Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- About felipesodre
felipesodre
Path Finder
Member since:
04-20-2020
11-17-2023
Community Statistics
| Posts | 27 |
| Solutions | 2 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 04-20-2020 |
Activity Feed
- Karma Re: Understanding Splunk Index Retention for woodcock. 09-30-2023 09:27 AM
- Karma Re: Understanding Splunk Index Retention for woodcock. 09-30-2023 09:27 AM
- Karma Re: Understanding Splunk Index Retention for gcusello. 09-30-2023 09:27 AM
- Karma Re: Understanding Splunk Index Retention for gcusello. 09-30-2023 09:27 AM
- Posted Re: Understanding Splunk Index Retention on Deployment Architecture. 09-30-2023 09:09 AM
- Posted Re: Understanding Splunk Index Retention on Deployment Architecture. 09-29-2023 05:33 PM
- Posted Re: Understanding Splunk Index Retention on Deployment Architecture. 09-29-2023 04:39 PM
- Posted Re: Understanding Splunk Index Retention on Deployment Architecture. 09-29-2023 04:03 PM
- Posted Re: Understanding Splunk Index Retention on Deployment Architecture. 09-29-2023 03:23 PM
- Posted Re: Understanding Splunk Index Retention on Deployment Architecture. 09-29-2023 02:39 PM
- Tagged Re: Understanding Splunk Index Retention on Deployment Architecture. 09-29-2023 02:39 PM
- Karma Re: Spath to convert array of json in multiple split lines for ITWhisperer. 09-29-2023 11:49 AM
- Posted Re: Understanding Splunk Index Retention on Deployment Architecture. 09-29-2023 11:41 AM
- Posted Understanding Splunk Index Retention on Deployment Architecture. 09-29-2023 11:24 AM
- Posted How to convert array of json in multiple split lines? on Splunk Search. 02-28-2022 06:32 AM
- Posted Find results that appears in a % of the cases and list the outliers on Splunk Search. 06-29-2021 01:12 PM
- Posted Re: Compare two searches on Alerting. 10-20-2020 05:35 AM
- Karma Re: Compare two searches for to4kawa. 10-20-2020 05:13 AM
- Posted Compare two searches on Alerting. 10-20-2020 03:48 AM
- Tagged Compare two searches on Alerting. 10-20-2020 03:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-30-2023
09:09 AM
Thank you for clarifying that 🙂
... View more
09-29-2023
05:33 PM
So, is it safe to assume that if no new data is ingested into this index the data should be gone by tomorrow (the same time I changed the config)? Thanks again
... View more
09-29-2023
04:39 PM
I am so confused as to why there are still buckets with data in which the endEpochTime is older than the "Searchable Retention" Thanks again
... View more
09-29-2023
04:03 PM
Hi, thank you for replying back. Settings: SmartStore: No Indexer clustering: No SF/RF Settings Splunk: SF=2, RF=3 Volume settings: Default settings Splunk Cloud: Yes Unfortunately, I am unable to run the "btool". However, I am able to run the following rest API query to gather the info from specific parameters for the mentioned index: | rest /services/data/indexes | join type=outer title [ | rest splunk_server=n00bserver /services/data/indexes-extended ] | search title=* | eval retentionInDays=frozenTimePeriodInSecs/86400 | table * What should be the parameters to look for? Thanks again.
... View more
09-29-2023
03:23 PM
@woodcock
... View more
09-29-2023
02:39 PM
gcusello Any guidance?
... View more
- Tags:
- index
09-29-2023
11:41 AM
I think I should also have mentioned that I have stopped ingestion onto this index for now. Until I figure out how to reduce the storage/clean the data.
... View more
09-29-2023
11:24 AM
Hi, and sorry if this question was already answered in any other thread. Thanks in advance for the help. I had an index in which the current size was over 10 GB, for deleting the data I tried to reduce it's max size and searchable retention. My question is what is going to happen with the data? Will it be deleted from the servers or archived? I am confused because I am seeing the event counts stuck with the same value as it was before changing the retention config. Previous index config: Current Size 10 GB, Max Size: 0, Event Count: 10M, Earliest Event: 5 Months, Latest Event: 1 day, Searchable Retention: 365 days, Archive Retention: blank, Self Storage: blank, Status: enabled Then, I changed the parameters "Max Size" to "200 MB" and "Searchable Retention" to "1 Day". Besides, when running the following query, I see the warm storage size pretty much with the same size (bouncing a few mbs). |dbinspect index=_internal *<index-name>*
| stats sum(sizeOnDiskMB) by state Any help greatly appreciated.
