Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Stevelim
Stevelim
Communicator
Member since:
01-17-2015
08-02-2023
Community Statistics
| Posts | 55 |
| Solutions | 6 |
| Karma Given | 12 |
| Karma Received | 5 |
| Member Since | 01-17-2015 |
Activity Feed
- Posted Re: Windows Installation Rollback error on Installation. 08-02-2023 01:17 AM
- Posted Why is there Windows Installation Rollback error? on Installation. 08-02-2023 12:25 AM
- Karma Background color in navbar is gone in 7.1 and 7.2 for lakromani. 06-05-2020 12:49 AM
- Karma Re: Problems opening a search on an APP... for OL. 06-05-2020 12:48 AM
- Karma Re: What is this bar called? And how do I change the colors? for dkeck. 06-05-2020 12:48 AM
- Karma Re: Is conditional background coloring possible in Splunk charts? for sundareshr. 06-05-2020 12:48 AM
- Got Karma for Re: How to use inputlookup to check if hosts in a CSV have been sending events to Splunk, then use eval to output "yes" or "no"?. 06-05-2020 12:48 AM
- Karma Is there any way to overlay vertical lines for event marking in Splunk timecharts? for aramirez_evolut. 06-05-2020 12:47 AM
- Karma Re: How to change table header after using transpose command? for AdixitSplunk. 06-05-2020 12:47 AM
- Karma Re: What is the best way to add a set of values in a table, subtract another set of values, then append the result back to the table? for jplumsdaine22. 06-05-2020 12:47 AM
- Karma Re: How to insert rows with eval calculated fields in a time series table? for javiergn. 06-05-2020 12:47 AM
- Karma Re: how to delete uploaded csv file for ngatchasandra. 06-05-2020 12:47 AM
- Karma Re: Is it possible to redefine the start of the fiscal year (September 1st) and start of the day (7:00AM) in Splunk? for renems. 06-05-2020 12:47 AM
- Karma Re: Is it possible to redefine the start of the fiscal year (September 1st) and start of the day (7:00AM) in Splunk? for javiergn. 06-05-2020 12:47 AM
- Got Karma for What is the best way to add a set of values in a table, subtract another set of values, then append the result back to the table?. 06-05-2020 12:47 AM
- Got Karma for How to insert rows with eval calculated fields in a time series table?. 06-05-2020 12:47 AM
- Got Karma for Re: Is it possible to redefine the start of the fiscal year (September 1st) and start of the day (7:00AM) in Splunk?. 06-05-2020 12:47 AM
- Got Karma for Re: Is it possible to redefine the start of the fiscal year (September 1st) and start of the day (7:00AM) in Splunk?. 06-05-2020 12:47 AM
- Posted Re: Creating a table with chronological headers on Splunk Search. 07-22-2019 06:37 AM
- Posted Creating a table with chronological headers on Splunk Search. 07-17-2019 04:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-02-2023
01:17 AM
If anyone is stuck like me, the solution I had was to re-run with the same version of Splunk before running the latest installer.
... View more
08-02-2023
12:25 AM
I am performing a migration of an 8.2.2 Splunk instance into a new VM. I have copied the entire $SPLUNK_HOME (D:\Splunk) folder into the new VM machine and ran the installer. The installer fails with rollback. I have the logs with me and here is an excerpt of the failure:
MSI (s) (DC:AC) [14:20:49:588]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3EE8.tmp, Entrypoint: FirstTimeRunCA FirstTimeRun: Warning: Invalid property ignored: FailCA=. FirstTimeRun: Info: Properties: splunkHome: D:\Splunk. FirstTimeRun: Info: Execute first time run. FirstTimeRun: Info: Enter. Args: "D:\Splunk\bin\splunk.exe", _internal first-time-run --answer-yes --no-prompt FirstTimeRun: Info: SystemPath is: C:\Windows\system32\ FirstTimeRun: Info: Execute string: C:\Windows\system32\cmd.exe /c ""D:\Splunk\bin\splunk.exe" _internal first-time-run --answer-yes --no-prompt >> "C:\Users\********\AppData\Local\Temp\splunk.log" 2>&1" FirstTimeRun: Info: WaitForSingleObject returned : 0x0 FirstTimeRun: Info: Exit code for process : 0x2 FirstTimeRun: Info: Leave. FirstTimeRun: Error: ExecCmd failed: 0x2. FirstTimeRun: Error 0x80004005: Cannot execute first time run. CustomAction FirstTimeRun returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) Action ended 14:20:57: InstallFinalize. Return value 3.
Anyone has any insights?
... View more
- Tags:
- error
- installation
Labels
- Labels:
-
Windows
07-22-2019
06:37 AM
The issue with this technique is that I need the format to be 22-Jul for example. Changing the eval strtime command to strftime(_time,"%d-%b") works but only for a month of data. I eventually need this to go over a year worth of data which will end up with this arrangement of headers if I go with this:
01-JAN | 01-FEB .. | 01-DEC | 02-JAN |
... View more
07-17-2019
04:42 AM
Given a week worth of timestamped data like the following:
1st FEB
Time = "010219 0100" Category = "A" Value = "1.1"
Time = "010219 0100" Category = "B" Value = "1.3"
Time = "010219 0110" Category = "A" Value = "2.1" <- Last data for A on 1st FEB
Time = "010219 0110" Category = "B" Value = "2.2" <- Last data for B on 1st FEB
2nd FEB
Time = "020219 0100" Category = "A" Value = "1.1"
Time = "020219 0100" Category = "B" Value = "1.3"
Time = "020219 0110" Category = "A" Value = "1.1" <- Last data for A on 2nd FEB
Time = "020219 0110" Category = "B" Value = "1.2" <- Last data for B on 2nd FEB
...
