About phularah

phularah

I tried something like this index=abc ("Aggregator * is Error" OR "Aggregator * is Up") NJ12GC102 | rex field=_raw "Aggregator\s(?<aggregator>[^\s]+)\sis\s(?<aggregator_status>\w+)\s" | streamstats current=t global=f window=2 range(_time) as time_diff by aggregator,aggregator_status | streamstats current=t global=f window=2 range(_time) as time_diff2 by aggregator | table _time aggregator aggregator_status time_diff time_diff2 | But the output is now what I needed. For that I would need to change the window=2, but it brings more issues.

phularah

So, I have data like this after I ran a query. For each aggregator, if the aggregator_status is Error and before15 minutes, the aggregator_status becomes Up, alert should not run. But, if the aggregator_status is still Error or no new event comes, alert should trigger. The Time field is epoch time which I am thinking can be used to find difference in Up and Error status times. How do I create such a query for the alert? I am thinking of using foreach command or some sort of streamstats, but I am unable to resolve this issue. The alert needs to run once every 24 hours.

phularah · ‎09-07-2023

The results have less than 10000 events in both the subsearches. I have off of my system now, but I will try multisearch tomorrow. Let's see if it works.

phularah · ‎09-07-2023

Yes, I have results from both the subsearches. But, still I don't see Counter in the results which is weird.

phularah · ‎09-07-2023

I am trying to get data from 2 indexes and combine them via appendcols. The search is index="anon" sourcetype="test1" localDn=*aaa* | fillnull release_resp_succ update_resp_succ release_req update_req n40_msg_written_to_disk create_req value=0 | eval Number_of_expected_CDRs = release_req+update_req | eval Succ_CDRs=release_resp_succ+update_resp_succ | eval Missing_CDRs=Number_of_expected_CDRs-Succ_CDRs-n40_msg_written_to_disk | timechart span=1h sum(Number_of_expected_CDRs) as Expected_CDRs sum(Succ_CDRs) as Successful_CDRs sum(Missing_CDRs) as Missing_CDRs sum(n40_msg_written_to_disk) as Written sum(create_req) as Create_Request | eval Missed_CDRs_%=round((Missing_CDRs/Expected_CDRs)*100,2) | eval Missed_CDRs_%=round((Missing_CDRs/Expected_CDRs)*100,2) | table * | appendcols [| search index=summary source="abc1" OR source="abc2" | timechart span=1h sum(xyz) as Counter | table Counter] But, I am getting output from just the first search. The appendcols search is just not giving the Counter field in the output.

phularah · ‎08-18-2023

Just to confirm, if I just want to parse and manipulate raw data with props, use add-ons to get data and forward it to indexers, no enterprise license is needed? If I don't use enterprise license no error will come?

phularah · ‎08-18-2023

I have a doubt. If we are using heavy forwarder to parse the data and forward it to indexers, does it need Enterprise license or just the forwarder license? Can I use something like-> ./splunk edit licenser-groups Forwarder -is_active 1. I don't want to use my HF as deployment server or LM or Monitoring Console. It's use is going to be to just parse data received from UF and forward it to peers or indexers. Let's say now if I install add-ons like Splunk db connect. Then, would it require Enterprise license or just forwarder license would suffice? I am still just forwarding the data.

phularah · ‎08-09-2023

hmm, I was asked this question in the Splunk interview today and was confused. So, the search would give an error or search won't work?

phularah · ‎08-09-2023

I have a lookup test_lookup with 2 fields a1 and b1. The field a1 is common with the fields in the raw data. the values of field a1 and b1 are as follows: a1 a2 a 1 a 2 b 3 b 4 What would be the o/p of the command ....| lookup test_lookup a1 OUTPUT a2?

phularah · ‎04-28-2023

Nevermind, I was able to solve it by myself. eventtype=cacti:mirage host=onl-cacti-02 rrdn=traffic_in host_id IN (215) ldi IN (9069,9070,9071,9073,9074,9075,9077,9078,9079) hostname IN (slrmpqfh-c1mpt-01-owmlb01) | reverse | streamstats current=t window=2 global=f range(_time) as deltaTime range(rrdv) AS rrd_value_delta by name_cache | eval isTraffic = if(like(rrdn,"%traffic%"),1,0) | eval kpi = if(isTraffic==1,rrd_value_delta*8/deltaTime/1024/1024/1024,rrd_value_delta/deltaTime) | streamstats current=f window=2 global=f last(kpi) as previouskpi by name_cache | eval change=round(((kpi-previouskpi)/previouskpi)*100,2) | noop feature_flag=stats:allow_stats_v2:false | timechart span=5m limit=0 useother=f first(change) as change_percent list(kpi) as kpi by name_cache

phularah · ‎04-27-2023

| eval Threshold = case(strftime(_time,"%a")="Sat" AND host="a1",1, strftime(_time,"%a")="Sun" AND host="a1",1, strftime(_time,"%a")="Sun" AND host="a2",1.5, strftime(_time,"%a")="Sun" AND host="a2",1.5) It worked. Thanks gcusello.

