About vivekkumarkk

vivekkumarkk · ‎10-02-2021

Thank You @ITWhisperer 😌

vivekkumarkk · ‎10-01-2021

Thanks for the response. My SPL may not be right. You can find the raw data: {"delete_me": "True", "vendor": "Dbruzy", "site": "India", "type": "Sales", "name": "Rahul", "date": ["10-jan-2022", "30-dec-2022"], "count_target": ["1700", "300"]} SPL I corrected in below way: my index | rename count_target{} as target | rename Date{} as voltage | foreach voltage* [ eval voltage=mvappend(voltage, '<<FIELD>>')] | foreach target* [ eval target=mvappend(target, '<<FIELD>>')] | mvexpand target| mvexpand voltage | stats values(voltage) as Date values(target) as Count_Target by Vendor, Name,Site,Type

vivekkumarkk · ‎10-01-2021

I have my splunk Jason in below format { [-] delete_me: True vendor: Dbruzy name: Rahul date: [ [-] 10-jan-2022 30-dec-2022 ] count_target: [ [-] 1700 300 ] site: India type: Sales } I am looking for a query to get output like this: Vendor Name Date Count_Target Site Type Dbruzy Rahul 10-jan-2022 1700 India Sales Dbruzy Rahul 30-dec-2022 300 India Sales But I am getting as below: Vendor Name Date Count_Target Site Type Dbruzy Rahul 10-jan-2022 30-dec-2022 1700 300 India Sales Dbruzy Rahul 10-jan-2022 30-dec-2022 1700 300 India Sales Query I am using: my index | rename count_target{} as target | rename Date{} as voltage | spath input=voltage path=voltage output=someOtherField | spath input=someOtherField | foreach voltage* [ eval voltage=mvappend(voltage, '<<FIELD>>')] | spath input=target path=target output=someOtherField1 | spath input=someOtherField1 | foreach target* [ eval target=mvappend(target, '<<FIELD>>')] | mvexpand target| mvexpand voltage | stats values(voltage) as Date values(target) as Count_Target by Vendor, Name,Site,Type Can you please help?

vivekkumarkk · ‎05-05-2021

Hello, I have a lookup file with below data. This auto populates everyday from a scheduled query. Feature Feature1 Feature 2 Feature 3 . . . I need to send a pdf to my colleagues from a dashboard with line chart based on each feature. I tried Trellies, but 7.x version splunk donot support pdf delivery. | inputcsv 85PercUsage.csv | stats values(feature) AS extendfeat | mvexpand extendfeat | append [| makeresults | eval extendfeat=""] | map search="search index=usage sourcetype=usedfeature=\"$extendfeat$\" earliest=-1d@d+11h+30m latest=@d+11h+30m| bin _time span=5m | stats sum(quantity) as MaxUSed by feature,_time | timechart span=5m max(MaxUSed) as LicUsed by feature" maxsearches=100

vivekkumarkk · ‎02-15-2021

My problem is, there are 2 block fields. The sum of Side should be only from 2 blocks. With the above query, its sums up all the side field. The query must select field side for rectangle from each block for any user within the selected time and sum only the sum of sides (here it is 8 ) always. It should not add another 4 if user B uses from Block 1 only. Thats why I tried with foreach.

vivekkumarkk · ‎02-14-2021

Hello, I have a data stream getting populated every 5 minutes as below. There are 100s of features in the data. Feature: Rectagle Side: 4 User: A Used:1 Time: 1/25/2021 5:00:00 Block:1 Feature: Rectagle Side: 4 User: A Used:1 Time: 1/25/2021 5:00:00 Block:2 Feature: square Side: 4 User: B Used:1 Time: 1/25/2021 5:05:00 Block:1 Feature: Square Side: 4 User: B Used:1 Time: 1/25/2021 5:05:00 Block:2 I need to sum the side for each side field along with the used column Something as below. Feature: Rectangle Side: 8 used:2 Time: 1/25/2021 5:00:00 The problem I have is, I could not sum the side either it comes as total across all events (it can be 4 * number of times it access across the period I selected) or 4. I am searching for a period of last 24 hours. I tried with this, but not giving right value. | foreach feature* [ eval subtotal = subtotal + 'side'] | stats max(subtotal) as TOTAL by _time

vivekkumarkk · ‎10-16-2020

@kamlesh_vaghela . This is super cool. Is it possible to create an exclude csv and donot show the acknowledged data in the table again say for x number of days that a user inputs?

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎10-16-2020

Online Status	Offline
Date Last Visited	‎10-03-2021 02:14 AM

Json key value mapping

Passing inputlookup to send pdf email from dashboa...

Sum specific field value across all events

Re: Json key value mapping

Re: Json key value mapping

Json key value mapping

Passing inputlookup to send pdf email from dashboa...

Re: Sum specific field value across all events

Sum specific field value across all events

Re: Need help in applying checkbox in splunk table...