Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About hvaithia
hvaithia
Path Finder
Member since:
04-15-2015
06-05-2020
Community Statistics
| Posts | 25 |
| Solutions | 2 |
| Karma Given | 3 |
| Karma Received | 3 |
| Member Since | 04-15-2015 |
Activity Feed
- Karma Re: Change chart bar color based on data value? for lguinn2. 06-05-2020 12:46 AM
- Karma Re: What capabilities provide access to Alert Manager for jklumpp_splunk. 06-05-2020 12:46 AM
- Karma Re: How can you restrict a timechart to display only weekdays? for somesoni2. 06-05-2020 12:46 AM
- Got Karma for Re: timechart X axis. 06-05-2020 12:46 AM
- Got Karma for Re: timechart X axis. 06-05-2020 12:46 AM
- Got Karma for Re: timechart X axis. 06-05-2020 12:46 AM
- Posted Re: How to compare data in 2 time buckets and alert based on results? on Alerting. 05-10-2016 06:15 PM
- Posted Re: How to compare data in 2 time buckets and alert based on results? on Alerting. 05-10-2016 01:06 PM
- Posted Re: How to compare data in 2 time buckets and alert based on results? on Alerting. 05-09-2016 06:16 PM
- Posted Re: How to compare data in 2 time buckets and alert based on results? on Alerting. 05-09-2016 06:11 PM
- Posted Re: How to compare data in 2 time buckets and alert based on results? on Alerting. 05-09-2016 06:08 PM
- Posted How to compare data in 2 time buckets and alert based on results? on Alerting. 05-09-2016 12:17 PM
- Tagged How to compare data in 2 time buckets and alert based on results? on Alerting. 05-09-2016 12:17 PM
- Tagged How to compare data in 2 time buckets and alert based on results? on Alerting. 05-09-2016 12:17 PM
- Tagged How to compare data in 2 time buckets and alert based on results? on Alerting. 05-09-2016 12:17 PM
- Tagged How to compare data in 2 time buckets and alert based on results? on Alerting. 05-09-2016 12:17 PM
- Posted Re: How to match the regex for LINE_BREAKER with the end of my event? Yet another one! on Splunk Search. 05-27-2015 03:55 PM
- Posted Re: How to match the regex for LINE_BREAKER with the end of my event? Yet another one! on Splunk Search. 05-27-2015 03:18 PM
- Posted How to match the regex for LINE_BREAKER with the end of my event? Yet another one! on Splunk Search. 05-27-2015 02:55 PM
- Tagged How to match the regex for LINE_BREAKER with the end of my event? Yet another one! on Splunk Search. 05-27-2015 02:55 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-10-2016
06:15 PM
That makes much more sense. I thought we were going down the date_hour route again and you made a typo in the search line here -> date_hourmin.
I didn't know that where can be used to specify time ranges like above! Thats really useful! I will keep that in mind.
And the above query works exactly as expected 🙂
Thanks a lot!!
Hari V
... View more
05-10-2016
01:06 PM
Hi @woodcock
I am trying to get the time range from the hour/min when the search is executed. Lets say I set up a hourly cron to run the search at 59th minute of each hour
At 10.59 AM the time comparison will be between 10 - 10.59 today and the average of 10-10.59 AM for the past 7 days
Same when the search is ran again at 11.59 AM. Time range will be 11 - 11.59.
How can I modify the above search to do that? Basically how to modify the search time dynamically?
Thanks,
Hari
... View more
05-09-2016
06:16 PM
sure! Thanks. I have been trying to do the same for the past couple hours now. Will let the forum know if anything turns up.
... View more
05-09-2016
06:11 PM
My bad in the above search, there was an extra pipe. But if I remove it
index=trendingnow sourcetype=yapache_access_trending status=200 colo=bf1 url="/tn?category=general&locale=en_us&source=mobile_distro"
date_minute>=30 earliest=-24h@h date_hour=eval strftime(_time, "%H") |
stats c as count1 |
appendcols [search index=trendingnow sourcetype=yapache_access_trending status=200 colo=bf1
url="/tn?category=general&locale=en_us&source=mobile_distro"
date_minute>=30 earliest=-7d@d date_hour=eval strftime(_time, "%H") |
stats count(url) as count2] |
eval count3=round(count2/7,0) |
eval issue1=if(count1<=(count3*.5),"true","false") |
eval issue2=if(count1>=(count3*1.5),"true","false") |
eval condition=if((issue1="true") OR (issue2="true"),"true","false") |
table count1 count3 issue1 issue2 condition
I still get count1 and count3 as zero. Is it because of timezone issues?
