About renanprado96

renanprado96 · ‎08-02-2016

Got it.. Thank you!

renanprado96 · ‎08-01-2016

Hello! I wanted a way to calculate the difference as the Delta, but in percentage. It's possible? Thank you!

renanprado96 · ‎07-27-2016

Thank you brother!

renanprado96 · ‎07-19-2016

Or by regex

renanprado96 · ‎07-19-2016

I tried to use just what you ordered (without extra content), insert new data, but still did not work. At the researched it was to be simple, do not know what's going on. I will try to choose a solution by the query for now ... [dynamicsAX_csv] FIELD_NAMES = DATAAREAID,RECID,DATAAREAID2,ITEMID,TRANSDATE,SUMOFQTYSEND,SUMOFQTYRET,RECIDLINE,TRANSDATETIME,DATAAREAID3,ITEMNAME INDEXED_EXTRACTIONS = csv TIME_PREFIX = TRANSDATE\s*=\s* TIME_FORMAT = %s%3N TZ = America/Sao_Paulo KV_MODE = auto

renanprado96 · ‎07-19-2016

I did, restarted, injected new data, but still did not work. Did I do something wrong? [dynamicsAX_csv] FIELD_NAMES = DATAAREAID,RECID,DATAAREAID2,ITEMID,TRANSDATE,SUMOFQTYSEND,SUMOFQTYRET,RECIDLINE,TRANSDATETIME,DATAAREAID3,ITEMNAME INDEXED_EXTRACTIONS = csv TIME_PREFIX = TRANSDATETIME\s*=\s* TIME_FORMAT = %s%3N TZ = America/Sao_Paulo KV_MODE = auto FIELD_DELIMITER = , NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true Thanks for the support...

renanprado96 · ‎07-18-2016

It is possible to do this for search?

renanprado96 · ‎07-18-2016

It is possible to do this for search?

renanprado96 · ‎07-18-2016

But I put TZ = America / Sao_Paulo , "America / Sao_Paulo" is quoted in this list. And it did not work!

renanprado96 · ‎07-18-2016

I'm doing like this: FIELD_NAMES = DATAAREAID,RECID,DATAAREAID2,ITEMID,TRANSDATE,SUMOFQTYSEND,SUMOFQTYRET,RECIDLINE,TRANSDATETIME,DATAAREAID3,ITEMNAME INDEXED_EXTRACTIONS = csv TIME_PREFIX = .{0,}TRANSDATETIME= TIME_FORMAT = %s%3N TZ = America/Sao_Paulo FIELD_DELIMITER = , KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true I have to just put TZ = America / Sao_Paulo? Event example: 7/18/16 7:52:04.000 AM "2016-07-18 07:52:04" DATAAREAID="206", RECID=5637144593, DATAAREAID#2="206", ITEMID="002.0001.168", TRANSDATE=1468810800000, SUMOFQTYSEND=1.000000000000, SUMOFQTYRET=0E-12, RECIDLINE=5637279183, TRANSDATETIME=1468839124000, TRANSDATETIMETZID=37001, DATAAREAID#3="206", ITEMNAME="PRINT-INS-RICOH 5000 TINTA DYE PLUS CYAN" Thank you!

renanprado96 · ‎07-18-2016

True, sorry!! [dynamicsAX_csv] FIELD_NAMES = DATAAREAID,RECID,DATAAREAID2,ITEMID,TRANSDATE,SUMOFQTYSEND,SUMOFQTYRET,RECIDLINE,TRANSDATETIME,DATAAREAID3,ITEMNAME INDEXED_EXTRACTIONS = csv TIME_PREFIX = .{0,}TRANSDATETIME= TIME_FORMAT = %s%3N TZ = GMT TZ_ALIAS = GMT = GMT-3:00 FIELD_DELIMITER = , KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true I sent the wrong, but I applied in correct. It was just a mess when sending.

