06 20105.25 25/07/2023 01:00 703851.03 476238.3 106862.8 83074.48 76232.02 74757.05 39880.33 28038.5 21953.2 21400.05 20975.31 20326.13 23032.06 20105.19

venky1544 · ‎07-20-2023

i have two drop down panels Basically when i select any value in Monitored statistics the Divisor value should change and its working but problem is i can see the value of the previous field as well like for "CPU used by" in monitored statistics has the value is in DIVISOR as 100 but it also shows the previous value1000000 in the divisor of another field how can i just get only one value in DIVISOR

venky1544 · ‎07-18-2023

Hi i have a table where i obtained the values after sorting PCT_FREE in ascending order now i want to plot a timechart of avg of used_space only for first two entity "B" AND "D" however when i plot timechart it takes all the entity any suggestions on how can i exclude then rest of the entity and plot the timechart time PCT_FREE USED_SPACE Entity 17/07/2023 16:15 10.4 245 B 16/07/2023 16:15 10.5 233 B 15/07/2023 16:15 10.3 235 B 14/07/2023 16:15 10.6 232 B 17/07/2023 16:15 11 245 D 16/07/2023 16:15 11 233 D 15/07/2023 16:15 11 235 D 14/07/2023 16:15 11 232 D 17/07/2023 16:15 12 245 A 16/07/2023 16:15 12 233 A 15/07/2023 16:15 12 235 A 14/07/2023 16:15 12 232 A 17/07/2023 16:15 14 245 C 16/07/2023 16:15 14 233 C 15/07/2023 16:15 14 235 C 14/07/2023 16:15 14 232 C

venky1544 · ‎07-12-2023

1q) i have my search starting with earliest=-1mon latest=now() i want to get the dates as startdate = earliest and end date = latest and caluclate the number of days between them 2Q) Also when we use timeticker how can i get the start and end time as fields in the search when we use option like last 7 days

venky1544 · ‎07-11-2023

Hi @ornaldo Configure the inputs.conf in splunk/etc/system/local/inputs.conf if you use the btool precedence command you get to know why the data is going in main index

venky1544 · ‎07-11-2023

Hi @PaulaCom when you edit the dashboard and in the panel if you click the magnifying lens you should get below option where you can set the time range is it Something you have done it or did i understood your question wrong

venky1544 · ‎07-10-2023

Hi @GaetanVP the data is coming from a file. its once a day so everyday you will have a new line appended to the file why the surprise, space in a drive doesn't mean it should always go linearly from 7 to 10. somedays some might copy total 13MB of files someday some might copy and delete so space in disk would change to 10MB i hope it clears your confusion Thanks

venky1544 · ‎07-10-2023

Hi i have dataset where data is ingested into splunk once a day at 5PM everyday Below is the dataset USED_SPACE and TOTAL SPACE are in MB date=10/07/2023 17:00:00 drive=HD USED_SPACE=10 TOTAL_space=100 date=09/07/2023 17:00:00 drive=HD USED_SPACE=12 TOTAL_space=100 date=08/07/2023 17:00:00 drive=HD USED_SPACE=13 TOTAL_space=100 date=07/07/2023 17:00:00 drive=HD USED_SPACE=10 TOTAL_space=100 Based on the growth of the used_space per day i want to calculate the days left for the drive to reach TOTAL space basically in how many days would it reach for Total space need a separate column as days remaining

venky1544 · ‎11-22-2022

venky1544 · ‎11-22-2022

Time door Fruit Count 11/11/2022 04:36:07 112 APPLE 14 11/11/2022 04:10:00 111 PEAR 8 11/11/2022 03:01:02 111 PEAR 119 11/11/2022 02:41:49 111 PEAR 82 10/11/2022 21:41:18 111 PEAR 26 10/11/2022 18:11:16 111 PEAR 12 10/11/2022 01:36:15 111 Orange 5 i want to plot timechart graph with count of fruits for each door

venky1544 · ‎06-16-2022

HI @dasadmin without the index name (the index should exist) it would either direct the events to main index or the default index in your settings it imp to define the index for any input source thanks Note:- if it helps karma points are appreciated/if it resolves solution acceptance is appreciated

venky1544 · ‎06-15-2022

HI @dasadmin it seems you have missed to define the index parameter in inputs.conf where the logs should be written index = abc Note:- if it helps karma points are appreciated/if it resolves solution acceptance is appreciated

venky1544 · ‎06-09-2022

Hello Splunkers I have a query regarding number of indexers or indexer clusters that can reside in a single site clustering suppose i have 400 indexers is there a limit as such for the number of indexers in single site?? and another question is how many indexers can i place in a indexer cluster can it be more than 3?

venky1544 · ‎06-07-2022

Hi @KyleMcDougall when you say 2 buckets can you please elaborate do you mean you want two panels in a dashboard ?? are can you share a sample output note:- if it helps karma points are appreciated/if it resolves solution acceptance is appreciated

venky1544 · ‎06-07-2022

hi @KyleMcDougall Have you tried the transaction command this command should group based on sessionID and would give you an eventcount which gives you an idead about the number of intent related to each sessionID whether its 0 or 1 intent and 2 or more intent |transaction sessionId just an example |makeresults |eval sesid="abc1234", data="amber", intent="payroll.help_preferences_standard" |append [|makeresults |eval sesid="abc1234", data="new", intent="payroll.update_account"] |transaction sesid |table sesid eventcount intent Thanks venky note:- if it helps karma points are appreciated/if it resolves solution acceptance is appreciated

Posts	153
Solutions	13
Karma Given	6
Karma Received	34
Member Since	‎01-09-2015

Online Status	Offline
Date Last Visited	‎01-23-2024 07:46 AM

need to delete column from the result generated af...

latest time values in search query

Why is timchart not working on lookup csv data?

remove the label in piechart

How to do column sorting in descending order after...

Dropdown panel issue- How do I get just one value ...

How to create a search for timechart plotting for ...

need time fields extracted as start and end time

How to estimate number of days left for disk to fu...

How to plot timechart graph with count of fruits f...

need to delete column from the result generated af...

latest time values in search query

Re: timchart not working on lookup csv data

Why is timchart not working on lookup csv data?

Re: column sorting in descending order after timec...

Re: Is there way to refresh a Simple XML drop-down...

Re: remove the label in piechart

Re: remove the label in piechart

Re: remove the label in piechart

remove the label in piechart

How to do column sorting in descending order after...

Dropdown panel issue- How do I get just one value ...

How to create a search for timechart plotting for ...

need time fields extracted as start and end time

Re: Using Ubuntu with Universal Forwarder to sent ...

Re: Classic Dashboard query - 3 visuals with 3 dif...

Re: Need to estimate number of days left for disk ...

How to estimate number of days left for disk to fu...

Re: need help with timechart command

How to plot timechart graph with count of fruits f...

Re: Getting Data in from SYSLOG / File Monitor

Re: Getting Data in from SYSLOG / File Monitor

What is the number of indexers allowed in a single...

Re: How to count the number of sessions with more ...

Re: How to count the number of sessions with more ...