Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nouraali
nouraali
Explorer
Member since:
02-23-2021
06-23-2022
Community Statistics
| Posts | 12 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-23-2021 |
Activity Feed
- Posted Is it possible to relate the issues displayed in Splunk UI to OS data or Splunk logs? on Monitoring Splunk. 06-23-2022 05:42 AM
- Posted Splunk ITSI Alerting-is a way to trigger a notable event, when the status is critical,? on Splunk IT Service Intelligence. 05-11-2022 05:24 AM
- Posted Re: How to use eval with mstats on Splunk Search. 08-27-2021 02:51 AM
- Posted Re: How to use eval with mstats on Splunk Search. 08-19-2021 02:11 AM
- Posted How to use eval with mstats on Splunk Search. 08-18-2021 01:42 AM
- Tagged How to use eval with mstats on Splunk Search. 08-18-2021 01:42 AM
- Tagged How to use eval with mstats on Splunk Search. 08-18-2021 01:42 AM
- Tagged How to use eval with mstats on Splunk Search. 08-18-2021 01:42 AM
- Tagged Splunk App for Unix and Linux props.conf fields are not calculated on Splunk Search. 07-06-2021 11:02 AM
- Posted Splunk App for Unix and Linux props.conf fields are not calculated on Splunk Search. 07-06-2021 07:30 AM
- Posted Re: Create Missing Records of a Timechart on Splunk Dev. 05-24-2021 03:24 AM
- Posted Re: Create Missing Records of a Timechart on Splunk Dev. 05-23-2021 08:16 AM
- Posted Create Missing Records of a Timechart on Splunk Dev. 05-21-2021 01:18 PM
- Tagged Create Missing Records of a Timechart on Splunk Dev. 05-21-2021 01:18 PM
- Posted Re: How to produce empty time buckets on Deployment Architecture. 05-21-2021 01:48 AM
- Posted Re: Splunk Free License on Reporting. 02-28-2021 10:09 AM
- Posted Splunk Free License on Reporting. 02-23-2021 02:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-23-2022
05:42 AM
Hello,
Is it possible to relate the issues displayed in Splunk UI (attached below) to OS data or Splunk logs:
In other words, Given the OS metrics(RAM,CPU,SWAP,....) of the servers hosting Splunk and Splunk logs, can we relate some trends in this data to below issues:
The percentage of high priority searches lagged (33%) over the last 24 hours is very high and exceeded the yellow thresholds (10%) on this Splunk instance. Total Searches that were part of this percentage=18. Total lagged Searches=6
The percentage of small buckets created over the last hour is high and exceeded the red thresholds for index=..., and possibly more indexes, on this indexer. At the time this alert fired, total buckets created=13, small buckets=11
The percentage of non high priority searches delayed (54%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=574144. Total delayed Searches=314696
Search peer down
Disk space/file system under this mount point ... is exceeding the limits 80%
Would really appreciate your response.
... View more
05-11-2022
05:24 AM
hello,
Q1 While configuring #splunk_itsi KPI, under the thresholding section there is an option to Enable KPI Alerting.
As below, the notable event is created when the severity changes from any lower level to critical.
My question is that if there is a way to trigger a notable event, when the status is critical, regardless of the state it was before.
In other words, when the severity remains critical from the 1st check point to the second check point, i need a notable event to be created in this case as well, is that possible ?.
Q2 After configuring #splunk_itsi correlation search as described here , i wasn't able to see notable events created in the episode review. I have already configured the search in the correlation search, and added associated services, so the final search is as below:
index="itsi_summary" kpi IN ("SH * RAM Static","SH * CPU Adaptive","SH * CPU Static","SH * RAM Adaptive","SH * SWAP") alert_level>1
| `filter_maintenance_services("400f819c-f739-4ffc-a25c-86d48362fef8,917c4030-a422-4645-851e-a5b2b5c7f3cd,7fb610b4-15f2-4d21-b035-b4857c9effef,28aa0103-fb41-4382-ab07-c637c16d3d85,bfe94d80-daf5-43b8-8318-dc881fd30128,b3c8562a-d1d6-465a-b0c7-4a28ba7f4612,225e7eb6-2f7c-4f0f-9221-75b1e8471053,a0826af0-2100-44a4-9b51-558bff966bb7,dcb38bc4-e930-4776-92a8-5de0d50cdc5e,721cb2c5-43fa-4419-9dde-a33a467d7770,328b9170-18d3-4b50-9968-01b1e087f955")`
When i run the search it returns the events, so i am not expecting something wrong in the search query. What am i missing, in order to get the notable events visible in the episodes review tab?
