About DarshanBK

DarshanBK · ‎08-10-2023

Hi All, I am trying to create a single value panel like below and add tooltip which displays values dynamically. But when i implemented this, the single value panel is disappeared and the output of the mouseover tooltip query is displaying as a panel in splunk as shown below. Below is the source Code. <label>Finance Job Status Clone</label> <row> <panel id="panel1"> <title>Functional Area</title> <search> <query>| makeresults | eval FA="HR and Finance ACN"</query> <earliest>-15m</earliest> <latest>now</latest> </search> <html id="htmlToolTip1" depends="$tokToolTipShow1$">  <style> #htmlToolTip1{ margin:auto !important; width: 20% !important; } </style> <div class="tooltip fade top in"> <div class="tooltip-arrow"/> <div class="tooltip-inner">$tokToolTipText1$</div> </div> </html> <table> <search> <query>*Search query*</query> <earliest>1691485200</earliest> <latest>1691658000</latest> <done> <set token="tokToolTipText1">$result.Job$</set> </done> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard> In the above sourcecode, the output of the striked over query should appear as a dashboard panel(first screenshot) and the out put of the second search query should be appeared when we hover over that panel. Could someone please suggest whats wrong in the above code.?

DarshanBK · ‎06-11-2023

For one splunk performance issue it was mentioned to us as below "We have a wait time of 57ms on the Search Head and a wait time of 25ms on the indexer. A wait time of maximum 10ms is good for proper processing in Splunk. This could be the reason for the storage performance issue." Could someone please let us know is there a parameter which denotes wait time on search head and indexers? If yes, please provide us some insight on what is that parameter and details about it.

DarshanBK · ‎05-22-2023

@sathwik067 How to check the MTU seeting? Is it something that needs to be done at splunk end or network end?

DarshanBK · ‎04-04-2023

@gcusello Thanks for your suggestion! I have one more requirement where we need to fetch only first 10lines from the above logs. Its a huge file and consumes lot of license. so we need to index only first 10 lines. Is it possible? if yes, how can we do it? I have tried many option with no success. Can you please guide me ?

DarshanBK · ‎04-03-2023

I have below configurations in transforms and props config files to fetch only events containing keyword 'splunking' in the log files. But it seems to be not working . transforms.conf [keepOnly10Lines] REGEX=splunking FORMAT=indexQueue DEST_KEY=queue props.conf [test-GP] TRANSFORMS-set = keepOnly10Lines inputs.conf [monitor:///opt/splunk/data/osheanTest/darsha_test*.log] index = main sourcetype = test-GP disabled = 0 whitelist = .log$ move_policy = sinkhole crcSalt = <source> Below are the logs: 05-12-2019 22:07:53.705 +0100 INFO splunkkkkkkkkkk - iueyrh8923f 2f82hob3f 208fhob 23f802ofb 2f8uo2bj f28ufb 2f892uobf2803fbuo j2f028bof j20fi oj 05-12-2019 22:07:53.705 +0100 INFO splunkingkkkkkkk - be27tf829fb 2u79fg2uibf 20fb 2f972gbu f20fb f0h2if 20f8bo f2hinfp 2fip 2f802fio2nf l 05-12-2019 22:07:53.705 +0100 INFO splunkkkkkkkkkk - uewhwf8iew cewuwbkj cobvjl ced08 jlwcuwojl vcew0vbjl wevcowejbl vwpeubvjl wvujwlevhwpivnwepviblj m 05-12-2019 22:07:53.705 +0100 INFO splunkkkkkkkkkk - 73ye9ubf 2fy92ou3bfj 2fhuo2bj f2yfdou2bj f208fhoub2jf02obfjl20fhinkf2pihbfl f9ip2knf c-92pjfpi2k 2-hpifn;k 05-12-2019 22:07:53.705 +0100 INFO splunkingkkkkkkk - ye08ru280fihn2 f20hfoib 2f0h2bi f2-9fpi2n f2fhpi2nk f2-9phifnk; 2fh2pibk f2fhpin;k 05-12-2019 22:07:53.705 +0100 INFO splunkkkkkkkkkk - ifhone 2n0ifnlk2 mfn082oihldj ovuce2h083do2bj fc028ifh3f8oih2lfdn2fob2jf80hi2pblj m9-2ufjpn;k f082hif 2 05-12-2019 22:07:53.705 +0100 INFO splunkingkkkkkkkkk - 8yd802hoifn 2fu2bj f28foub 2f9i2uk f2fobj 2fb 292fpin2 f29jpfin;k 2fpi2nf 0iphnfl 2fiplk 2fhipbl 05-12-2019 22:07:53.705 +0100 INFO splunkingkkkkkkk - d80dfh2inf280fyhoin2lf082hfoibnl 3df032u2inf2083yfh2n3f082y3fhn2 n2803f2ifn 2f820bf 280f2ob f280foi 2jl82u0ib 05-12-2019 22:07:53.705 +0100 INFO splunkkkkkkkkkk - e3ue832oin 23ifh23oilkf 2380ifb 23f802obuf 29-fhpi2 f290fpi 2f-2ipk 05-12-2019 22:07:53.705 +0100 INFO splunkingkkkkkkk - 3hd982yo802in f230f92hin3 f23fhpib2 3f230hpifn23fpi2b l 05-12-2019 22:07:53.705 +0100 INFO splunkingkkkkkkkkk - wyud8230foidn 2f02hiofn2fhpi2bf2hipfb2fpi2b3 f23f2-93fpi2n;k3 f2-fhpi2n3k; f2-39hpifnk; m 05-12-2019 22:07:53.705 +0100 INFO splunkkkkkkkkkk - feature="IOWait" color=green due_to_stanza="feature:iowait" node_type=feature node_path=splunkkkkkkkkkkd.resource_usage.iowait 05-12-2019 22:07:53.705 +0100 INFO splunkingkkkkkkkkk - vgavsgcavs chcyvashc msacyhasvc asasycvas casycvajs casyicxh darshan 05-12-2019 22:07:53.705 +0100 INFO splunkkkkkkkkkk - 10520523 3412 0520523 120523 120534gtey54y darshan 05-12-2019 21:37:53.702 +0100 INFO splunkkkkkkkkkk - 2052052ftrfquxutfxyiyqigx yhghck scxixb qcyicgkhqwmn cqwicykh darshan. Please help me in figuring out what is hindering splunk from applying transforms and props configuartions.