... View more
05-09-2016
06:08 PM
Thanks for your response. I have got parts of what I need from your answer. Here is how my current search looks
index=abc url="/xyz"
date_minute>=30 earliest=-24h@h |
date_hour=eval strftime(_time, "%H") |
stats c as count1 |
appendcols [search index=abc
url="/xyz"
date_minute>=30 earliest=-7d@d |
date_hour=eval strftime(_time, "%H") |
stats count(url) as count2] |
eval count3=round(count2/7,0) |
eval issue1=if(count1<=(count3*.5),"true","false") |
eval issue2=if(count1>=(count3*1.5),"true","false") |
eval condition=if((issue1="true") OR (issue2="true"),"true","false") |
table count1 count3 issue1 issue2 condition
I am planning to run this search every half hour or hourly. So I need to find the date_hour dynamically every time. I figured the above method would help but somehow I get a Unknown search command 'date'. error. If I remove the eval strftime(_time, "%H") in both the searches and just put in plain integers, it works! How do I solve this?
... View more
05-09-2016
12:17 PM
bucket 1 -> Last 30 mins (say 10.30 AM to 11 AM)
bucket 2 -> Get avg count of events for the same time period for the last 7 days (10.30 AM to 11 AM)
compare bucket 1 and bucket 2. If bucket 1 is 50% less than bucket 2, then send me an alert Email
I am trying to get the number of URL hits and if its substantially less than avg of last 7 days for the same time period, I need to be notified. How can I achieve this in splunk?
... View more
05-27-2015
03:55 PM
cos I had used a combination of
SHOULD_LINEMERGE=false
TRUNCATE=200000 ----------- cos my event is greater than 10k bytes
LINE_BREAKER=\"estimatedDuration\":\s\d+}
which didn't work for the event which was above 10k bytes
Also tried the other variant as described in http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents
SHOULD_LINEMERGE=true
TRUNCATE=200000 ----------- cos my event is greater than 10k bytes
LINE_BREAKER=\"estimatedDuration\":\s\d+}
BREAK_ONLY_BEFORE={\"building\":
which didn't work for the event which was above 10k bytes as well
I see from the regex you gave that LINE_BREAKER should also include the place where we break/carriage return. I tried your regex as well with no luck. I have also tried the above combination with/without
MAX_EVENTS=2000
with no effect. What am I doing wrong?
PS: I am not able to write "\" (slash) marks in this comment. No idea why. Everything before 's' and 'd' in the LINE_BREAKER and BREAK_ONLY_BEFORE has a slash.
... View more
05-27-2015
03:18 PM
The event starts with {"building":
Sample event below
{"building": false, "changeSet": {"items": [], "kind": null}, "builtOn": "rhel6", "description": null, "artifacts": [], "timestamp": 1430241584496, "number": 13, "actions": [{"causes": [{"upstreamBuild": 14, "shortDescription": "Started by upstream project "answers" build number 14", "upstreamProject": "answers", "upstreamUrl": "job/answers/"}]}, {}, {}, {}, {}, {"highlightsData": "[{"Previous Job":"answers#14"},{"Previous Job":"answers_se"},{"Build host":"rhel6"}]", "highlightsTable": "<h4>Global Patterns</h4><b>Previous Job:</b><b>Started by <a href="/hudson/job/answers/14/">answers</a></b><b>Previous Job:</b><b>Started by <a href="/hudson/job/answers/8/">answers #8</a></b><b>Build host:</b><b>Built on <a href="/hudson/computer/rhel6/">rhel6</a></b>"}], "id": "2015-04-28_17-19-44", "keepLog": false, "url": "http://thefactory.xyz.com:9999/jenkins/job/answers/13/", "culprits": [], "result": "SUCCESS", "executor": null, "duration": 377658, "fullDisplayName": "answers", "estimatedDuration": 298415}
... View more
05-27-2015
02:55 PM
My event ends like this,
, "estimatedDuration": 2505189}
The no of digits in the estimated time can be a variable. How do I match this in props.conf using REGEX. I need to add it as a LINE_BREAKER.