renanprado96 · ‎07-15-2016

In these samples the time should be at least 3 hours ago. "2015-07-24 11:50:41" DATAAREAID="206", RECID=5637144596, DATAAREAID#2="206", ITEMID="002.0001.171", TRANSDATE=1437706800000, SUMOFQTYSEND=1.000000000000, SUMOFQTYRET=0E-12, RECIDLINE=5637184982, TRANSDATETIME=1437749441000, TRANSDATETIMETZID=37001, DATAAREAID#3="206", ITEMNAME="PRINT-INS-RICOH 5000 TINTA DYE PLUS BLACK" "2015-07-24 11:50:41" DATAAREAID="206", RECID=5637144589, DATAAREAID#2="206", ITEMID="002.0001.163", TRANSDATE=1437706800000, SUMOFQTYSEND=1.000000000000, SUMOFQTYRET=0E-12, RECIDLINE=5637184981, TRANSDATETIME=1437749441000, TRANSDATETIMETZID=37001, DATAAREAID#3="206", ITEMNAME="PRINT-INS-TINTA PIGMENTADA PARA COLORSTREAM COR CYAN"

renanprado96 · ‎07-15-2016

This configuration is defined in the Splunk server, the data is sent to a SQL database connected by dbConnect v2

renanprado96 · ‎07-15-2016

TIME_PREFIX removed and still did not work :'( I had already tried to removed it I do not know what to do ..

renanprado96 · ‎07-15-2016

Hello, have not worked yet. What did I do wrong? [dbcmp_csv] EXTRACT-jobname_ricoh = ^(?P<jobname_ricoh>\d+_&\d+&) FIELD_NAMES = ClienteERP,Aplicacao,ClienteAplicacao,idHistoricoProducao,DataHoraInicio,DataHoraTermino,Quantidade,idEtapa,NomeArquivoImpressao,CentroImpressao,TipoProduto,FormatoPapel,Maquina,GrupoMaquina,Fabricante,SituacaoArqImpressao,SituacaoLote INDEXED_EXTRACTIONS = csv TIME_PREFIX = .{0,}DataHoraTermino= TIME_FORMAT = %s%3N TZ = GMT TZ_ALIAS = GMT = GMT-3:00 FIELD_DELIMITER = , KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true Thank you!

renanprado96 · ‎07-15-2016

Hello, have not worked yet. What did I do wrong? [dbcmp_csv] EXTRACT-jobname_ricoh = ^(?P<jobname_ricoh>\d+_&\d+&) FIELD_NAMES = ClienteERP,Aplicacao,ClienteAplicacao,idHistoricoProducao,DataHoraInicio,DataHoraTermino,Quantidade,idEtapa,NomeArquivoImpressao,CentroImpressao,TipoProduto,FormatoPapel,Maquina,GrupoMaquina,Fabricante,SituacaoArqImpressao,SituacaoLote INDEXED_EXTRACTIONS = csv TIME_PREFIX = .{0,}DataHoraTermino= TIME_FORMAT = %s%3N TZ = America/Sao_Paulo FIELD_DELIMITER = , KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true Thanks!

renanprado96 · ‎07-14-2016

I want to set the time zone in an index. The time zone is GMT -03: 00 (São Paulo - Brazil). How do I do that? Thank you!

renanprado96 · ‎07-07-2016

Got it, But... Returned: Error in 'bin' command: Invalid argument: 'time'

renanprado96 · ‎07-07-2016

search: index=ricoh | table pkNmArq, "Total K Ink Usage _cc",Jobname, date_month , PaginasA4Ricoh, "Total C Ink Usage _cc","Total Y Ink Usage _cc","Total M Ink Usage _cc", custoRicohMlColor, custoRicohMlBlack, _time | join type=inner max=0 pkNmArq [search index=cmp date_year>=2015 idEtapa=3 CentroImpressao="Alphaville" Maquina="*IP5000_1*" OR Maquina="*IP5000_2*" ClienteAplicacao="TELECOMUNICAÇÕES DE SÃO PAULO S/A (TELESP) - FATURA AUTOENVELOPADA A3 - AT*" | table pkNmArq, FormatoPapel, ClienteERP, TipoProduto, ClienteAplicacao,PaginasA4CMP, _time] | eval chaveRicoh = _time+";"+Jobname+";"+PaginasA4Ricoh | dedup chaveRicoh | search PaginasA4Ricoh>=1000 | eval CustoTotal= (('Total K Ink Usage _cc'*custoRicohMlBlack) + ('Total C Ink Usage _cc'*custoRicohMlColor) + ('Total Y Ink Usage _cc'*custoRicohMlColor) + ('Total M Ink Usage _cc'*custoRicohMlColor)) | fillnull value=0 | eval CustoMilheiro=((CustoTotal/PaginasA4Ricoh)*1000) | eval Tipo= if( TipoProduto="AUTOENVELOPADO","AUTOENVELOPADO","INSERIDO") | eval Produto = ClienteAplicacao."-".Tipo | timechart span=1week avg(CustoMilheiro) by Produto | streamstats values(CustoMilheiro) as prev | eval prev=coalesce(prev,CustoMilheiro) | where CustoMilheiro>(1.2*prev)