Appreciate your help.
... View more
Labels
- Labels:
-
using ITSI
08-27-2021
02:51 AM
This works only on events index, while the data i am searching is stored in metrics index.
... View more
08-18-2021
01:42 AM
Hi, I want to run something similar to the below on metrics data stored in metrics index, can you please assist: eval ip34 = if(ip=="37.25.139.34",1,0) ,ip35 = if(ip=="37.25.139.35",1,0)
| mstats sum(ip34) , sum(ip35) ,
avg(bytes) , stdev(bytes) , median(bytes)
avg(response_time_s) , stdev(response_time_s) , median(response_time_s)
where index=sfp_metrics earliest=-5m@m latest=@m span=1m by uri It gives me: Any idea how to achieve this would be appreciated. Best Regards,
... View more
Labels
- Labels:
-
eval
07-06-2021
07:30 AM
Hi, Given the below system architecture on a single server: 1. When I pass the OS data generated by the Splunk addon (Splunk App for Unix and Linux) through the universal forwarder to Splunk single instance. I get fields like UsedBytes, PercentMemory, pctCPU,.. as below: 2. But when I pass the OS data generated by the Splunk addon (Splunk App for Unix and Linux) through the universal forwarder to Cribl, then from Cribl to Splunk single instance. These fields are not computed as below: As per my understanding, these extra fields are computed with the help of the props.conf file in the path /opt/SP/splunk/splunkforwarder/etc/apps/Splunk_TA_nix/default. But i don't get why this file is not taking effect or why the fields are not getting calculated when passed from UF to Cribl to Splunk. Any idea how to pass the data from universal forwarder to Cribl then to Splunk(path no. 2) and get the extra fields to be calculated. Best Regards, Noura Ali
... View more
- Tags:
- props.conf
Labels
- Labels:
-
field extraction
-
fields
05-24-2021
03:24 AM
When i specify a time window of 4 mins (5/18/21 2:01:00.000 AM to 5/18/21 2:05:00.000 AM), the query returns all URIs . when i specify a time window of 2 mins (5/18/21 2:01:00.000 AM to 5/18/21 2:03:00.000 AM), the query returns the records for the existing URIs in that time window, in my case URI=a. So the issue occurs when the time window in which i am running the search is not having events with URI=b. However, i was able to sort this out by using: | sort _time | append [| inputlookup uri.csv | table uri] | rename _time AS t | filldown t | rename t AS _time | dedup _time uri This way a record will be created for URI=b in the last bucket in the time window.
