Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mariamathewtel
mariamathewtel
Explorer
Member since:
12-30-2019
03-25-2021
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 1 |
| Member Since | 12-30-2019 |
Activity Feed
- Got Karma for Re: Time from a search. 03-25-2021 04:40 AM
- Posted Re: Time from a search on Splunk Search. 03-25-2021 03:55 AM
- Posted Re: Time from a search on Splunk Search. 03-25-2021 12:28 AM
- Karma Re: Time from a search for rnowitzki. 03-25-2021 12:27 AM
- Posted Re: Time from a search on Splunk Search. 03-25-2021 12:24 AM
- Tagged Re: Time from a search on Splunk Search. 03-25-2021 12:24 AM
- Karma Re: Time from a search for manjunathmeti. 03-25-2021 12:23 AM
- Posted Time from a search on Splunk Search. 03-23-2021 04:43 AM
- Posted Eval If Else with calculations on Splunk Search. 03-17-2021 07:51 AM
- Posted Re: How to specify a time range inside a search on Dashboards & Visualizations. 03-15-2021 03:27 AM
- Posted Re: How to specify a time range inside a search on Dashboards & Visualizations. 03-15-2021 02:13 AM
- Posted Status indicators and uptime calculation on Dashboards & Visualizations. 03-15-2021 12:27 AM
- Posted Re: How to extract fields from the logs on Dashboards & Visualizations. 09-23-2020 09:54 PM
- Posted How to extract fields from the logs on Dashboards & Visualizations. 09-23-2020 07:31 AM
- Posted Re: Error while adding new Oracle connection in DB connect app on All Apps and Add-ons. 08-23-2020 10:30 PM
- Tagged Re: Error while adding new Oracle connection in DB connect app on All Apps and Add-ons. 08-23-2020 10:30 PM
- Posted Re: Error while adding new Oracle connection in DB connect app on All Apps and Add-ons. 08-20-2020 10:36 PM
- Posted Error while adding new Oracle connection in DB connect app on All Apps and Add-ons. 08-20-2020 06:09 AM
- Tagged Error while adding new Oracle connection in DB connect app on All Apps and Add-ons. 08-20-2020 06:09 AM
- Tagged Error while adding new Oracle connection in DB connect app on All Apps and Add-ons. 08-20-2020 06:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-25-2021
03:55 AM
Hi @manjunathmeti , @rnowitzki , need one more help query works well and m getting the correct duration. here as you can see the duration is getting updated to the row when the Trend is 10(UP). i want it to be attached to the row where trend is 0(DOWN) so that i can display the downtime properly. Like below So that it can be displayed like below in a dashboard. (Only Downtime)
... View more
03-25-2021
12:28 AM
1 Karma
Hi @rnowitzki , This also works as required. 🙂 Thanks a lot for the help 🙂
... View more
03-25-2021
12:24 AM
Hi @manjunathmeti , this works just fine. exactly what i needed. Thanks a lot 🙂
... View more
- Tags:
- hi @
03-23-2021
04:43 AM
Hi All, I have a query like below. index="abc" host=xxx | eval Indicator=if(state=="RUNNING", "10", "0") | timechart span=5min min(Indicator) as "Trend" and it will give me results like below. I am trying to get the time(_time) value when there is a change in the value of Trend happens. eg myTime = 2021-03-18 16:55:00 (When trend changes from 10 to 0) myTime = 2021-03-18 17:25:00 (When trend changes from 0 to 10) Can someone please help me do it. Would really appreciate if someone can help with the difference between these times also. myTime = 2021-03-18 16:55:00 myTime = 2021-03-18 17:25:00 Difference = 30 minutes
... View more
Labels
- Labels:
-
eval
-
fields
-
other
-
search job inspector
-
timechart
03-17-2021
07:51 AM
Hi, I am stuck with this from last few days and i really need some help. M trying to create a gauge for displaying the uptime of an object. I have this query for checking the current status(last 5 min) of this object whether it is Running or not.(10 for running and 0 for Not). | eval Indicator=if(state=="RUNNING", "10", "0") | timechart span=5min min(Indicator) as "Trend" | eventstats latest(_time) as current | where current=_time | eval SI=if(Trend==0,"Currently Down","UP") If the value of SI is "Currently Down", then just display that. And if it is "UP" then need to do some calculations for the uptime. I have the query like below. | eval Indicator=if(state=="RUNNING", "10", "0") | timechart span=5min min(Indicator) as "Trend" | eval DownTime=if(Trend==0,_time,null()) ,current_time=now() | where isnotnull(DownTime) | eventstats latest(_time) as current | where current=_time | eval diff= (current_time-DownTime) ,Days=diff/86400 ,Days=if(match('Days',"^[\d\.]*$"),floor('Days'),'Days') ,mod1 = (diff%86400) ,Hours=mod1/3600 ,Hours=if(match('Hours',"^[\d\.]*$"),floor('Hours'),'Hours') ,mod2 = (diff%3600) , Minutes=mod2/60 ,Minutes=if(match('Minutes',"^[\d\.]*$"),floor('Minutes'),'Minutes') ,Seconds = (diff%60) | eval UpTime = Days." Days, ".Hours." Hours, ".Minutes." Minutes, ".Seconds." Seconds" | table UpTime Can someone please help me to merge these 2 queries to one so that if currently the state is not running it will show as "Currently Down" else it should show the uptime.
