About Kumar23

Kumar23 · ‎11-13-2020

Hi @Richfez , edited the question. Please check and let me know still it's not clear. Thanks, Kumar

Kumar23 · ‎11-11-2020

we are getting severity medium and high data with time into splunk. normal data not sending into splunk. if there is no data for next 3 minutes we need to consider that severity as normal with start time and end time(end_time=till next severity(high or medium) start time). need to show severity start time and end time when severity changes from normal to medium, medium to high, high to normal. sample data: 12/11/2020 09:24:46:00 severity: high 12/11/2020 10:24:46:00 severity: medium 12/11/2020 12:34:46:00 severity: medium 12/11/2020 14:44:46:00 severity: high output:- severity=high start_time=12/11/2020 09:24:46:00 end_time=12/11/2020 09:27:46:00 severity=normal start_time=12/11/2020 09:27:46:00 end_time=12/11/2020 10:24:46:00 severity=medium start_time=12/11/2020 10:24:46:00 end_time=12/11/2020 10:27:46:00 severity=normal start_time=12/11/2020 10:27:46:00 end_time=12/11/2020 12:34:46:00 severity=medium start_time=12/11/2020 12:34:46:00 end_time=12/11/2020 12:37:46:00 severity=normal start_time=12/11/2020 12:37:46:00 end_time=12/11/2020 14:44:46:00 severity=high start_time=12/11/2020 14:44:46:00 end_time=12/11/2020 14:47:46:00 severity=normal start_time=12/11/2020 14:47:46:00 end_time=12/11/2020 23:59:59:00 i just tried to adding 3minutes time to the "_time" by using "eval time=_time+180". now am getting next 3minutes as time. end time also will get by using "| streamstats last(_time) as end_time".but how to add the severity to that next 3mins time.

Kumar23 · ‎08-18-2020

Hi @richgalloway did you understand my query? Please let me know for any further information. Thanks, Kumar23

Kumar23 · ‎08-10-2020

We will set the threshold values for KPI's like High, Medium, Normal in ITSI right. I need a query to get that threshold values for various KPI's.

Kumar23 · ‎08-10-2020

Kumar23 · ‎08-08-2020

Did you find any query to get thresholds? Am also looking for the same

Kumar23 · ‎09-14-2018

Hi @swetar, How you achieved the above requirement, please let me know am also expecting the same. Thanks in advance. Vinil

Kumar23 · ‎03-10-2017

UAT $Prefixhost$_Basesearch($HostName$) | fields * $TimeSpan.earliest$ $TimeSpan.latest$ <query>`$Prefixhost$_Process($HostName$)` instance=$instance$ | fields *</query> <earliest>$TimeSpan.earliest$</earliest> <latest>$TimeSpan.latest$</latest> <input type="radio" searchWhenChanged="true" token="Enter SID/HostName"> HostName SID $SID$ $HostName$ $HostName$ $SID$ Enter Hostname (click away): UA Clone_GSO Clone_GSO Clone_GSO Clone_GSO Clone_GSO Enter SID (click away): Select Time Window -4h@m now Select Timechart Span: Select a Span from dropdown to set chart resolution. Search by Hostname: Click on a row of "SID to Host Lookup" for Perfmon statistics Select Timechart Span: 1 Minute 5 Minutes 10 Minutes 15 Minutes 30 Minutes 60 Minutes 5m 5m Advanced Debug Enable </panel> <panel > <title>SID to Host Lookup</title> <table depends="$SID$"> <search > <query>source=User_activity_stats index=wks_summary sourcetype="user_activity_stats" SID=$SID$ | convert auto(Last_Reported) auto(First_Reported) | table orig_host SID First_Reported Last_Reported _time | dedup SID orig_host sortby -Last_Reported | sort -Last_Reported | convert ctime(First_Reported) ctime(Last_Reported)| rename orig_host as HostName</query> <earliest>-30d@d</earliest> <latest>@d</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <drilldown> <set token="HostName" >$row.HostName$</set> <fieldset autoRun="true" submitButton="false"> <change> <condition match="match('row.value',"^CH.*")"> <set token="Prefixhost">UA</set> </condition> <condition match="match('row.value',"^V\d{1,2}\d\d.*")"> <set token="Prefixhost">Clone_GSO</set> </condition> <condition match="match('row.value',"L.*")"> <set token="Prefixhost">Clone_GSO</set> </condition> <condition match="match('row.value',"ATC.*")"> <set token="Prefixhost">Clone_GSO</set> </condition> <condition match="match('row.value',"\dCP.*")"> <set token="Prefixhost">Clone_GSO</set> </condition> <condition match="match('row.value',"W.*")"> <set token="Prefixhost">Clone_GSO</set> </condition> </change> </fieldset> <option name="drilldown">row</option> <option name="count">20</option> </drilldown> </table> </panel> </row> <row depends="$HostName$"> <panel> <title>CPU Utilization</title> <chart id="link1"> <title>OverAll</title> <search base="Overview_Data" > <query> | timechart span=$chartSpan$ avg("%_Processor_Time") as %_Processor_Time, avg("%_User_Time") as %_User_Time, avg("%_Privileged_Time") as %_Privileged_Time avg("%_Interrupt_Time") as %_Interrupt_Time</query> </search> <chart id="link35"> <title>Context Switches/Sec</title> <search base="Overview_Data" > <query> | timechart span=$chartSpan$ Avg(Context_Switches/sec) As "Context Switches/sec"</query> </search> </chart> </panel> </row> </form>

