About kevinmabini

kevinmabini · ‎01-18-2024

Hello, We have PROD and DEV instance that are both running Mission Control with the following versions below: PROD - ES v7.1.1, Mission Control v3.0.2 DEV - ES v7.3.0, Mission Control v3.0.2 PROD works fine and incidents are tally between ES and MC. Unfortunately for DEV, some of the notables from ES are not flowing into MC. Is this an issue with the latest version of ES? I've looked into the latest release notes of both ES and MC, and it's not listed in the "Known Issues" page. Can't find anything helpful too in the internal logs. Any insights will be highly appreciated. Thank you!

kevinmabini · ‎12-16-2018

Found the problem. I forgot that the code you posted was from a dashboard. I just had to remove the extra '$' in the title and owner. It's working fine now. Thanks @woodcock ! 🙂

kevinmabini · ‎12-14-2018

Hi @randy_moore, @woodcock - This one's a really good SPL to determine the status of the bundles. However, i tried to run it in my side and i'm not getting any data for the bytes and other numerical fields. Though i can see the lookup names and owners. Hope you can give insights on this. Thank you in advance for your assistance!

kevinmabini · ‎07-25-2017

Thanks for the response @DalJeanis! By ticket, i mean these are incidents logged by the users. We are using ML to auto-categorize the logged incident if it is an 'Admin Request' or 'Change Request' etc. For the data, what if there are new set of data ingested in Splunk and was also auto-categorized, is it advisable to use that as a training data for ML?

kevinmabini · ‎07-24-2017

Hey Guys, Hope you can give insights on this. Currently, we are using Machine Learning in predicting new ticket type/category. We are using the whole index as an input to train our model. My question, is it right to use the whole index? Or does ML just need a new set of data/events in training the model?,Hey Guys, Hope you can give insights on this. Currrently, we are using Machine Learning(ML) to predict a certain ticket type/category. We are using the whole index as an input to train the model. My question, is it right to use the whole index as an input? Or does ML just need the new set of data in training the model?

Posts	5
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎07-24-2017

Online Status	Offline
Date Last Visited	‎01-18-2024 06:36 AM

Splunk ES Notables Not Flowing into Mission Contro...

Data to Train Machine Learning

Splunk ES Notables Not Flowing into Mission Contro...

Re: Is there a search to show bundle size in the D...

Re: Is there a search to show bundle size in the D...

Re: Data to Train Machine Learning

Data to Train Machine Learning