phularah · ‎04-26-2023

I have a search and resultant output like shown below: search is --> eventtype=cacti:mirage host=onl-cacti-02 rrdn=traffic_in host_id IN (215) ldi IN (9069,9070,9071,9073,9074,9075,9077,9078,9079) hostname IN (slrmpqfh-c1mpt-01-owmlb01) | reverse | streamstats current=t window=2 global=f range(_time) as deltaTime range(rrdv) AS rrd_value_delta by name_cache | eval isTraffic = if(like(rrdn,"%traffic%"),1,0) | eval kpi = if(isTraffic==1,rrd_value_delta*8/deltaTime/1024/1024/1024,rrd_value_delta/deltaTime) | noop feature_flag=stats:allow_stats_v2:false | timechart span=5m limit=0 useother=f list(kpi) as kpi by name_cache What I want to have are new fields fe01, fe02 and so on that would give the percentage change in value for each of the fields. I know timechart is not the command to use here. I tried eventstats and streamstats but wasn't able to do what I wanted. Each ldi in my search corresponds to a unique name_cache. and host_id corresponds to a unique hostname. It is easy to filter data via ldi and host_id fields than typing long and complicated name_cache and hostname fields. e.g., the new field FE01 should be like ((1.21-1.33)/1.21-(1.21-1.33))*100 and same formula for other fields. It means, new fields FE01, FE02 and so on would show the traffic change percent. @somesoni2 @andrewtrobec @lakshman239 @efavreau @phanTom @diogofgm @woodcock

phularah · ‎04-24-2023

I need help with case, if and strftime functions. I am doing something wrong and getting error that arguments to the if function are invalid. I have used various permutations and combinations with strptime and strftime as well. Also, the threshold needs to be changed depending on the time of the day.

phularah · ‎04-24-2023

I am trying to modify Thresholds based on the day and time. I have the chart completed, just need help with the thresholds. If the day is Saturday or Sunday and host is a1, Threshold should be 1, if host is a2 with same timing conditions, threshold should be 1.5 and for other remaining hosts threshold should be 0.5 with same timing conditions. If the day is Monday-Friday, and time is between 12:00am to 12:pm, for host a1 threshold should be 3, and for same timing conditions for host a2 threshold should be 4 and for other remaining hosts threshold should be 1 with same timing conditions. The search that I am trying is something like as shown below, but there are multiple hosts and it is not working for a single host and I need to change thresholds based on time of that particular day as well. | eval Threshold = case (if(strftime(_time,"%a")="Sat" AND host="a1"), Threshold=1, if(strftime(_time,"%a")=Sun AND host="a1"), Threshold=1, if(strftime(_time,"%a")="Sun" AND host="a2"), Threshold=1.5, if(strftime(_time,"%a")="Sun" AND host="a2"), Threshold=1.5)

phularah · ‎01-29-2023

Yes, that's exactly what I wanted.

phularah · ‎01-28-2023

Hi, @gcusello, addtotals would add all the field values, which I don't want. I want the sum of the fields in such a way that it only adds up the fw values, like traffic_infw1+traffic_outfw1, traffic_infw2+traffic_outw2, traffic_infw3+traffic_outfw3 and so on. Now, fw can change and so do their numbers. So, if I have 10 fields initially, I should get 5 fields after the summation of required field values. and after that timechart would show 5 graphical lines. Like in the screenshot shared in the question, I would want sum of field values of 1st and 5th field, 2nd and 6th, 3rd and 7th and 4th and 8th fields.

phularah · ‎01-27-2023

Hi, I would like to add value in two fields based on their name. I want the output as sum of traffic_in#fw1+traffic_out#fw1 and so on by _time.

phularah · ‎10-27-2022

It still didn't actually solve my problem. I need some formula that can accurately determine the percentage. E.g., if I have values like 2,10 and and so on and last_kpi_diff is 8, then change is abs(10/(10-8)*100)=500, that's ok. But, if I have values like 10,2 and so on and last_kpi_diff is 8, then change is abs(2/(2-8)*100)=33, which is not ok. Change should have been 20 here with abs(2/(2-(-8)))=20. Need some functionality that can give the actual difference rather than absolute difference as given by range() function. I know there isn't any function that gives actual difference.

phularah · ‎10-20-2022

Yes, that's what I want. When a sum of field value of any(traffic_in#xyz and traffic_out#xyz) at let's say 12:15 is greater than 30% of the same at 12:10, fire an alert and show all of those fields where this condition is satisfied.

