Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About 3666142
3666142
Path Finder
Member since:
07-17-2019
04-04-2024
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 07-17-2019 |
Activity Feed
- Posted Re: Count of rows with a value greater than 0 on Splunk Enterprise. 04-04-2024 06:21 AM
- Posted Count of rows with a value greater than 0 on Splunk Enterprise. 04-03-2024 11:40 AM
- Posted Splunk Alerts: How to use email address from variable? on Alerting. 03-02-2023 07:02 AM
- Posted Labels on Dashboard UI on Dashboards & Visualizations. 06-23-2021 11:28 AM
- Karma Re: Single Value Color Change for kamlesh_vaghela. 06-23-2021 11:12 AM
- Posted Re: Single Value Color Change on Splunk Search. 06-22-2021 09:55 AM
- Posted Single Value Color Change on Splunk Search. 06-22-2021 08:15 AM
- Karma Re: How to span through log timestamps instead of _time for adonio. 06-05-2020 12:50 AM
- Karma Re: How to span through log timestamps instead of _time for jaime_ramirez. 06-05-2020 12:50 AM
- Karma Re: How to span through log timestamps instead of _time for jaime_ramirez. 06-05-2020 12:50 AM
- Karma Re: How to span through log timestamps instead of _time for jaime_ramirez. 06-05-2020 12:50 AM
- Karma Re: Line graph: Count per hour with a trendline that plots the average count every 24 hours. for dmarling. 06-05-2020 12:50 AM
- Karma Re: Filter a Chart with Values Greater Than some Integer. for memarshall63. 06-05-2020 12:50 AM
- Posted Re: Filter a Chart with Values Greater Than some Integer. on Splunk Search. 08-26-2019 04:04 AM
- Posted Re: Filter a Chart with Values Greater Than some Integer. on Splunk Search. 08-26-2019 04:01 AM
- Posted Re: Filter a Chart with Values Greater Than some Integer. on Splunk Search. 08-26-2019 04:00 AM
- Posted Filter a Chart with Values Greater Than some Integer. on Splunk Search. 08-23-2019 11:01 AM
- Tagged Filter a Chart with Values Greater Than some Integer. on Splunk Search. 08-23-2019 11:01 AM
- Tagged Filter a Chart with Values Greater Than some Integer. on Splunk Search. 08-23-2019 11:01 AM
- Tagged Filter a Chart with Values Greater Than some Integer. on Splunk Search. 08-23-2019 11:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-03-2024
11:40 AM
How do a get a count of rows that have a value greater than 0? Example below. The last column is what we are trying to generate. Name 2024-02-06 2024-02-08 2024-02-13 2024-02-15 Count_Of_Rows_with_Data
Pablo 1 0 1 0 2
Eli 0 0 0 0 0
Jenna 1 0 0 0 1
Chad 1 0 5 0 2
... View more
Labels
- Labels:
-
Analytics Workspace
-
splunk-assist
03-02-2023
07:02 AM
We have data set up like this:
{
email:JohnSmith@Company.com
Count:100
},
{
email:DavidHarris@Company.com
Count:50
},
{
email:ChuckNorris@Company.com
Count:90
}
I want to set up an alert where a specific person will be emailed if their alert is > 80, but I want to use the email field. So I want Chuck to get an email and John to get a separate email. David does not get an alert because the count did not break the threshold.
In the alert setup, can I put $email$ in the "To: " part of the send email action??
... View more
Labels
- Labels:
-
alert action
-
email
06-23-2021
11:28 AM
I have a panel (shown below) and I want to change its color. The panel is called Application Name and I want it to be purple. How do I do that? In other words, I want "sad-api" to be purple not white.
... View more
Labels
- Labels:
-
Dashboard Studio
-
other
-
panel
-
simple XML
06-22-2021
09:55 AM
Close, but not exactly there. It's one panel. This query index=index_name | rename msg.event.healthStatus as healthStatus | dedup healthStatus | table healthStatus The table will only show the healthStatus. healthStatus will only equal UP or DOWN. If the value of healthStatus is UP, I want the word UP to be green. If the value of healthStatus is DOWN, I want it to be RED. Only one value will be displayed at a time because I want it to be a single value display.
... View more
06-22-2021
08:15 AM
I have a panel that is a single value that only shows the Health Status as "UP" or "DOWN". If it is "UP" I want it to be green. If it is "DOWN" I want it to be red. How can I do this in the source code? This is a query the shows what the panel is doing. index=index_name | rename msg.event.healthStatus as healthStatus | dedup healthStatus | table healthStatus
... View more
Labels
- Labels:
-
other
08-26-2019
04:04 AM
That is exactly what I needed. Thank you!
... View more
08-26-2019
04:01 AM
Sorry cleanseTime is actually timeDiff. Let me fix it.