... View more
03-15-2021
03:27 AM
Hi @gcusello , For transpose command , i am getting an error like below Error in 'transpose' command: Numerical limit expected.
... View more
03-15-2021
02:13 AM
Hi @gcusello , Thanks for your reply. But it is not working. not sure how to get the duration
... View more
03-15-2021
12:27 AM
Hi, I am trying to build a dashboard with some status indicators and uptime gauges. Below are the few sample logs. 2021-02-21 13:48:42,744 (DEBUG) Thread_^[OP].* BATCH ID(31673) response (Internal Server Error, 500) 2021-02-21 13:48:42,741 (DEBUG) Thread_^[KL].* BATCH ID(62422) response (Internal Server Error, 500) 2021-02-21 13:48:31,620 (DEBUG) Thread_^[UV].* BATCH ID(40284) response (OK, 200) 2021-02-21 13:47:41,991 (DEBUG) Thread_^[OP].* BATCH ID(31672) response (OK, 200) Created a status indicator for last 10 minutes as in the below query. index="abc" | eval Indicator=if(Response=="(OK, 200)", "UP", "DOWN") | stats count(eval(if(Indicator="UP", 1, null()))) as UP_count count(eval(if(Indicator="DOWN", 1, null()))) as DOWN_count count(Indicator) as "TotalCount" | eval SI = case(UP_count>0,"UP", UP_count==0,"DOWN") | table SI Result will be either UP or DOWN. Now I am trying to create a uptime gauge which will display the time from which the value of SI is UP. For example, if the value of SI was DOWN for sometime and the connection restored and SI = UP from last 2 days, the uptime will be like 2 days, 30 minutes, 40 seconds Can anyone please help me with this.
... View more
Labels
- Labels:
-
other
09-23-2020
09:54 PM
Hi @richgalloway , Thanks for the reply. Host names are the highlighted bold ones. Critical_DISK: ABC - /var is at 99 % . Critical_DISK: DEF - /var/log is at 85 % . Critical_DISK: GHI - /var/log is at 90 % . Critical_DISK: JKL-MNO-PQR - /var/log is at 73 % . Critical_DISK: JKL-MNO-PQR - /var/log is at 85 % . Critical_DISK: JKL-MNO-PQR - /var/log is at 87 % . Critical_DISK: hkgtelpac-sg1.hkg2.oss - /var/log is at 85 % . [VMware vCenter - Alarm alarm.HostConnectivityAlarm] Host abcdefgh.in.reach.com in TGCN_PAD is not responding [zenoss] AB-CD-EFG 10.111.122.33 is DOWN! [zenoss] QWERTYU disk space threshold: 98.1% used (8.1GB free) [zenoss] asedfrt 10.20.30.40 is DOWN!
... View more
09-23-2020
07:31 AM
Hi All, I am having a set of logs from one of my ticketing system. I want to extract the Host name of the device that caused issue from the description. Critical_DISK: ABC - /var is at 99 % . Critical_DISK: DEF - /var/log is at 85 % . Critical_DISK: GHI - /var/log is at 90 % . Critical_DISK: JKL-MNO-PQR - /var/log is at 73 % . Critical_DISK: JKL-MNO-PQR - /var/log is at 85 % . Critical_DISK: JKL-MNO-PQR - /var/log is at 87 % . Critical_DISK: hkgtelpac-sg1.hkg2.oss - /var/log is at 85 % . [VMware vCenter - Alarm alarm.HostConnectivityAlarm] Host abcdefgh.in.reach.com in TGCN_PAD is not responding [zenoss] AB-CD-EFG 10.111.122.33 is DOWN! [zenoss] QWERTYU disk space threshold: 98.1% used (8.1GB free) [zenoss] asedfrt 10.20.30.40 is DOWN! These are some sample description. I used this rex statement : | rex field=_raw "^[^\\]\\n]*\\]\\s+(?P<HostName>\\w+)" but it is not properly extracting the hostname. Can someone please help me with this.