phularah · ‎10-20-2022

The search output with a part of the search is

phularah · ‎10-20-2022

I am trying to create a search where if there is a change of 30 percent within 5 mins of a few field values, I would like to create an alert. The search should take a sum of the field values where field names are like traffic_in#abc and traffic_out#abc, and then use delta command to find difference between current and previous values. Now, the issue is I have 11 field values like abc(e.g., abc, cde,efg etc.) and I want delta of total of (traffic_in#***+traffic_out#***) and then find the values when traffic has changed by over 30%. The search that I have can be used when I have only one value like abc, but I want to change it so that it can work with multiple values. The search is : eventtype=cacti:mirage host="onl-cacti-02" host_id=193 ldi IN("8835","8836","8837","8839","8840","8841","8846","8847","8848","8843","8844",) | reverse | eval combination=rrdn+"#"+name_cache | streamstats current=t window=2 global=f range(_time) as deltaTime range(rrdv) AS rrd_value_delta by combination | eval isTraffic = if(like(rrdn,"%traffic%"),1,0) | eval kpi = if(isTraffic==1,rrd_value_delta*8/deltaTime,rrd_value_delta/deltaTime) | timechart limit=0 useother=f span=5min last(kpi) by combination | addtotals fieldname=total | delta total as change | eval change_percent=change/(total-change)*100 | timechart span=5min first(total) AS total_traffic, first(change_percent) AS traffic_change | where abs(traffic_change) > 30

phularah · ‎09-08-2022

I saw a question on the internet while searching for answers for a separate question and a few comments below regarding the correct answer for that. Now, I am confused as to what should have been the correct answer. This was the question. This file has been manually created on a universal forwarder: /opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf [monitor:///var/log/messages] sourcetype=syslog index=syslog A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file: /opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf [monitor:///var/log/maillog] sourcetype=maillog index=syslog Which file is now monitored? /var/log/maillog or both /var/log/maillog and /var/log/messages

phularah · ‎08-02-2022

Thank you. It worked.

phularah · ‎08-02-2022

No it is not working. SIteName field generally has only 2 values, either NULL or "some other value" and same goes for Address field. So, mvcount() will always be greater than 1 and mvfilter() won't work. What I need is a condition that if a CellName for a Date is not unique and its SiteName and Address field has 2 values NULL (by fillnull value=NULL) or "some other value", the row with NULL value is removed. But, if CellName is unique on a Date and value for SiteName and Address fields is NULL, the row remains. Anyhow, using this line (| stats values(SiteName) as SiteName values(Address) as Address by TAC DATE SiteID CellName) after my search is showing no results as expected --> My Search right now is --> index=abc SiteID=xyz TAC=12345 | eval Date=strftime(_time,"%d-%b-%y") | table _time TAC Date SiteID CellName SiteName Address | fillnull value=NULL SiteName Address | dedup Date CellName SiteName Address | sort - _time | fields - _time I am sorting with _time here, because if month changes and I am looking at last 7 days, it would show data for 31st of previous month first, then 30th and at last 1st of current month.

phularah · ‎08-02-2022

I have sorted the results based on Date and CellName. As can be seen CellName and Date values are same for rows 5 and 6 and same in rows 3 and 4 here, but SiteName and Address are NULL. So, I don't want the rows 3 and 5. But, there are some cases where Date and CellName combination are different, but SiteName and Address are NULL. I want those rows in my table.

Posts	48
Solutions	3
Karma Given	12
Karma Received	5
Member Since	‎01-30-2018

Online Status	Offline
Date Last Visited	3 weeks ago

Need Help with a Splunk query

Need Help with Splunk Dbconnect rising inputs quer...

Need help with a splunk search with appendcols

Heavy Forwarder License Type?

How to create Splunk lookup query?

How to find traffic change from a search?

Need Help with a Splunk Search and modifying thres...

How to add value in two fields based on their name...

Need help with a search where I am using streamsta...

Deployment Server and Universal Forwarder- Which f...

Re: Need Help with a Splunk query

Need Help with a Splunk query

Re: Need help with a splunk search with appendcols

Re: Need help with a splunk search with appendcols

Need help with a splunk search with appendcols

Re: Heavy Forwarder License Type?

Heavy Forwarder License Type?

Re: Need help with Splunk lookup query

How to create Splunk lookup query?

Re: Need help to find traffic change from a searc...

Re: Need Help with a Splunk Search and modifying t...

How to find traffic change from a search?

Re: Need Help with a Splunk Search

Need Help with a Splunk Search and modifying thres...

Re: How to add value in two fields based on their ...

Re: Need help with a splunk search

How to add value in two fields based on their name...

Re: Need Help with a search where I am using strea...

Re: Need Help with a search where I am using strea...

Re: Need Help with a search where I am using strea...

Need help with a search where I am using streamsta...

Deployment Server and Universal Forwarder- Which f...

Re: Need first non-null values in the table based ...

Re: Need first non-null values in the table based ...

Re: Need first non-null values in the table based ...