... View more
08-26-2019
04:00 AM
I have tried that and I get no results.
... View more
08-23-2019
11:01 AM
I have this query (time is in milliseconds and I converted it to seconds):
index=ABCD source=EFGH
| bin span=5m _time
| eval timeDiff=(endTime-startTime)/1000
| timechart span=5m eval(round(avg(timeDiff),3))
It gives me this data:
_time=13:45:00 timeDiff=0.479
_time=13:45:05 timeDiff=1.716
_time=13:45:10 timeDiff=1.276
_time=13:45:15 timeDiff=0.627
_time=13:45:20 timeDiff=1.771
_time=13:45:25 timeDiff=0.855
_time=13:45:30 timeDiff=1.670
I am trying to create a chart that displays all the timeDiff that are > 1. (I am ok with the blank values.)
Example:
_time=13:45:00
_time=13:45:05 timeDiff=1.716
_time=13:45:10 timeDiff=1.276
_time=13:45:15
_time=13:45:20 timeDiff=1.771
_time=13:45:25
_time=13:45:30 timeDiff=1.670
I was thinking about doing something with the where argument, but I'm not sure.
If someone could help me out that would be awesome! Thank you.
... View more
08-06-2019
10:16 AM
I didn't get the response that I wanted, but thank you for the help. Turns out my client does not need a trendline anymore. Sorry for the inconvenience.
... View more
08-01-2019
06:06 AM
Let me get back to you on this. I am waiting for the client to send me more data so I can properly test this. Thank you for the help. I'll let you know if this works or not.
... View more
08-01-2019
05:55 AM
Here is an example of the data that I'm ingesting. I did have to take irrelevant data out because of confidentiality reasons.
{
end: 2019-07-18 14:59:51.904915
start: 2019-07-18 14:59:47.734263
exampleInteger: 417
}
So I am given a start/end timestamp. I have successfully create a line graph (it graphs on on the end timestamp as the x axis) that plots a count of all the events every hour. For example, between 2019-07-18 14:00:00.000000 AND 2019-07-18 14:59:59.999999, I got a count of 7394. I want to take that 7394, along with 23 other counts throughout (because there are 24 hours in a day), and average them. For example:
2019-07-18 00:00:00.000000 AND 2019-07-18 00:59:59.999999 COUNT: 7394
2019-07-18 01:00:00.000000 AND 2019-07-18 01:59:59.999999 COUNT: 8053
2019-07-18 02:00:00.000000 AND 2019-07-18 02:59:59.999999 COUNT: 7265
2019-07-18 03:00:00.000000 AND 2019-07-18 03:59:59.999999 COUNT: 7237
2019-07-18 04:00:00.000000 AND 2019-07-18 04:59:59.999999 COUNT: 7656
2019-07-18 05:00:00.000000 AND 2019-07-18 05:59:59.999999 COUNT: 7528
2019-07-18 06:00:00.000000 AND 2019-07-18 06:59:59.999999 COUNT: 7948
2019-07-18 07:00:00.000000 AND 2019-07-18 07:59:59.999999 COUNT: 7254
2019-07-18 08:00:00.000000 AND 2019-07-18 08:59:59.999999 COUNT: 7744
2019-07-18 09:00:00.000000 AND 2019-07-18 09:59:59.999999 COUNT: 7752
2019-07-18 10:00:00.000000 AND 2019-07-18 10:59:59.999999 COUNT: 7936
2019-07-18 11:00:00.000000 AND 2019-07-18 11:59:59.999999 COUNT: 7410
2019-07-18 12:00:00.000000 AND 2019-07-18 12:59:59.999999 COUNT: 7047
2019-07-18 13:00:00.000000 AND 2019-07-18 13:59:59.999999 COUNT: 7008
2019-07-18 14:00:00.000000 AND 2019-07-18 14:59:59.999999 COUNT: 7394
2019-07-18 15:00:00.000000 AND 2019-07-18 15:59:59.999999 COUNT: 7647
2019-07-18 16:00:00.000000 AND 2019-07-18 16:59:59.999999 COUNT: 7954
2019-07-18 17:00:00.000000 AND 2019-07-18 17:59:59.999999 COUNT: 7541
2019-07-18 18:00:00.000000 AND 2019-07-18 18:59:59.999999 COUNT: 7145
2019-07-18 19:00:00.000000 AND 2019-07-18 19:59:59.999999 COUNT: 7421
2019-07-18 20:00:00.000000 AND 2019-07-18 20:59:59.999999 COUNT: 7045
2019-07-18 21:00:00.000000 AND 2019-07-18 21:59:59.999999 COUNT: 7453
2019-07-18 22:00:00.000000 AND 2019-07-18 22:59:59.999999 COUNT: 7155
2019-07-18 23:00:00.000000 AND 2019-07-18 23:59:59.999999 COUNT: 7124
The average of this 24 hour period would be 7462
I need a line graph that shows the past months worth of data. On this graph, I have to lines: the first lines is the hour per hour count and the other is the 24 hour average of those hour per hour counts.