... View more
Labels
- Labels:
-
other
08-23-2020
10:30 PM
hi @richgalloway , Thanks for the reply. But i did the same setup in another server with same expired license and it was successful. So why is this happens to one server only?
... View more
- Tags:
- @
08-20-2020
10:36 PM
Hi @richgalloway , The errors in splunkd.log are :- 08-20-2020 02:13:28.815 +0800 ERROR TcpInputProc - Error encountered for connection from src=192.168.91.110:54671. Read Timeout Timed out after 600 seconds. 08-20-2020 02:13:30.614 +0800 ERROR TcpInputProc - Error encountered for connection from src=192.168.91.116:57329. Read Timeout Timed out after 600 seconds. 08-20-2020 15:31:47.454 +0800 ERROR TcpInputProc - Error encountered for connection from src=172.28.214.43:34054. Read Timeout Timed out after 600 seconds. 08-20-2020 15:31:47.813 +0800 ERROR TcpInputProc - Error encountered for connection from src=172.28.214.41:23511. Read Timeout Timed out after 600 seconds. 08-20-2020 15:31:47.882 +0800 ERROR TcpInputProc - Error encountered for connection from src=172.28.214.63:49707. Read Timeout Timed out after 600 seconds. 08-20-2020 15:31:48.263 +0800 ERROR TcpInputProc - Error encountered for connection from src=172.28.214.60:23087. Read Timeout Timed out after 600 seconds. 08-20-2020 15:31:49.236 +0800 ERROR TcpInputProc - Error encountered for connection from src=172.28.216.44:32187. Read Timeout Timed out after 600 seconds. 08-20-2020 18:35:05.684 +0800 ERROR ApplicationUpdater - Error checking for update, URL=https://apps.splunk.com/api/apps:resolve/checkforupgrade: Connect Timeout 08-20-2020 18:41:50.340 +0800 ERROR ApplicationUpdater - Error checking for update, URL=https://apps.splunk.com/api/apps:resolve/checkforupgrade: Connect Timeout Errors in splunk_app_db_connect_dbx.log :- 2020-08-20T18:38:24+0800 [ERROR] [__init__.py], line 201: [HTTP 500] Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK. 2020-08-20T20:56:29+0800 [ERROR] [__init__.py], line 201: [HTTP 500] Error in 'litsearch' command: Your Splunk license expired or you have exceeded your license limit too many times. Renew your Splunk license by visiting www.splunk.com/store or calling 866.GET.SPLUNK. Errors in splunk_app_db_connect_server.log :- 2020-08-20 19:13:29.021 +0800 [dw-56 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: fd3a7a3099a4a86d 2020-08-20 19:15:52.201 +0800 [dw-57 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: ce3de8cb966e2598 2020-08-20 20:36:59.795 +0800 [dw-58 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: 660c7169fe8b1252 2020-08-20 21:18:03.338 +0800 [dw-56 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: 2f988c7cd297e9e7 2020-08-20 21:18:27.249 +0800 [dw-60 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: fcb9fa36bb0dffd5 2020-08-20 21:18:31.971 +0800 [dw-56 - POST /api/connections/status] ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: 343a9b7f02b77722
... View more
08-20-2020
06:09 AM
Hi, I am facing an error while trying to establish a new Oracle connection in Splunk DB connect app. Added identities without any error. Below are the details. Error - There was an error processing your request. It has been logged (ID .....). Have configured java- /java/jdk1.8.0_251-amd64/ Installed Drivers - Oracle 12.1 Splunk Version - 8.0.4.1 DB Connect Version - 3.3.1 & Build:5 dbx_settings.conf => [java] javaHome = /usr/java/jdk1.8.0_251-amd64/ identities.conf => [Oracle_iden] disabled = 0 password = U2FsdGVkX1+cAT2Scp6riQGah0uCf5sGgSaFYe4qZ2U= use_win_auth = 0 username = admin inputs.conf => [http://db-connect-http-input] disabled = 0 token = DF5BE1B9-0C3A-47F7-8B69-5815C91222B4 ui-metrics-collector.conf => [collector] app_id = e3743b4e-9f25-4ccb-ac66-122fa9e48149 mode = on db_connections.conf => [Oracle_Conn] connection_type = oracle database = test disabled = 0 host = <hostname> identity = Oracle_iden jdbcUseSSL = false localTimezoneConversionEnabled = false port = 1521 readonly = false timezone = Australia/Sydney Can someone please help me to fix this issue.
... View more
Labels
- Labels:
-
configuration
07-03-2020
06:58 AM
Hi, Is there any way to change the color to Zero or picking from the given color range?
