Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About amerineni
amerineni
Loves-to-Learn
Member since:
10-25-2017
11-03-2022
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-25-2017 |
Activity Feed
- Posted Re: How to achieve dynamic field value filtering after main search? on Splunk Search. 11-03-2022 01:41 PM
- Posted Re: How to filter the results based on the evaluated field? on Splunk Search. 11-03-2022 01:40 PM
- Posted How to filter the results based on the evaluated field? on Splunk Search. 11-02-2022 02:31 PM
- Posted How to achieve dynamic field value filtering after main search? on Splunk Search. 11-02-2022 02:09 PM
- Posted Re: calculating field percentages before stats command on Splunk Search. 07-19-2020 02:16 PM
- Posted calculating field percentages before stats command on Splunk Search. 07-19-2020 12:35 PM
- Posted How to display nested tables? on Splunk Search. 05-22-2020 01:06 PM
- Tagged How to display nested tables? on Splunk Search. 05-22-2020 01:06 PM
- Tagged How to display nested tables? on Splunk Search. 05-22-2020 01:06 PM
- Tagged How to display nested tables? on Splunk Search. 05-22-2020 01:06 PM
- Tagged How to display nested tables? on Splunk Search. 05-22-2020 01:06 PM
- Posted Re: How to handle sub-search with no results and error in search command: "Unable to parse the search"? on Splunk Search. 05-15-2020 10:30 AM
- Posted How to handle sub-search with no results and error in search command: "Unable to parse the search"? on Splunk Search. 05-14-2020 01:38 PM
- Tagged How to handle sub-search with no results and error in search command: "Unable to parse the search"? on Splunk Search. 05-14-2020 01:38 PM
- Tagged How to handle sub-search with no results and error in search command: "Unable to parse the search"? on Splunk Search. 05-14-2020 01:38 PM
- Tagged How to handle sub-search with no results and error in search command: "Unable to parse the search"? on Splunk Search. 05-14-2020 01:38 PM
- Posted Re: custom time range to sub search on Splunk Search. 09-24-2019 10:22 AM
- Posted custom time range to sub search on Splunk Search. 09-23-2019 09:03 PM
- Tagged custom time range to sub search on Splunk Search. 09-23-2019 09:03 PM
- Posted Re: Drilldown with column value when clicking on any row. on Dashboards & Visualizations. 11-18-2017 02:29 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-03-2022
01:41 PM
I need to evalute some search criteria based on the inputs selected and peform the search.
... View more
11-03-2022
01:40 PM
I have two inputs in the dashboard and I need to evaluate filed name and value to compare dynamically based on those inputs and filter events based on that. That is what I'm tryign to do.
... View more
11-02-2022
02:31 PM
I'm trying the below query,
index=XXXXXXXXX | eval space="cf_space_name=production" | search "space" YYYYYYYYYYYY | stats count
===================================================================
I want to filter the results based on the evaluated field.
| search "space" XXXXXXXXXXXXX => is not returning correct values
| search "cf_space_name=production" XXXXXXXXXXXXX => but If I use the value like this its working.
how to fix this? Thanks for the help.
... View more
Labels
- Labels:
-
eval
11-02-2022
02:09 PM
Hello, I'm trying to filter my events/results after evalulating the field name and value dynamically using eval.
index=XXXX YYYYYYY | eval field_name=PPPP | eval field_value=KKKK | search field_name=field_value
I tried below options, but none worked.
index=XXXX [|gentimes start=-1 | eval space="Test"| table space]
index=XXXX [|gentimes start=-1 | eval space="Test"| fields space]
... View more
Labels
- Labels:
-
eval
07-19-2020
02:16 PM
thanks for the quick response. My data looks like this requestName1 logType1 errorMessage1 requestName1 logType1 errorMessage2 the query you suggested returns different success percent for the above two combinations. However i want to populate a column with total success percent for "request1" not individual combinations success percents. Hope explained what i need correctly. I'm doing a sub query to calculate to percentages and then joining now. Wanted to know if there is a better way. Thanks.
... View more
07-19-2020
12:35 PM
index= base search | stats count, avg(ElapsedTime) as duration, by requestName, LogType, errorMessage, HttpStatus, isValidError is there anyway i can calculate the success percent of each requestName field based on HttpStatus values(<299 success and >299 failure) before executing stats command and then include that in the result table? Appreciate any help.
... View more
Labels
- Labels:
-
stats
05-22-2020
01:06 PM
My events looks like this: REQUEST_NAME is the common field that ties both request and services.