... View more
05-22-2015
02:29 PM
I just tested the same sourcetype with splunk 6.1 and it works perfectly! Safe to assume that something is wrong with Splunk 6.2 indexing
... View more
05-22-2015
11:34 AM
Another weird thing that I am noticing is that, it works fine when I analyze the logs when uploading it and using the same sourcetype, but it appears to not work after I upload it and start the search. This is not the 1st time I am seeing this, it happened to me once before. Is the log analyzer in splunk 6.2 not working properly?
... View more
05-22-2015
10:58 AM
Hi @esix_splunk, the timestamp is not the start of the event. My event is typically starts with a """ {"building": """ like this,
{"building": false, "changeSet": {"items": [{"comment": "Revert \"set pos field can be overrided by logGroup dynamically \"\n", "paths": [{"editType": "edit", "file": "src/datamodel/ComponentData.php" }], "author": {"absoluteUrl": "http://thefactory.corp.xxx.com:9999/jenkins/user/prajakta", "fullName": "prajakta"}, "timestamp": 1432177477000, "id": "5f428d3cde806ec296538023dae94ae694bca747", "com mitId": "5f428d3cde806ec296538023dae94ae694bca747", "msg": "Revert \"set pos field can be overrided by logGroup dynamically \"", "date": "2015-05-21T03:04:37+0000 -0700", "affectedPaths": ["src/datamo del/ComponentData.php"]}], "kind": "git"}, "builtOn": "rhel6-gq1-factory-slave-029.infra", "description": null, ...
And jenkinsTimestamp is the timestamp I want splunk to pick up. and hence the
TIME_FORMAT = %s%3N
TIME_PREFIX = jenkinsTimestamp
I tried KV_MODE=json earlier and somehow that doesn't seem to work for me. I read that KV_MODE is only for search-time extractions and not index-time. Do you have any suggestions for this?
... View more
05-21-2015
07:14 PM
[my sourcetype]
INDEXED_EXTRACTIONS = json
TIME_FORMAT = %s%3N
TIME_PREFIX = jenkinsTimestamp
SHOULD_LINEMERGE = false
description = JavaScript Object Notation
category = Structured
disabled = false
pulldown_type = true
TRUNCATE=200000
MAX_EVENTS=200000
some of my events are 110,000+ characters long. I tried TRUNCATE=0 and MAX_EVENTS=0 to no effect. some of my events log from the middle and others do not log in the end. Some are logged just fine. Examples below,
----not logging in the start event----
5/22/15
2:08:39.000 AM
ckground-color: #F0F8FF;} </style><h4>Global Patterns</h4><table><tr ><td><b>Previous Job:</b></td><td><b>Started by <a href='/yhudson/job/searchproducts_gsm_upload_assembly/481/'>searchproducts_gsm_upload_assembly #481</a></b></td></tr><tr class=\"aliceblue\"><td><b>Previous Job:</b></td><td><b>Started by <a href='/yhudson/job/searchproducts_gsm_fr_map_component/499/'>searchproducts_gsm_fr_map_component #499</a></b></td></tr><tr ><td><b>Build host:</b></td><td><b>Built on <a href='/yhudson/computer/rhel6-gq1-slave-03.adcd.infra/'>rhel6-gq1-slave-03.adcd.infra</a></b></td></tr></table>"}], "id": "2015-05-22_00-34-30", "keepLog": false, "url": "http://thefactory.corp.xxx.com:9999/jenkins/view/Search_GSM/job/searchproducts_gsm_upload_deploy_int/440/", "culprits": [{"absoluteUrl": "http://thefactory.corp.xxx.com:9999/jenkins/user/by-tortuga", "fullName": "by-tortuga"}], "result": "SUCCESS", "executor": null, "duration": 98065, "fullDisplayName": "http://thefactory.corp.xxx.com:9999/jenkins/view/Search_GSM/job/searchproducts_gsm_upload_deploy_int", "estimatedDuration": 180575}
---------not logging in the end------
5/22/15
2:08:03.000 AM