... View more
06-23-2020
04:25 AM
@to4kawa Thanks for the reply. I did not get the required results from your query. I will modify my requirement little bit as this will be more easier , I guess.... From the table - Incidents Status Resolved Date Closed Date INC001 Assigned INC001 Assigned INC001 Resolved 1/5/2020 2/5/2020 INC001 Closed 1/5/2020 2/5/2020 INC002 Assigned INC002 Resolved 8/5/2020 INC002 Resolved 8/5/2020 INC002 Closed 8/5/2020 10/5/2020 INC003 Assigned INC003 Pending INC004 Assigned INC004 Assigned INC004 Assigned INC004 Resolved 15/05/2020 INC004 Closed 15/05/2020 22/05/2020 INC004 Closed 15/05/2020 22/05/2020 INC005 Assigned INC005 Assigned INC005 In Progress INC005 Pending INC005 Pending If the incident is Resolved or Closed in any of the entries, remove all entries for that incident. OR, i want to have incidents which are not resolved or closed . Required Table Incidents Status Resolved Date Closed Date INC003 Assigned INC003 Pending INC005 Assigned INC005 Assigned INC005 In Progress INC005 Pending INC005 Pending
... View more
06-23-2020
04:23 AM
@ayush1906 Thanks for the reply. I am a newbie to splunk and not much hands on in JS. I will modify my requirement little bit as this will be more easier , I guess.... From the table - Incidents Status Resolved Date Closed Date INC001 Assigned INC001 Assigned INC001 Resolved 1/5/2020 2/5/2020 INC001 Closed 1/5/2020 2/5/2020 INC002 Assigned INC002 Resolved 8/5/2020 INC002 Resolved 8/5/2020 INC002 Closed 8/5/2020 10/5/2020 INC003 Assigned INC003 Pending INC004 Assigned INC004 Assigned INC004 Assigned INC004 Resolved 15/05/2020 INC004 Closed 15/05/2020 22/05/2020 INC004 Closed 15/05/2020 22/05/2020 INC005 Assigned INC005 Assigned INC005 In Progress INC005 Pending INC005 Pending If the incident is Resolved or Closed in any of the entries, remove all entries for that incident. OR, i want to have incidents which are not resolved or closed . Required Table Incidents Status Resolved Date Closed Date INC003 Assigned INC003 Pending INC005 Assigned INC005 Assigned INC005 In Progress INC005 Pending INC005 Pending
... View more
06-23-2020
02:17 AM
Hi, I have a table like below where multiple entries of same ticket numbers are displaying as these are taken from the logs receiving from the ticketing system. Incidents Status Resolved Date Closed Date INC001 Assigned INC001 Assigned INC001 Resolved 1/5/2020 2/5/2020 INC001 Closed 1/5/2020 2/5/2020 INC002 Assigned INC002 Resolved 8/5/2020 INC002 Resolved 8/5/2020 INC002 Closed 8/5/2020 10/5/2020 INC003 Assigned INC003 Pending INC004 Assigned INC004 Assigned INC004 Assigned INC004 Resolved 15/05/2020 INC004 Closed 15/05/2020 22/05/2020 INC004 Closed 15/05/2020 22/05/2020 If the ticket is actually closed, I want to fill the closed date column of each incident with the actual closed date. Incidents Status Resolved Date Closed Date INC001 Assigned 2/5/2020 INC001 Assigned 2/5/2020 INC001 Resolved 1/5/2020 2/5/2020 INC001 Closed 1/5/2020 2/5/2020 INC002 Assigned 10/5/2020 INC002 Resolved 8/5/2020 10/5/2020 INC002 Resolved 8/5/2020 10/5/2020 INC002 Closed 8/5/2020 10/5/2020 INC003 Assigned INC003 Pending INC004 Assigned 22/05/2020 INC004 Assigned 22/05/2020 INC004 Assigned 22/05/2020 INC004 Resolved 15/05/2020 22/05/2020 INC004 Closed 15/05/2020 22/05/2020 INC004 Closed 15/05/2020 22/05/2020 Can someone please help me.
... View more
06-15-2020
10:41 PM
Hi @anilchaithu , Restarted lready and the services are up and running. URL is also displaying. But not able to access it.
... View more
06-15-2020
10:38 PM
hi @gcusello , Thanks for the reply. I am trying to connect within a single network and no firewall is blocking there. Telnet is connecting.
... View more
06-15-2020
06:46 AM
Hi, I am trying to access Splunk web. Enabled web server. Splunkd & splunk webserver both are running. Configured web.conf file in local folder with httpport as 8000 and the port is listening. While trying to access the web interface using the host name it is giving error as "This site can’t be reached". While trying to access via IP address getting error as "Network Error (tcp_error) A communication error occurred: "Operation timed out" The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time.". Can someone please help to fix this.
... View more
Labels