Kumar23 · ‎03-08-2017

My Scenario:- Macro1=US_Base_Search Macro2= AD_Base_Search If host=AB* then need to get the data from macro US_Base_Search,( host=C* OR host != AB*) then need to get the data from different macro AD_Base_Search. UAT $Prefixhost$_Basesearch($HostName$) | fields * $TimeSpan.earliest$ $TimeSpan.latest$ <query>`$Prefixhost$_Process($HostName$)` instance=$instance$ | fields *</query> <earliest>$TimeSpan.earliest$</earliest> <latest>$TimeSpan.latest$</latest> <row> <input type="radio" searchWhenChanged="true" token="Enter SID/HostName"> HostName SID $SID$ $HostName$ $HostName$ $SID$ Enter Hostname (click away): UA Clone_GSO Clone_GSO Clone_GSO Clone_GSO Clone_GSO Enter SID (click away): Select Time Window -4h@m now Select Timechart Span: Select a Span from dropdown to set chart resolution. Search by Hostname: Click on a row of "SID to Host Lookup" for Perfmon statistics Select Timechart Span: 1 Minute 5 Minutes 10 Minutes 15 Minutes 30 Minutes 60 Minutes 5m 5m Advanced Debug Enable SID to Host Lookup source=User_activity_stats index=wks_summary sourcetype="user_activity_stats" SID=$SID$ | convert auto(Last_Reported) auto(First_Reported) | table orig_host SID First_Reported Last_Reported _time | dedup SID orig_host sortby -Last_Reported | sort -Last_Reported | convert ctime(First_Reported) ctime(Last_Reported)| rename orig_host as HostName -30d@d @d true true none $row.HostName$ US AD AD AD AD AD row 20 CPU Utilization OverAll | timechart span=$chartSpan$ avg("%_Processor_Time") as %_Processor_Time, avg("%_User_Time") as %_User_Time, avg("%_Privileged_Time") as %_Privileged_Time avg("%_Interrupt_Time") as %_Interrupt_Time Context Switches/Sec | timechart span=$chartSpan$ Avg(Context_Switches/sec) As "Context Switches/sec"

Posts	9
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-08-2017

Online Status	Offline
Date Last Visited	‎11-13-2020 01:43 PM

if there is no data for next 3 minutes we need to ...

Splunk query to get the threshold values of differ...

I have two macro's depends on text input type host...

Re: if there is no data for next 3 minutes we need...

if there is no data for next 3 minutes we need to ...

Re: Splunk query to get the threshold values of di...

Re: Splunk query to get the threshold values of di...

Splunk query to get the threshold values of differ...

Re: How to query kpi thresholds of various service...

Re: How can I monitor the status of cluster nodes ...

Re: I have two macro's depends on text input type ...

I have two macro's depends on text input type host...