... View more
05-21-2021
01:18 PM
Hi , given the below input (4 mins of sample access log data): _time,URI,Bytes 2021-05-18 02:01:00,a,1 2021-05-18 02:01:00,a,1 2021-05-18 02:02:00,a,1 2021-05-18 02:03:00,b,1 2021-05-18 02:03:00,b,1 2021-05-18 02:04:00,a,1 assuming a window of 2 mins from (2:01:00.000 ) to (2:03:00.000), i want to perform some computations (average and standard dev of bytes grouped by URI) as below: source="ds1.csv" host="vgspl11hr" index="sfp" sourcetype="csv" | table _time,URI,Bytes | timechart span=1m avg(Bytes) AS avg_bytes, stdev(Bytes) AS std_bytes by URI limit=0 | fillnull value="" | untable _time Measure Value | eval Metric=mvindex(split(Measure,": "),0),uri=mvindex(split(Measure,": "),1) | fields - Measure | eval time_uri=_time."__".uri | fields - uri - _time | xyseries time_uri Metric Value | eval _time=mvindex(split(time_uri,"__"),0),uri=mvindex(split(time_uri,"__"),1) | fields - time_uri exact time window between (5/18/21 2:01:00.000 AM to 5/18/21 2:03:00.000 AM), below is the output: _time uri avg_bytes std_bytes 2021-05-18 02:01:00 a 1 0 2021-05-18 02:02:00 a 1 0 So, the timechart performed the computations on the existing URIs in the first 2 mins time window, in that case the URI=a. However, i want the timechart to consider the existence of the URI = b. Is there a way to have the timechart consider all the values of the URI in the computation, even if not all of the URIs existing in that time window? I need the output to be as below in the first 2 mins time window: _time uri avg_bytes std_bytes 2021-05-18 02:01:00 a 1 0 2021-05-18 02:01:00 b 2021-05-18 02:02:00 a 1 0 2021-05-18 02:02:00 b Is that possible? I would really appreciate if you helped me.
... View more
- Tags:
- timechart
Labels
- Labels:
-
Splunk Web Framework
05-21-2021
01:48 AM
Hi , given the below input (4 mins of sample access log data): _time,URI,Bytes 2021-05-18 02:01:00,a,1 2021-05-18 02:01:00,a,1 2021-05-18 02:02:00,a,1 2021-05-18 02:03:00,b,1 2021-05-18 02:03:00,b,1 2021-05-18 02:04:00,a,1 assuming a window of 2 mins, i want to perform some computations (average and standard dev of bytes grouped by URI) as below source="ds1.csv" host="vgspl11hr" index="sfp" sourcetype="csv" | table _time,URI,Bytes | timechart span=1m avg(Bytes) AS avg_bytes, stdev(Bytes) AS std_bytes by URI limit=0 | fillnull value="" | untable _time Measure Value | eval Metric=mvindex(split(Measure,": "),0),uri=mvindex(split(Measure,": "),1) | fields - Measure | eval time_uri=_time."__".uri | fields - uri - _time | xyseries time_uri Metric Value | eval _time=mvindex(split(time_uri,"__"),0),uri=mvindex(split(time_uri,"__"),1) | fields - time_uri with 2-min time window between (5/18/21 2:01:00.000 AM to 5/18/21 2:03:00.000 AM), below is the output: _time uri avg_bytes std_bytes 2021-05-18 02:01:00 a 1 0 2021-05-18 02:02:00 a 1 0 So, the timechart performed the computations on the existing URIs in the first 2 mins time window, in that case the URI=a. but i want the timechart to consider the existence of the URI = b. Is there a way to have the timechart consider all the values of the URI in the computation, even if not all of the URI have values in the time window? I need the output to be as below in the first 2 mins time window: _time uri avg_bytes std_bytes 2021-05-18 02:01:00 a 1 0 2021-05-18 02:01:00 b 2021-05-18 02:02:00 a 1 0 2021-05-18 02:02:00 b Is that possible?
... View more
02-28-2021
10:09 AM
Hi, Thanks for the clarification. But apart from the dev/test license, can i use the features below: 1- scheduled searches I am not able to schedule searches; by clicking settings - > searches - > new search - > once it is created - > click on edit - > no schedule option in the drop down menu 2- summary index I am not able to create summary indexes ; by clicking settings - > searches - > new search - > once it is created - > click on edit - > no summary index option in the drop down menu. I would appreciate if you guided me how to try the mentioned features with free license. Best Regards, Noura Ali
... View more
02-23-2021
02:32 AM
Hi, Hope you are fine. Please note that I am currently using Splunk for self-learning. The enterprise trial license expired and now I am using the free trial. I thought using the free trial would allow me to schedule searches as mentioned here , but in fact I am not able to schedule searches. I really need to use this feature, for my training, before starting my new job. Not sure what are the next steps to get this feature. Please assist. Best Regards, Noura Ali
... View more
Labels
- Labels:
-
scheduled search
-
summary indexing
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-23-2022
11:55 AM
|