DarshanBK · ‎11-30-2022

This how the data is coming into splunk. gol********* and serv******** are coming in as multiple values in a single field. Where as our requirement is to capture them as single field and corresponding count in "total" element. Like this in facets there are more facets.name entries and corresponding count which we need to extract. But when we use auto extracted field below is what we are getting all in facets.name values captured as multivalue filed. Whereas we need seperate row for each facets.name entry.

DarshanBK · ‎11-29-2022

@PickleRick index=* source=* |rename facets{}.total.results{}.count AS COUNT,facets{}.name{} as Node |table _time,COUNT,Node Above is the simple SPL i'm using. As you mentioned the data is json/xml which gets parsed this way.

DarshanBK · ‎11-29-2022

Hi All, We have below data extracted in splunk and the ask is , in the "Node" field we need to make first two values as one value, next two values as one value and so on and map these values to the corresponding COUNT value. For Eg: in the first row in "Node" field , we need to create three separate values of consecutive two values and map these values to corresponding COUNT value. expected result: COUNT Node 682 gol************,ser**** --------------------------------------------------------- 622 gol************,ser**** ---------------------------------------------------------- 606 gol************,ser**** Note: *********** is just for masking not the requirement. Only above format is the requirement. COUNT and Node are multi value fields and we need single value fields in above format Can someone please help me in achieving this. I have spent 2 days and not getting the solution. Any help would be appreciated a lot. Thanks,

DarshanBK · ‎11-16-2022

Hi All, I have data as below, my requirement is to append/merge both the columns and then for each year split the column into multiple and place the details for one year field value adjacent to the previous one. Merging part can be taken care, i need the solution for splitting columns part. Can someone please help how to achieve this. SPL: |rex field=_raw "(?<Date>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})" | rex field=_raw "\w+:\s(?<Year>(\d+))\sQ" | rex field=_raw "\d+\s(?<Quarter>(Q\d)):" |rex field=_raw "\s+(?<Count>(\d+M))" |table Year,Quarter,Count |strcat Quarter " " Count Task |fields - Quarter Count |strcat Year " " Task Ask |fields - Year Task Below is the expected result. 2021 2022 Q4 2m Q4 5m Q3 1m Q3 7m Q2 2m Q2 8m Q1 0m Q1 5m

DarshanBK · ‎11-08-2022

Not sure why it seems to be dumb, but it is certainly taking our effort in understanding why the correct details are updated in rest uri path. I think the indexer cluster was not restarted after diskpace expansion. It was before I joined the organization. Does restating the indexer cluster helps in solving this and we would be able to see correct data in monitoring console?

DarshanBK · ‎11-07-2022

When I run the "df" command in indexer server exact diskspace details are displayed as below. But when we run the above SPL, it is displaying the old values(2.5TB) which was before increasing, not 4TB as in indexer server . df -h|grep splunk 4.0T 1.6T 2.4T 41% /opt/splunk

DarshanBK · ‎11-07-2022

We have indexer cluster deployment. We recently added additional memory to all the indexers. In splunk monitoring console the new diskspace details are not updated. In the rest URI path '/services/server/status/partitions-space' the correct diskspace details are not updated. We are using below SPL to fetch diskspace details in monitoring console dashboard: | rest splunk_server=* /services/server/status/partitions-space | eval free = if(isnotnull(available), available, free) | eval usage = round((capacity - free) / 1024, 2) | eval capacity = round(capacity / 1024, 2) | eval compare_usage = usage." / ".capacity | eval pct_usage = round(usage / capacity * 100, 2) | stats first(fs_type) as fs_type first(compare_usage) AS compare_usage first(pct_usage) as pct_usage by mount_point | rename mount_point as "Mount Point", fs_type as "File System Type", compare_usage as "Disk Usage (GB)", pct_usage as "Disk Usage (%)"

Posts	12
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎11-07-2022

Online Status	Offline
Date Last Visited	‎08-10-2023 11:02 AM

How to add a dynamic tooltip to a panel on a mouse...

How to configure wait time on search heads and ind...

Why isn't my Transforms.conf working as expected?

How to merge and map two splunk multi value fields...

How to split single column into muliple columns an...

Splunk indexers diskpace mismatch in monitoring co...

How to add a dynamic tooltip to a panel on a mouse...

How to configure wait time on search heads and ind...

Re: We are building a new indexer cluster and gett...

Re: Transforms.conf not working as expected