About kiamco

kiamco · ‎11-01-2019

this should do the trick e\>(?<msg>[a-zA-Z .]+)<\/M

kiamco · ‎10-09-2019

you might want to just use a |timechart like ...base search |timechart count(foo) by foo

kiamco · ‎10-09-2019

no problemo, happy to help 😄

kiamco · ‎10-07-2019

this is what I use | rest /services/authentication/users splunk_server=local | fields title, roles, email | rename title as user | search | join max=2 usetime=true type=left user [search index=_audit action="password change" info="succeeded" | stats latest(timestamp) as change_timestamp by user | fields + change_timestamp user ] |eval change_timestamp = if(isnull(change_timestamp),"never",change_timestamp ) | eval display_roles=mvjoin(roles, ", ") | eval password_days=trunc((now() - strptime(change_timestamp, "%m-%d-%Y %H:%M:%S.%Q"))/84600) | sort - password_days | table user, email, change_timestamp, password_days, display_roles

kiamco · ‎10-07-2019

can you provide a sample data for both indexes? my first though would be using a join but since you mentioned that the join is not working I am curious on what the data looks like

kiamco · ‎10-07-2019

try something like this | your search | rex field=`some_field` "(?<=\/shop)(?<uri>[a-zA-Z-0-9.\/-]+)" | table uri

kiamco · ‎12-17-2018

Thanks for pointing that out @aholzer , I have been trying to debug this query for hours and totally forgot that it needed a (')

kiamco · ‎11-29-2018

I have this query that is supposed to get the difference between the primary region and all other regions, but for some reason nothing is being returned for d_* | eval ms_region=rtrim("region_"+ms_zone, "abcdefgh") |chart count OVER tenant_id by ms_region |rename region_ap-southeast-1 as "primary_region" | rename region* as r* |foreach r* [eval d_<<MATCHSTR>>=primary_region - <<FIELD>>] here is my table: tenant_id primary_region r_ap-northeast-1 r_ap-south-1 r_us-east-1 r_us-west-1 18 60 0 0 0 0 344 370 0 0 0 0 366 3505 0 23 0 0 441 1323 0 0 0 0 My expected result would be to add columns like d_$region1$ d_$region2$, d_$region3$, which would contain the difference of the primary region and other regions. I tried debugging it and found out, for some reason, <<FIELD>> in the foreach doesn't return anything.

kiamco · ‎10-09-2018

Hello, I have a question about the use of the foreach command. I have a good idea what the foreach command can do for example: index=summary source="summary_events_2" orig_source=$source$ ms_region=$region$ ms_level=$level$ | timechart span=5m partial=f sum(count) as count | timewrap d series=short | rename s0 as Today | foreach s* [eval d<<MATCHSTR>> = Today - <<FIELD>>] I know that this will create new columns like d1,d2,d3,d4,... that will contain the difference of Today and s* . Here is my dilemma: what if I do something like this: index=summary source="summary_events_2" orig_source=$source$ ms_region=$region$ ms_level=$level$ | timechart span=5m partial=f sum(count) as count by ms_level (//note that there are 4 levels) | timewrap d series=short | rename *_s0 as *_Today This would give me columns like ERROR_Today, WARNING_TODAY, ERROR_s1, ERROR_s2,WARNING_s1.... Is there a way to achieve the same result as the first query using the foreach command. I want to be able to create new columns like ERROR_d1, ERROR_d2, WARNING_d1, WARNING_d2

kiamco · ‎08-13-2018

So I have to scenarios When user click on the no-event value a dashboard appers with a query that would probably contain something like: level=$level$ NOT event=* |eval ms_region=rtrim(ms_zone, "abcdefgh") |where ms_region="$region$" When user click on any event that is not labeled as 'no-event' search would be something like: level=$level$ event=$event$ |eval ms_region=rtrim(ms_zone, "abcdefgh") |where ms_region="$region$"

kiamco · ‎08-13-2018

@renjith.nair so what I wanted is for the column fields would be: _time event totalEvents day1 day2 day3 day4 day5 day6 day7 There is a reason why I wanted it in this format, I was planning on running a foreach command and compare the past days by the total event and see whether or not it is an outlier stuff like that.

kiamco · ‎08-12-2018

@renjith.nair so I tried the query above and this is what I got : sample result _time event sum(count) dayno 2018-08-05 23:00:00 idna-encode-failed 1 Day1 2018-08-05 23:00:00 monitor-set-selection-error 4 Day1 2018-08-05 23:00:00 no-event 53 Day1 2018-08-05 23:00:00 srouter-browser-useragent-ie-valid-failed 8 Day1 2018-08-05 23:00:00 tc-frame-load-timed-out 2 Day1 2018-08-05 23:00:00 tc-pairing-unexpected-response 6 Day1 2018-08-05 23:05:00 auth-password-reset-failed 1 Day1 2018-08-05 23:05:00 no-event 60 Day1 2018-08-05 23:05:00 srouter-bad-url 2 Day1 2018-08-05 23:05:00 srouter-browser-useragent-ie-valid-failed 10 Day1 2018-08-05 23:05:00 srouter-fetch-retry-failed 43 Day1 2018-08-05 23:05:00 tc-cb-generated-exception 1 Day1 2018-08-05 23:05:00 tc-pairing-unexpected-response 2 Day1 2018-08-05 23:10:00 no-event 77 Day1 2018-08-05 23:10:00 service-unavailable-error 1 Day1 2018-08-05 23:10:00 srouter-bad-url 2 Day1 2018-08-05 23:10:00 srouter-browser-useragent-ie-valid-failed 8 Day1 2018-08-05 23:10:00 srouter-fetch-retry-failed 28 Day1 2018-08-05 23:10:00 surrogate-unknown-fid 4 Day1 2018-08-05 23:10:00 tc-pairing-unexpected-response 10 Day1 2018-08-05 23:15:00 monitor-set-selection-error 1 Day1 2018-08-05 23:15:00 no-event 58 Day1 2018-08-05 23:15:00 srouter-browser-useragent-ie-valid-failed 6 Day1 2018-08-05 23:15:00 srouter-fetch-retry-failed 1 Day1 2018-08-05 23:15:00 srouter-popup-pair-failure 1 Day1 2018-08-05 23:15:00 surrogate-unknown-fid 1 Day1 2018-08-05 23:15:00 tc-pairing-unexpected-response 7 Day1 2018-08-05 23:15:00 tc-uncaught-exception 1 Day1 2018-08-05 23:20:00 channel-xhr-push-lost-message 3 Day1 it goes all the way to day 7 which is giving me the information that I wanted but not in the format that I was looking for