Assuming my keys are extracted correctly, how can I display a table of this format:
Category 01-FEB 02-FEB...
A 2.1 1.1
B 2.2 1.2
I am able to get to this point with the following query:
<Base Search>
| dedup date_mday, date_month, TagName
| eval date = strftime(_time,"%Y%m%d-%b")
| xyseries TagName, date, Value
and get the following results:
Category 20190219-Feb 20190219-Feb
A 2.1 1.1
B 2.2 1.2
How can I rename manipulate the header such that they are all in chronological order with the correct header names? For context, the data will be searched for an entire year. I was able to get close to the presentation but encountered an ordering issue, for example, all the 01-X grouped together, 01-JAN, 01-FEB, 01-MAR and so on
... View more
- Tags:
- splunk-enterprise
05-05-2019
06:07 PM
The issue with an overlay is that it goes all the way to the bottom of the y axis. In the rangemarker example, you can see that it is a range in the middle of the chart, ie. (4 to 6 in your example).
... View more
05-05-2019
12:33 AM
I am trying to achieve the same visualization as documented over here: https://wiki.splunk.com/Community:Search_Report:_How_to_Add_a_Range_Marker_by_Advanced_XML
My understanding is that this is deprecated but are there anyway I can get this up in the latest version of Splunk?
... View more
10-26-2018
09:15 AM
To write back, you can trigger a REST Call to the Tag in question. You will however, need the use of the IoT Gateway instead of the IDF for Splunk Plugin.
So steps in general:
Create an alert based on your requirement
Trigger Script
Script sends a HTTP Post to the correct end point in Kepware
Kepware "writes" to trigger the machine shut down
... View more
10-07-2018
10:00 PM
This works great! I learnt a lot from the regex pattern as I was primary stuck on how to extract the huge chunk of table. I would love to extract the raw to something splunk friendly but unfortunately that is out of my control.
... View more
10-04-2018
09:48 AM
I figured what I can extract most of the fields out of the box via Splunk. I will like the key value pair to be something along:
15:30:33 No1_OFFSET = 14.3
15:30:33 No2_OFFSET = 14.5
15:30:33 No1_Direction = Counter
15:30:33 No2_Direction = Reverse
Is this possible?
... View more
10-04-2018
09:35 AM
My apologies, I realised I did not think deep enough about how it will appear in Splunk since I was originally working on it in Excel. So in Excel, I am able to just fit it columns but I forgot that in Splunk it will be associated with time. My end state is to be able to say do a search and create a time series chart of all the No = 1.
| No = 1
and it should return me with something like:
15:30:33 OFFSET = 14,3 <- From first log file
15:30:33 OFFSET = 15.2 <- From second log file of similar format
After which I can then append a | timechart avg(OFFSET) by No to see all the OFFSET.
I hope it makes sense.
... View more
10-04-2018
05:58 AM
I have a raw data set that goes like this:
Logtime: 20181010_15:30:34
ID: V12
ArrivalTime: 15:30:33
No OFFSET DIRECTION LOAD
1 14.3 Counter 100
2 14.5 Reverse100
ExitTime: 15:30:34
Max: 1000
MIN: 900
What will be the best way to parse this data using Splunk?
... View more
03-01-2018
12:21 AM
We now have a technical guide on how to send to Splunk Cloud here @ https://www.kepware.com/en-us/support/resource-library/technical-notes/sending-data-kepserverex-splunk-cloud/
... View more
09-18-2017
01:35 AM
I have tried this. The issue is that the data will appear as this:
NameValue
A = 1
B = 2
C = 3...
I can of course do a mvexpand but I will like A,B,C to be the key for me to search easily meaning I can do this:
| search A < 2 and so forth
... View more
09-17-2017
12:43 PM
I have base search that was able to get me to this form in Splunk:
Name Value
A 1
B 2
C 3
I need to create a new key value pair that goes A = 1, B = 2, C = 3 and so forth. Is this possible without regex?
... View more
07-14-2016
08:56 AM
Hey, to list out unique values, you should look into stats command as well
Base search to filter out the correct events | table_time | eval Date =strftime(_time, "%Y%m%d") | stats list(Date)
Here's an example:
index=* Value>60 | eval Date = strftime(_time, "%Y%m%d") | stats values(Date) as Date | mvexpand Date
... View more
07-14-2016
08:20 AM
Hey Sundaresh,
I tried this out with a restart, I didnt notice anything. Also, i added the transforms.conf under etc/system/local
Am I doing this right?
... View more
07-12-2016
04:22 AM
base search | appendcols [ search index=idx1 sourcetype=load host="*" ut=*|rename host as dns_name | table dns_name, ut ]
... View more
07-12-2016
04:19 AM
Yep, did that work?
... View more
07-11-2016
06:52 AM
For a clustered deployment, you should look into the deployer instead
http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/PropagateSHCconfigurationchanges
... View more
07-06-2016
07:18 AM
1 Karma
You might want to use a case statement instead:
input Lookup search | eval Results =case(count == 0, "Yes", count >= 0, "No")
You can also refer to this quick reference:
https://www.splunk.com/content/dam/splunk2/pdfs/solution-guides/splunk-quick-reference-guide.pdf
... View more
06-24-2016
06:56 AM
In case the SNMP Modular input dont work, check out Kepware's SNMP Driver. It is GUI driven, combined with the IDF, you can accquire and listen to the SNMP traps.
https://www.kepware.com/products/kepserverex/drivers/snmp/
... View more
06-23-2016
09:45 PM
Are you using the default Splunk Map tiles? You can populate with the OSM Map tiles which allows you to zoom into a greater detail,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-02-2023
10:37 PM
|
