Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About sivaranjani
sivaranjani
Explorer
Member since:
04-27-2023
02-05-2025
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 04-27-2023 |
Activity Feed
- Karma Re: How to stats count by app name , and avg count per minute by app name together in one query for gcusello. 02-05-2025 10:14 AM
- Karma Re: How to stats count by app name , and avg count per minute by app name together in one query for gcusello. 02-05-2025 10:14 AM
- Posted Setup alert for two thresholds on Other Usage. 12-23-2024 11:32 AM
- Posted Alert when Avg duration greater than threshold on Alerting. 06-15-2024 04:23 PM
- Posted Dashboard Time range on Dashboards & Visualizations. 06-15-2024 10:59 AM
- Posted Re: How to stats count by app name , and avg count per minute by app name together in one query on Splunk Search. 06-15-2024 10:52 AM
- Posted How to stats count by app name , and avg count per minute by app name together in one query on Splunk Search. 06-14-2024 09:57 PM
- Posted Re: How to find second maximum value on Splunk Search. 05-26-2023 09:53 AM
- Posted How to find second maximum value on Splunk Search. 05-24-2023 09:28 PM
- Posted Re: How to find field with maximum value dynamically on Splunk Search. 04-27-2023 07:26 PM
- Karma Re: How to find field with maximum value dynamically for yeahnah. 04-27-2023 07:25 PM
- Posted How to find field with maximum value dynamically? on Splunk Search. 04-27-2023 03:08 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-23-2024
11:32 AM
I want to set up splunk alert that can have two threshold 1. if the time is between 8 AM to 5PM - alert if AvgDuration is greater than 1000ms
2. If time is between 5pm to next day 8AM - alert if avgduration is greater than 500ms
How do i implement this Query am working on
<mySearch>| bin _time span=1m|
stats avg(msg.DurationMs) AS AvgDuration by _time, msg.Service | where AvgDuration > 1000
... View more
06-15-2024
04:23 PM
I have a query that displays avg duration. How to i modify query to alert if avg ( duration) is greater than 1000 last 15 mins. index=tra cf_space_name="pr" "cf_app_name":"Sch" "msg"."Logging Duration" AND NOT "DistributedLockProcessor" |rename msg.DurationMs as TimeT |table _time TimeT msg.Service | bucket _time span=1m | stats avg(TimeT) as "Avg" by msg.Service
... View more
Labels
- Labels:
-
alert action
-
alert condition
06-15-2024
10:59 AM
How do i configure my splunk dashboard to display results from 8AM to the current time by default. I see options for Today or a specific date and timerange, but not a combination of both.
... View more
Labels
- Labels:
-
Classic dashboard
-
timechart
06-15-2024
10:52 AM
Thanks this is perfect. Exactly what i needed.
... View more
06-14-2024
09:57 PM
index=abc cf_space_name=prod-ad0000123 cf_app_name IN (RED,Blue,Green) "Initiating " OR "Protobuf message received" OR "Event Qualification Determined"
| bucket _time span=1m
| stats
count(eval(cf_app_name == "RED)) as RedVolume
count(eval(cf_app_name == "blue")) as BlueVolume
count(eval(cf_app_name == "Green")) as GreenVolume
avg(GreenVolume) as AvgGVolume
| eval estimate = (RED + Blue - Green) / AvgGVolume
... View more
Labels
- Labels:
-
stats
05-24-2023
09:28 PM
I have a search like this to fetch the maximum value. Now the case i wanted to add is, if the maximum value field is 4-step4 then i want my table to display second maximum value as the max step. Desired result Id Step that is taking maximum time maxtime 12345678 3-step3 33 | makeresults | eval _raw="{
\"Detail\": {
\"Id\": 12345678,
\"RequestCompleteTS\": \"2023-04-27T15:59:30.6960113-04:00\",
\"Steps\": {
\"0-step1\": 32,
\"0-step2\": 15,
\"3-step3\": 33,
\"4-step4\": 49,
\"5-step5\": 15,
\"6-step6\": 9,
\"7-step7\": 8
},
\"StepsCnt\": 18,
\"TargetRegion\": \"BRD\"
},
\"LogType\": \"Info\",
\"Message\": \"Success\",
\"Time\": \"2023-04-27 15:59:30.696--04:00\""
``` ^^^ create dummy event ^^^ ```
| spath
| rename Detail.Id AS Id Detail.Steps.* AS *
| foreach *step* [ eval Steps=if(isnull(Steps), '<<FIELD>>', mvappend(Steps, '<<FIELD>>')) ]
| eval steps_list_ordered=mvmap( mvsort(mvmap(mvdedup(Steps), len(Steps) . "-" . Steps)), substr(Steps, 3) )
,maxtime=mvindex(steps_list_ordered, mvcount(steps_list_ordered)-1)
| foreach *-step* [ eval "maxstep"=if('<<FIELD>>'=maxtime, "<<FIELD>>", if(isnotnull('maxstep'), 'maxstep', null())) ]
| rename maxstep AS "Step that is taking maximum time"
| table Id "Step that is taking maximum time" maxtime
... View more
Labels
- Labels:
-
table
04-27-2023
07:26 PM
Thank you very much. Exactly what i needed.
... View more
04-27-2023
03:08 PM
I have a data like this , and i want to display the step with maximum value.
Detail: { [-] Id: 12345678 RequestCompleteTS: 2023-04-27T15:59:30.6960113-04:00 Steps: { [-] 0-step1: 32 0-step2: 15 3-step3: 33 4-step4: 49 5-step5: 15 6-step6: 9 7-step7: 8 } StepsCnt: 18 TargetRegion: BRD } LogType: Info Message: Success Time: 2023-04-27 15:59:30.696--04:00
Desired Output
Id
Step that is taking maximum time
12345678
4-step4
... View more
Labels
- Labels:
-
field extraction