{"building": true, "changeSet": {"items": [{"comment": "[GSM-1393] Support 'style' attribute in the GSM CardModule structure.\n", "paths": [{"editType": "edit", "file": "components/common/src/test/java/com/xxx/search/middleware/cosmos/template/CardModuleTest.java"}, {"editType": "edit", "file": "components/common/src/main/java/com/xxx/search/middleware/cosmos/template/CardModule.java"}], "author": {"absoluteUrl": "http://thefactory.corp.xxx.com:9999/jenkins/user/whsu", "fullName": "whsu"}, "timestamp": 1432159954000, "id": "86b19401707141f58cd3d561158fee38f69f648e", "commitId": "86b19401707141f58cd3d561158fee38f69f648e", "msg": "[GSM-1393] Support 'style' attribute in the GSM CardModule structure.", "date": "2015-05-20T22:12:34+0000 -0700", "affectedPaths": ["components/common/src/main/java/com/xxx/search/middleware/cosmos/template/CardModule.java", "components/common/src/test/java/com/xxx/search/middleware/cosmos/template/CardModuleTest.java"]}, {"comment": "[GSM-1393] Support 'url' attribute in the GSM CardModule structure.\n", "paths": [{"editType": "edit", "file": "components/common/src/test/java/com/xxx/search/middleware/cosmos/template/CardModuleTest.java"}, {"editType": "edit", "file": "components/common/src/main/java/com/xxx/search/middleware/cosmos/template/CardModule.java"}], "author": {"absoluteUrl": "http://thefactory.corp.xxx.com:9999/jenkins/user/whsu", "fullName": "whsu"}, "timestamp": 1432181780000, "id": "828dd4633fd5ecc565b1395c59586889fb2f57c9", "commitId": "828dd4633fd5ecc565b1395c59586889fb2f57c9", "msg": "[GSM-1393] Support 'url' attribute in the GSM CardModule structure.", "date": "2015-05-21T04:16:20+0000 -0700", "affectedPaths": ["components/common/src/main/java/com/xxx/search/middleware/cosmos/template/CardModule.java", "components/common/src/test/java/com/xxx/search/middleware/cosmos/template/CardModuleTest.java"]}, {"comment": "[GSM-1393] Fix url variable in CardModule.java.\n", "paths": [{"editType": "edit", "file": "components/common/src/main/java/com/xxx/search/middleware/cosmos/template/CardModule.java"}], "author": {"absoluteUrl": "http://thefactory.corp.xxx.com:9999/jenkins/user/whsu", "fullName": "whsu"}, "timestamp": 1432182356000, "id": "a0d1e6e7d2b65d5020cc2292d2bcc2699b8c5470", "commitId": "a0d1e6
Any help is greatly appreciated
... View more
05-21-2015
02:53 PM
3 Karma
This one doesn't work anymore for dashboards. (Using splunk 6.2)
... View more
05-01-2015
10:57 AM
Thanks to Stephen and esix for their help on this. Really appreciate it. This is what worked for me finally
[json_timestamp]
INDEXED_EXTRACTIONS = json
TIME_FORMAT = %s%3N
TIMESTAMP_FIELDS = timestamp
TIME_PREFIX = timestamp
SHOULD_LINEMERGE = false
description = JavaScript Object Notation
category = Structured
disabled = false
pulldown_type = true
TIMESTAMP_FIELDS didn't unfortunately work with the forwarder (although it worked in the data preview)
... View more
05-01-2015
10:54 AM
[json_timestamp]
INDEXED_EXTRACTIONS = json
TIME_FORMAT = %s%3N
TIMESTAMP_FIELDS = timestamp
TIME_PREFIX = timestamp
SHOULD_LINEMERGE = false
description = JavaScript Object Notation
category = Structured
disabled = false
pulldown_type = true
This is the props that worked out for me finally if anyone is interested in the future. TIMESTAMP_FIELDS didn't unfortunately work with the forwarder (although it worked in the data preview)
... View more
04-29-2015
05:33 PM
Hi,
I have a very similar issue too. I have posted it in
http://answers.splunk.com/answers/233542/timestamp-preview-different-than-timestamp-in-sear.html
The solution you gave did not work for me. I tried the time_prefix values
TIME_PREFIX=^\"timestamp\":\s\"
TIME_PREFIX="timestamp":
Nothing so far, any clues?