I hope I might that clear... I know it's a lot of information. Thank you.
... View more
08-01-2019
05:05 AM
Not exactly. I see where you were going with it, but the average create became a constant value. Plus, I don't know to work it with the previous query. Thank you! I appreciate the help.
... View more
07-25-2019
10:22 AM
I have a line graph that displays the number of transactions per hour. I want a trendline to go with it, but I want it to give me the average transactions every 24 hours. I have to use epochTime because I'm using the client's timestamp instead of Splunk's _time.
In other words, the query works except the trendline is plotting the average every hour instead of every 24 hours
index=ABCD
| eval epochTime=strptime(end, "%Y-%m-%d %H:%M:%S.%6N")
| bin epochTime span=1h
| stats count as "Transactions" by epochTime
| convert ctime(epochTime) as epochTime
| trendline sma2("Transactions") as Trend
Do you think I should create another bin for the trendline?
If someone could help me out that would absolutely amazing! Thank you.
... View more
07-23-2019
09:30 AM
Thank you. That definitely put me in the right direction.
... View more
07-22-2019
12:29 PM
I am trying to find the difference between today and yesterday's data. The data consists of every employee's Id number and first/last name. So I just want to know if the company hired within the last day. This is the search query that I currently have. Does the "earliest" and "latest" format make sense (like the -1d@d). Also, if there is not a difference between the two days, how do I have Splunk display a chart that says, "No diff."? Thanks.
| set diff
[ search index="ABCD" (earliest=@d)
| table Employee_number First_name Last_name]
[ search index="ABCD" (earliest=-1d@d latest=@d-1)
| table Employee_number First_name Last_name]
... View more
07-18-2019
05:01 AM
hmmm if I use the Overlay, won't it still give me the sum of the NumOfConnections per 15s?
I tried taking "sum(NumOfConnections) as NumOfConnections" out of the stats function, but then I cannot use NumConnections for the Overlay.
Thanks again.
... View more
07-17-2019
12:56 PM
Last thing. Let's say, for example, I put this on a line graph.
One line shows the sum of Transactions every 15s
The other line shows the NumOfConnections per transaction. (so not every 15s)
Is that possible? Thanks.
... View more
07-17-2019
09:46 AM
Thank you. That helped, but how do add up all the NumOfConnections and Transactions that occurred in the 15s window? Also, is there something wrong with the date format? I appreciate the help. Splunk is still a new thing for me.
Here is what I did.
| eval _time = Time | bin _time span=15s | stats count as Transactions by _time NumOfConnections
Time:"07/17/2019 11:00:02" NumOfConnections:92 Transactions:1
Time:"07/17/2019 11:00:17" NumOfConnections:100 Transactions:1
Time:"07/17/2019 11:00:47" NumOfConnections:113 Transactions:1
Time:"07/17/2019 11:47:50" NumOfConnections:139 Transactions:1
Time:"07/17/2019 11:47:51" NumOfConnections:140 Transactions:1
... View more
07-17-2019
07:21 AM
I'm receiving data from a client where they give me two Key Value Pairs: Time(this is a log timestamp) and NumOfConnections(int)
I want to get a count of events being ingested every 15 secs.
example data created by | stats count as "Transactions" by Time:
Time: "07/23/2019 12:56:12" NumOfConnections:165 Transactions:1
Time: "07/23/2019 12:56:12" NumOfConnections:166 Transactions:1
Time: "07/23/2019 12:56:12" NumOfConnections:167 Transactions:1
Time: "07/23/2019 12:56:13" NumOfConnections:168 Transactions:1
Time: "07/23/2019 12:56:13" NumOfConnections:169 Transactions:1
Time: "07/23/2019 12:56:14" NumOfConnections:170 Transactions:1
This is what I want:
Time: "07/23/2019 12:56:00" NumOfConnections:2475 Transactions:15
Time: "07/23/2019 12:56:15" NumOfConnections:2480 Transactions:15
Time: "07/23/2019 12:56:30" NumOfConnections:2495 Transactions:15
Time: "07/23/2019 12:56:45" NumOfConnections:2490 Transactions:15
Time: "07/23/2019 12:57:00" NumOfConnections:2488 Transactions:15
Time: "07/23/2019 12:57:15" NumOfConnections:2482 Transactions:15
Is there a way to span every 15s even if the timestamp is not _time?
I need something similar to this:
| bin _time span=15s | stats count as Transactions by _time
But instead of Splunk's ingestion time (_time), I want to use the client's log timestamp (Time).
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-04-2024
01:26 PM
|
Karma given to