renanprado96 · ‎07-07-2016

returned: No results found. search: index=ricoh | table pkNmArq, "Total K Ink Usage _cc",Jobname, date_month , PaginasA4Ricoh, "Total C Ink Usage _cc","Total Y Ink Usage _cc","Total M Ink Usage _cc", custoRicohMlColor, custoRicohMlBlack, _time | join type=inner max=0 pkNmArq [search index=cmp date_year>=2015 idEtapa=3 CentroImpressao="Alphaville" Maquina="*IP5000_1*" OR Maquina="*IP5000_2*" ClienteAplicacao="TELECOMUNICAÇÕES DE SÃO PAULO S/A (TELESP) - FATURA AUTOENVELOPADA A3 - AT*" | table pkNmArq, FormatoPapel, ClienteERP, TipoProduto, ClienteAplicacao,PaginasA4CMP, _time] | eval chaveRicoh = _time+";"+Jobname+";"+PaginasA4Ricoh | dedup chaveRicoh | search PaginasA4Ricoh>=1000 | eval CustoTotal= (('Total K Ink Usage _cc'*custoRicohMlBlack) + ('Total C Ink Usage _cc'*custoRicohMlColor) + ('Total Y Ink Usage _cc'*custoRicohMlColor) + ('Total M Ink Usage _cc'*custoRicohMlColor)) | fillnull value=0 | eval CustoMilheiro=((CustoTotal/PaginasA4Ricoh)*1000) | eval Tipo= if( TipoProduto="AUTOENVELOPADO","AUTOENVELOPADO","INSERIDO") | eval Produto = ClienteAplicacao."-".Tipo | timechart span=1week avg(CustoMilheiro) by Produto | streamstats values(CustoMilheiro) as prev | eval prev=coalesce(prev,CustoMilheiro) | where CustoMilheiro>(1.2*prev)

renanprado96 · ‎07-07-2016

returned: Error in 'delta' command: Invalid argument: 'delta'

renanprado96 · ‎07-07-2016

I found this error in Scheduler.log. I was trying to send an email in an alert. 07-07-2016 06:29:06.697 -0300 INFO SavedSplunker - savedsearch_id="admin;search;lab_real 1", user="admin", app="search", savedsearch_name="lab_real 1", status=skipped, reason="maxconcurrent limit reached", scheduled_time=1467883740, window_time=0 Thank you!!

renanprado96 · ‎07-07-2016

I want Splunk to notify me when the result increase is more than 20% for the week. For example: When C2 is more than 20% greater than C1 and C1 20% greater than C0. Can alert me, changing color, can be anyway. Thank you!

renanprado96 · ‎07-01-2016

The files were already in this condition.

renanprado96 · ‎07-01-2016

When I try to open a search for an app that is not the "Search" gives the following result: . . I imagine my other apps do not have the "Search". How to fix this? I would have to add the search in apps or redirect the search to "Search" app? App: digital;

Posts	82
Solutions	0
Karma Given	2
Karma Received	5
Member Since	‎01-06-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

It is possible to use the delta command to calcula...

How to configure the timezone by sourcetype?

How to set the time zone in an index?

Trying to send an alert email, why am I getting er...

How to set up an alert to trigger when the search ...

Problems opening a search on an APP...

How to configure Splunk to parse uppercase field v...

How to configure Splunk to parse uppercase field v...

How to export a report in Splunk and open it in Ex...

What does the _bump endpoint do?

Re: It is possible to use the delta command to cal...

It is possible to use the delta command to calcula...

Re: How to configure the timezone by sourcetype?

Re: How to configure the timezone by sourcetype?

Re: How to configure the timezone by sourcetype?

Re: How to configure the timezone by sourcetype?

Re: How to set the time zone in an index?

Re: How to set the time zone in an index?

Re: How to configure the timezone by sourcetype?

How to configure the timezone by sourcetype?

Re: How to set the time zone in an index?

Re: How to set the time zone in an index?

Re: How to set the time zone in an index?

Re: How to set the time zone in an index?

Re: How to set the time zone in an index?

Re: How to set the time zone in an index?

How to set the time zone in an index?

Re: How to set up an alert to trigger when the sea...

Re: How to set up an alert to trigger when the sea...

Re: How to set up an alert to trigger when the sea...

Re: How to set up an alert to trigger when the sea...

Trying to send an alert email, why am I getting er...

How to set up an alert to trigger when the search ...

Re: Problems opening a search on an APP...

Problems opening a search on an APP...