... View more
04-29-2015
05:28 PM
The event starts with {"building":
Sample event below
{"building": false, "changeSet": {"items": [], "kind": null}, "builtOn": "rhel6", "description": null, "artifacts": [], "timestamp": 1430241584496, "number": 13, "actions": [{"causes": [{"upstreamBuild": 14, "shortDescription": "Started by upstream project \"answers\" build number 14", "upstreamProject": "answers", "upstreamUrl": "job/answers/"}]}, {}, {}, {}, {}, {"highlightsData": "[{\"Previous Job\":\"answers#14\"},{\"Previous Job\":\"answers_se\"},{\"Build host\":\"rhel6\"}]", "highlightsTable": "<h4>Global Patterns</h4><b>Previous Job:</b><b>Started by <a href="/hudson/job/answers/14/">answers</a></b><b>Previous Job:</b><b>Started by <a href="/hudson/job/answers/8/">answers #8</a></b><b>Build host:</b><b>Built on <a href="/hudson/computer/rhel6/">rhel6</a></b>"}], "id": "2015-04-28_17-19-44", "keepLog": false, "url": "http://thefactory.xyz.com:9999/jenkins/job/answers/13/", "culprits": [], "result": "SUCCESS", "executor": null, "duration": 377658, "fullDisplayName": "answers", "estimatedDuration": 298415}
... View more
04-29-2015
05:01 PM
here is my props.conf
[json_no_timestamp_new]
INDEXED_EXTRACTIONS = json
KV_MODE = json
TIMESTAMP_FIELDS = timestamp
TIME_FORMAT = %s%3N
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 512
description = JavaScript Object Notation
category = Structured
disabled = false
pulldown_type = true
I tried to attached the preview from splunk and data coming from splunk forwarder but I am not able to do so...
... View more
04-29-2015
12:10 PM
Also tried
[json_no_timestamp]
TIME_PREFIX="timestamp":
TIME_FORMAT=%s%3N
MAX_TIMESTAMP_LOOKAHEAD = 512
still nothing!!
... View more
04-29-2015
11:38 AM
[json_no_timestamp]
TIME_PREFIX=^\"id\":\s\"
TIME_FORMAT=%Y-%m-%d_%H-%M-%S
MAX_TIMESTAMP_LOOKAHEAD = 1048
Here is my updated props. I tried 512 and 1048 for timestamp look ahead, but its still logging the time when I create the log with my script. It's still not taking the time from the ID parameter.
Setting the lookahead will make splunk to look that many number of characters for the timestamp in every line. Did I get it right? I was wondering if I could match the 'timestamp' and deduce time with the epoch time if possible instead of getting it from 'id' field. Can you tell me how I can convert my epoch timestamp into something recognizable by splunk.
... View more
04-28-2015
01:54 PM
Thanks for the quick response. I think its my bad to have described my logs in part. But my actual logs look like below
{"building": false, "changeSet": {"items": [], "kind": null}, "builtOn": "rhel6", "description": null, "artifacts": [], "timestamp": 1430241584496, "number": 13, "actions": [{"causes": [{"upstreamBuild": 14, "shortDescription": "Started by upstream project \"answers\" build number 14", "upstreamProject": "answers", "upstreamUrl": "job/answers/"}]}, {}, {}, {}, {}, {"highlightsData": "[{\"Previous Job\":\"answers#14\"},{\"Previous Job\":\"answers_se\"},{\"Build host\":\"rhel6\"}]", "highlightsTable": " Global Patterns Previous Job:Started by answersPrevious Job:Started by answers #8Build host:Built on rhel6"}], "id": "2015-04-28_17-19-44", "keepLog": false, "url": "http://thefactory.xyz.com:9999/jenkins/job/answers/13/", "culprits": [], "result": "SUCCESS", "executor": null, "duration": 377658, "fullDisplayName": "answers", "estimatedDuration": 298415}
This is just one line. The entire splunk-logged file is a json dump. now I need to extract the time from either the 'ID' field or the 'timestamp' field. Will the same props work for these? (I tried it didn't). My ultimate aim is to have the logs logged in that timestamp (2015-04-28 in this case) instead of when I create this logs. Any help will be largely useful....