LogType=REQUEST status=200 REQUEST_NAME=XXXX URI=REQ1
LogType=SERVICE status=200 REQUEST_NAME=XXXX URI=SER1
LogType=SERVICE status=200 REQUEST_NAME=XXXX URI=SER2
LogType=SERVICE status=200 REQUEST_NAME=XXXX URI=SER3
LogType=REQUEST status=200 REQUEST_NAME=YYYY URI=REQ2
LogType=SERVICE status=200 REQUEST_NAME=YYYY URI=SER1
I want to see if this display is possible in a table format. Thanks for the help.
XXXX 200 SER1 200
SER2 200
SER2 200
YYYY 300 SER1 200
... View more
05-15-2020
10:30 AM
I need to return some dummy data if my sub search returns no results, otherwise my main search is returning all results. I achieved by doing this. is there any better way to do this?
Anyway thanks for the response.
|
eval sub_uuid=[ search index=cloudfoundry cf_org_name=Magenta_Pay cf_app_name=PaymentRestApi-* "Result based on transactionID" $identifier$
| rex "(?ms)uuid=(? [^]]+)" | eval uuid=uuid
| return $uuid | format] |eval test=if(isNotNull(sub_uuid), sub_uuid, "XXXXX") | where uuid=sub_uuid | table URI, HttpStatus, ElapsedTime, _time
... View more
05-14-2020
01:38 PM
Why am I not getting results from this search?
Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side
| search c_ip=[search | stats sum(bytes_out) as "Total Bytes Out" by c_ip | sort -"Total Bytes Out" | return $c_ip ]
Thanks
... View more
09-24-2019
10:22 AM
the time range is not fixed here. If user selects last 60 mins, then i should compare the trend with the previous 60 mins. If user selects last 4 hours in time picker, the the subs search should compare the results with 4 hours before that time range. So the subs search time range should be calculated dynamically based on the user picked time range.
... View more
09-23-2019
09:03 PM
Hi, I want to run a search for a selected time range, and also want to do a sub search for the same duration in the previous interval. For example if user selects the last 60 mins as time range, then i want to do a sub search for the previous hour. Please help me how we can achieve this. Thanks.
..my search | eval range=info_max_time - info_min_time | [search earliest=earliest from time range - range latest=latest from time range - range]
... View more
- Tags:
- splunk-enterprise
11-18-2017
02:29 PM
sorry for the delay. My requirement is to not just set a token. Whatever the token that gets passed when we click the operatioURI column, i want the same tokens to be passed to the drilldown when the user clicks on any other column.
Just setting the token is not working. There is no drilldown happening. So i started using the link tag and internally constructed a splunk link with dynamic tokens. That is working fine.
Not sure if there is any better solution. Anyway thanks for your help.
... View more
10-25-2017
03:24 PM
looks like i can't upload image here. Here is the link to the image.
https://photos.app.goo.gl/9hmRTGvhSuKtCBqZ2
The data i gave above is from table output.
When i click the row nothing is happening. No response.
... View more
10-25-2017
01:52 PM
Thanks for the quick response. Below is sample data. Its wierd that nothing is happening when i click with drilldown set token tag. Also why is your drilldown option set to "cell" instead of "row"
REQUEST_METRIC /shopping/continueToDeviceValidation S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:16:01
SERVICE_METRIC verifyAccountUnchanged S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:16:01
REQUEST_METRIC /shopping/showAccessoryCatalog S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:19:07
REQUEST_METRIC /upgrades/upgrade S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47
PERFORMANCE PERFORMANCE NA CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47
SERVICE_METRIC GetEligibleSalesScenarios S CARE UPGRADE NA 18872707669096683 957214265 2017-10-25 11:20:47
... View more
10-25-2017
12:15 PM
Did the same, but same response. Nothing is happening when i click.
row
$row.operationOrURI$
... View more
10-25-2017
11:01 AM
Hello, I want to mimic a cell click even if we click anywhere in the row.
my query: ----- | table type, operationOrURI, status, channel, flow, deviceId, workflowId, identifier, timeStamp
<option name="drilldown">row</option>
<drilldown>
<condition field="*">
<set token="operationOrURI">$row.operationOrURI$</set>
</condition>
</drilldown>
In this table i want to always pass "operationOrURI" no matter where the user clicks on that row. Click is not working with the above code. Appreciate for any help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-03-2022
05:03 PM
|