... View more
02-28-2022
06:32 AM
Any help is greatly appreciated.
How to convert the following json into a table?
{ "Summary":{ "jobType":"jobA", "summaryId":22746666, "objectsArchived":[ { "name":"tableA", "count":855 }, { "name":"tableB", "count":678 } ] } }
Jobtype | SummaryId | Table | Count
jobA. | 22746666. | tableA | 855
jobA. | 22746666 | tableB | 678
... View more
- Tags:
- "spath"
Labels
- Labels:
-
field extraction
-
other
06-29-2021
01:12 PM
Hi there, First of all, thank you for any comment. I am looking for a way to identify if I have any index missing across databases in my environment. So, I am logging in Splunk all indexes I have across the environment and the results looks like as following: [
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_a"
},
{
"indexrelname":" index_2",
"table":" tb_2",
"database":"db_a"
},
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_b"
},
{
"indexrelname":" index_2",
"table":" tb_2",
"database":"db_b"
},
{
"indexrelname":" index_1",
"table":" tb_1",
"database":"db_c"
},
Missing index_2 tb_2 here...
] So, as an example I would like to find the missing index "index_2" on the table "tb_2" on database "db_c". The result would be a table of missing index: database | table | indexrelname db_c | tb_2 | index_2 Does anyone able to help ?
... View more
10-20-2020
05:35 AM
The untable was the key for what I wanted. I just did a few adptations. I really appreciate your help here is my final solution: index=schedule TransactionPurgingSummary AND "\"newPurging\":true" | rex "TransactionPurgingSummary: (?<TransactionPurgingSummary>.*?})" | spath input=TransactionPurgingSummary | eval trans_date=strftime(_time, "%m-%d-%y") | search objectsPurgedSummary.transaction0 > 0 | stats sum(objectsPurgedSummary.transaction0) as transaction0, sum(objectsPurgedSummary.auxiliarymessage) as auxiliarymessage, sum(objectsPurgedSummary.transactionmessage) as b_transactionmessage, sum(objectsPurgedSummary.transactionmessagevalue) as transactionmessagevalue, sum(objectsPurgedSummary.trans_transactionmessages) as trans_transactionmessages, sum(objectsPurgedSummary.labelling_transaction_pfd_link_tb) as labelling_transaction_pfd_link_tb, sum(objectsPurgedSummary.labelling_transaction_alert_link_tb) as labelling_transaction_alert_link_tb by warehouse, trans_date | table trans_date, transaction0, auxiliarymessage, transactionmessage, transactionmessagevalue, trans_transactionmessages, labelling_transaction_pfd_link_tb, b_labelling_transaction_alert_link_tb | untable trans_date table_name b_rows | join warehouse, table_name, trans_date [search index="schedule" "uploaded to S3, number of rows:" | rex "File (?<table_name>.*?csv)" | eval table_name=substr(table_name, 0, len(table_name) - 28) | eval rows = replace(Success,"number of rows:","") | eval rows = substr(rows, 1, len(rows)-1) | eval trans_date=strftime(_time, "%m-%d-%y") | search trans_date=10-14-20 | stats sum(rows) as rows by warehouse, table_name, trans_date | table table_name, trans_date, rows]
... View more
10-20-2020
03:48 AM
Hi everybody, I hope someone can help me out. I appreciate any further comments. I have two searches that I have to compare but they have different formats: First search: index="schedule" "uploaded to S3, number of rows:" | rex "File (?<table_name>.*?csv)" | eval table_name=substr(table_name, 0, len(table_name) - 28) | eval rows = replace(Success,"number of rows:","") | eval rows = substr(rows, 1, len(rows)-1) | eval trans_date=strftime(_time, "%m-%d-%y") | search trans_date=10-14-20 | stats sum(rows) as rows by warehouse, table_name, trans_date | table table_name, trans_date, rows Second search: index=schedule TransactionPurgingSummary AND "\"newPurging\":true" | rex "TransactionPurgingSummary: (?<TransactionPurgingSummary>.*?})" | spath input=TransactionPurgingSummary | eval trans_date=strftime(_time, "%m-%d-%y") | search objectsPurgedSummary.transaction0 > 0 | stats sum(objectsPurgedSummary.transaction0) as b_transaction0, sum(objectsPurgedSummary.auxiliarymessage) as b_auxiliarymessage, sum(objectsPurgedSummary.transactionmessage) as b_transactionmessage, sum(objectsPurgedSummary.transactionmessagevalue) as b_transactionmessagevalue, sum(objectsPurgedSummary.trans_transactionmessages) as b_trans_transactionmessages, sum(objectsPurgedSummary.labelling_transaction_pfd_link_tb) as b_labelling_transaction_pfd_link_tb, sum(objectsPurgedSummary.labelling_transaction_alert_link_tb) as b_labelling_transaction_alert_link_tb by warehouse, trans_date | table trans_date, b_transaction0, b_auxiliarymessage, b_transactionmessage, b_transactionmessagevalue, b_trans_transactionmessages, b_labelling_transaction_pfd_link_tb, b_labelling_transaction_alert_link_tb I am aim creating an alert that compares the first query table_name and rows to the second query the value in the correspondent table name by tarns_date eg: transaction0 rows = b_transaction0
... View more
Labels
- Labels:
-
alert condition
07-10-2020
08:21 AM
Hi, sorry for the late reply and thanks for your help. For some reason your code works for some fields and others don't. Please see the image attached. Any ideas that might help? Is it possible to get the JSON of Purging_Results: {all content in here} using regex and then navigate to the fields using a spath?