... View more
04-28-2015
01:51 PM
Thanks for the quick response. I think its my bad to have described my logs in part. But my actual logs look like below
{"building": false, "changeSet": {"items": [], "kind": null}, "builtOn": "rhel6", "description": null, "artifacts": [], "timestamp": 1430241584496, "number": 13, "actions": [{"causes": [{"upstreamBuild": 14, "shortDescription": "Started by upstream project \"answers\" build number 14", "upstreamProject": "answers", "upstreamUrl": "job/answers/"}]}, {}, {}, {}, {}, {"highlightsData": "[{\"Previous Job\":\"answers#14\"},{\"Previous Job\":\"answers_se\"},{\"Build host\":\"rhel6\"}]", "highlightsTable": " Global Patterns Previous Job:Started by answersPrevious Job:Started by answers #8Build host:Built on rhel6"}], "id": "2015-04-28_17-19-44", "keepLog": false, "url": "http://thefactory.xyz.com:9999/jenkins/job/answers/13/", "culprits": [], "result": "SUCCESS", "executor": null, "duration": 377658, "fullDisplayName": "answers", "estimatedDuration": 298415}
This is just one line. The entire splunk-logged file is a json dump. now I need to extract the time from either the 'ID' field or the 'timestamp' field. Will the same props work for these? (I tried it didn't). My ultimate aim is to have the logs logged in that timestamp (2015-04-28 in this case) instead of when I create this logs. Any help will be largely useful....
... View more
04-28-2015
01:47 PM
I think its my bad to have described my logs in part. But my actual logs look like below
{"building": false, "changeSet": {"items": [], "kind": null}, "builtOn": "rhel6", "description": null, "artifacts": [], "timestamp": 1430241584496, "number": 13, "actions": [{"causes": [{"upstreamBuild": 14, "shortDescription": "Started by upstream project \"answers\" build number 14", "upstreamProject": "answers", "upstreamUrl": "job/answers/"}]}, {}, {}, {}, {}, {"highlightsData": "[{\"Previous Job\":\"answers#14\"},{\"Previous Job\":\"answers_se\"},{\"Build host\":\"rhel6\"}]", "highlightsTable": " Global Patterns Previous Job:Started by answersPrevious Job:Started by answers #8Build host:Built on rhel6"}], "id": "2015-04-28_17-19-44", "keepLog": false, "url": "http://thefactory.xyz.com:9999/jenkins/job/answers/13/", "culprits": [], "result": "SUCCESS", "executor": null, "duration": 377658, "fullDisplayName": "answers", "estimatedDuration": 298415}
This is just one line. The entire splunk-logged file is a json dump. now I need to extract the time from either the 'ID' field or the 'timestamp' field. Will the same props work for these? (I tried it didn't). My ultimate aim is to have the logs logged in that timestamp (2015-04-28 in this case) instead of when I create this logs. Any help will be largely useful....
... View more
04-23-2015
05:15 PM
My log sample event looks like this
"id": "2015-03-02_20-10-12", "keepLog": false
"id": "2015-03-19_10-26-38", "keepLog": false
etc. I have to extract this timestamp for the various events. My props.conf looks like below,
[json_no_timestamp]
TIME_PREFIX = :\s
TIME_FORMAT = %Y-%m-%d_%H-%M-%S
I also tried
[json_no_timestamp]
TIME_PREFIX = "id":\s
TIME_FORMAT = %Y-%m-%d_%H-%M-%S
but still doesn't work. Its still showing the system time for the events. How should my TIME prefix and format look like?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