... View more
- Tags:
- hi
07-09-2020
01:36 PM
Hi Everyone. Thanks in advance for any help. I am trying to extract some fields (Status, RecordsPurged) from a JSON on the following _raw text: {"": "INFO : 2020-07-09T01:11:08Z : [database@test.com]: {\"Purging_Results_Test\": {\"NewPurging\": 1, \"Status\":\"Successful\", \"VacuumEnabled\": true, \"RecordsPurged\": 6646, \"StartTime\":\"8-Jul-2020 18:03:07\", \"EndTime\":\"8-Jul-2020 18:11:08\", \"Duration(min)\":8.02}}"} Any Ideas that might help me out? Thank you so much.
... View more
06-26-2020
05:27 AM
Hi everyone, I am trying to parse a json data to a plain text formatted to use it in an email alert. Here is my JSON: { "DbMaintenanceDailyRoutineSummary": { "success": [ { "server-002": [ { "vacuum": true, "analyze": true, "warehouse": "mydatabase@aaaaaa" }, { "vacuum": true, "analyze": true, "warehouse": "mydatabase@bbbbbb" } ] }, { "server-003": [ { "vacuum": true, "analyze": true, "warehouse": "mydatabase@ccccccc" }, { "vacuum": true, "analyze": true, "warehouse": "mydatabase@ddddddd" } ] } ], "fail": [ { "server-002": [ { "vacuum": true, "analyze": false, "warehouse": "mydatabase@eeeeee" } ] }, { "server-003": [ { "vacuum": false, "analyze": true, "warehouse": "mydatabase@fffffff" }, { "vacuum": true, "analyze": false, "warehouse": "mydatabase@gggggg" }, { "vacuum": true, "analyze": false, "warehouse": "mydatabase@hhhhhh" } ] } ] } } Can I convert that JSON in something like the following: DbMaintenanceDailyRoutineSummary fail: server002: mydatabase@eeeeee: analyze: false, vacuum: true server003: mydatabase@fffffff - analyze: false, vacuum: true mydatabase@ggggg - analyze: false, vacuum: true success: server002: mydatabase@aaaaaa- analyze: true, vacuum: true mydatabase@bbbbbb - analyze: true, vacuum: true server003: mydatabase@ccccccc - analyze: false, vacuum: true mydatabase@dddddd - analyze: false, vacuum: true Any help appreciated.
... View more
Labels
- Labels:
-
alert action
-
email
-
other
06-25-2020
08:50 PM
Thanks for your help, appreciate it. But the solution presented is not I would like to have. I just want to change that part from this: "vacuum": true, "analyze": false, "warehouse": "mydatabase@hhhhhh" to this: "warehouse": "mydatabase@hhhhhh", "vacuum": true, "analyze": false
... View more
06-25-2020
09:36 AM
{ "DbMaintenanceDailyRoutineSummary": { "success": [ { "server-002": [ { "vacuum": true, "analyze": true, "warehouse": "mydatabase@aaaaaa" }, { "vacuum": true, "analyze": true, "warehouse": "mydatabase@bbbbbb" } ] }, { "server-003": [ { "vacuum": true, "analyze": true, "warehouse": "mydatabase@ccccccc" }, { "vacuum": true, "analyze": true, "warehouse": "mydatabase@ddddddd" } ] } ], "fail": [ { "server-002": [ { "vacuum": true, "analyze": false, "warehouse": "mydatabase@eeeeee" } ] }, { "server-003": [ { "vacuum": false, "analyze": true, "warehouse": "mydatabase@fffffff" }, { "vacuum": true, "analyze": false, "warehouse": "mydatabase@gggggg" }, { "vacuum": true, "analyze": false, "warehouse": "mydatabase@hhhhhh" } ] } ] } } I am wondering how can I convert this result in something like the following message to sent it as a alert by email. DbMaintenanceDailyRoutineSummary fail: server002: mydatabase@eeeeee: analyze: false, vacuum: true server003: mydatabase@fffffff - analyze: false, vacuum: true mydatabase@ggggg - analyze: false, vacuum: true success: server002: mydatabase@aaaaaa- analyze: true, vacuum: true mydatabase@bbbbbb - analyze: true, vacuum: true server003: mydatabase@ccccccc - analyze: false, vacuum: true mydatabase@dddddd - analyze: false, vacuum: true
... View more
Labels
- Labels:
-
field extraction
-
other
-
subsearch
-
table
04-23-2020
05:56 AM
Almost there but for some reason the Fields for ServerCount and ServerName are empty
{"VacuumTableWoodChipperFinish": {"DbName": "xxxx@xxx.com", "QueryTimeApproxSeconds": 141, "VacuumQuery": "vacuum analyze entity;", "VacuumCleanupQuery": "Select pg_terminate_backend(24862) from pg_stat_activity where pid = 24862 and query ='vacuum analyze entity;' and datname ='xxxx@xxx.com' and usename='xxxxxxx';->[(True,)]", "VacuumIsCompleteQuery": "Select * from pg_stat_activity where query ='vacuum analyze entity;' and datname ='xxxxx@xxx.com' and usename='xxxxxx' and state='active';->[]", "TableSize": "191 MB", "DbSize": "570 MB", "ServerName": "xxxxxxxxx"}}
... View more
04-22-2020
02:05 PM
Sorry, for not be clear.
I have much more Functions, but they all have the same Json template. What changes is just the name of the functions; instead of VacuumTaskStepFunctionBegin I have another one called LambdaTaskStepFunctionBegin and so on...
The idea is to group all transactions in a table and show how long it took to run and the number of servers and databases which the tasks ran.
As the following eg:
{
LambdaTaskStepFunctionBegin: {
NumberOfCustomers: 55
QueueURL: https://xxxxxxxxxx.fifo
}
}
{
LambdaFinish: {
DbName: xxxxx
DbSize: 55 GB
QueryTimeApproxSeconds: 20
ServerName: xxxxx
TableSize: 100 MB
Query: Select * from xxxxxxx;
}
}
... View more
04-22-2020
12:03 PM
I have multiple events in a server that I would like to get the timestamp from the very first transaction and the timestamp from the very last transaction for each feature, then get the timestamp difference between them in hours, in a table format.
My Json looks like:
--Multiples Begin events like this
{
VacuumTaskStepFunctionBegin: {
NumberOfCustomers: 55
QueueURL: https://xxxxxxxxxx.fifo
}
}
--Multiples finish events like this
{
VacuumTableFinish: {
DbName: xxxxx
DbSize: 55 GB
QueryTimeApproxSeconds: 20
ServerName: xxxxx
TableSize: 100 MB
Query: Select * from xxxxxxx;
}
}
I am looking for a result like this:
Function | Startime | Endtime | TimeProcessing | ServerCount | DB Count
VacuumTask | 03-04-2020 08:00 am| 03-05-2020 08:00 am| 24 hours | 10 | 55
But also I have more functions like this for other features so my end table would like this:
Function | Startime | Endtime | TimeProcessing | ServerCount. | DB Count
VacuumTask | 03-04-2020 08:00 am | 03-05-2020 08:00 am. | 24 hours. | 10 | 55
Importer | 03-04-2020 08:00 am | 03-05-2020 09:00 am | 1 hour | 20 | 35
Lambda |03-04-2020 08:00 am | 03-04-2020 20:00 am | 12 hours | 15 | 20
And so on. All events I have look like the JSON I posted below.
Thank you in advance.
... View more
04-22-2020
06:48 AM
Thank you all good! Please close the ticket.
... View more
04-20-2020
04:01 PM
Furthermore, Is there any way that I can configure the errors lines to redirect to the event errors?
Also, do you know how to format the field function to hide ".Error" eg: showing just: "EmailSettingsCorrection"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-17-2023
04:13 PM
|
Karma given to