kiamco · ‎08-11-2018

I have this problem with streamstats maybe I am not understanding it right but my expected result didnt come out from the query that I wrote index=summary source="summary_events" orig_source=some_source ms_region=us-west-1 ms_level=E* | stats sum(count) as totalEvents by _time event | streamstats time_window=1d first(totalEvents) as day1 by event | streamstats time_window=2d first(totalEvents) as day2 by event | streamstats time_window=3d first(totalEvents) as day3 by event | streamstats time_window=4d first(totalEvents) as day4 by event | streamstats time_window=5d first(totalEvents) as day5 by event | streamstats time_window=6d first(totalEvents) as day6 by event | streamstats time_window=7d first(totalEvents) as day7 by event The sample result is: _time event totalEvents day1 day2 day3 day4 day5 day6 day7 2018-08-04 22:00:00 no-event 217 217 217 217 217 217 217 217 2018-08-04 22:00:00 service-error 1 1 1 1 1 1 1 1 2018-08-04 22:00:00 bad-url 7 7 7 7 7 7 7 7 my expectation was that it is going to display the total count for each past day per 5min interval but I am just getting the same value for all of them.Any ideas what Im doing wrong? as sample event that I am aggregating is 08/11/2018 22:15:00 +0000, search_name="Summary index: Error reports", search_now=1534026000.000, info_min_time=1534025400.000, info_max_time=1534026000.000, info_search_time=1534026007.707, count=3, event="some_event", ms_level=ERROR, ms_region="region", ms_version=version, orig_source="source"

kiamco · ‎08-10-2018

I have this column named as "cloud-look-up_s0" and "cloud-look-up_s1" and so on and so on. so What I want to do is to rename "cloud-look-up-s0" with "cloud-look-up-Today". But here is the thing, I want to name all fields that have "s0" in the end to "Today " and the columns will have a different string attached in the front so the format would be something like: string1_s0, string1_s1 string2_s0, string1_s2 string3_s0, string1_s3 string4_s0, string1_s4

kiamco · ‎08-09-2018

@mmodestino explained it so well Thankss!!!

kiamco · ‎08-09-2018

i thought of using a summary index also but if run a summary index every 15m wouldn't it affect the accuracy of the predict. for example a query with predict that runs for 2 months would get a more accurate prediction compared to a 4 hours prediction, or am I misunderstanding the predict command. I am not sure however hoe the accelerated report works. I have read the documentation but I don't really know how that would solve my issue.

kiamco · ‎08-09-2018

I know that the predict functions become more accurate when you feed it more data but I don't want to be querying 2 months worth of data in a dashboard that would take like 2 mins to load. Is there a way to get a more accurate prediction without actively querying the past 2 months? or is there a way to do this differently with a different function. FYI I d not have authority to download the MLTK I know this is a tough question but would like to hear some ideas. index=summary source="summary_events_2" orig_source=/var/log/pnr* ms_region=us-west-1 ms_level=E* | timechart span=15m sum(count) as count | predict count as count_prediction period=7 algorithm=LLP5 future_timespan=10 holdback=0 upper50=high_prediction lower5=low_prediction | rename high_prediction(count_prediction) as high_prediction | eval deviation=count-round(count_prediction,0) | streamstats window=300 current=true median(deviation) as median_of_residual | eval abs_dev=(abs(deviation - median_of_residual)) | streamstats window=300 current=true median(abs_dev) as median_abs_dev | eval upper_bound=if(median_of_residual + median_abs_dev * 5 < 0,abs(median_of_residual + median_abs_dev), median_of_residual + median_abs_dev * 5) | eval anomaly=if(deviation > upper_bound,1,0) | predict deviation as deviation_prediction period=7 algorithm=LLP5 future_timespan=0 holdback=0 upper20=high_prediction lower20=low_prediction | fields - median_of_residual, median_abs_dev, abs_dev, high_prediction, bounds, count, count_prediction

kiamco · ‎08-03-2018

if I am understanding the question right. I believe what you want to look up is the transpose function it turns columns into rows https://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Transpose

kiamco · ‎07-19-2018

@ixixix_spl so I assuming that transaction_id is unique first query | table transcation_id | join type=left transcation_id [|search second query |table orders] something like that but it gets a bit complicated depending on the fields you want to join but try it out see if it works

kiamco · ‎07-17-2018

have you considered a join instead of a subquery it might be easier

kiamco · ‎07-13-2018

yes there is, I believe when you click on "more actions" in the chart there as option to edit drilldown. For the token name it can be anything you think of that would best represent the $click.value2$

kiamco · ‎07-05-2018

use the search bar on the top next to the activity button, I had this problem few years ago didn't know that the search bar on top can do that haha

kiamco · ‎07-03-2018

ye a this would work if applied the time token before the appendcols but unfortunately that is no the case. what I am trying to basically do is when user clicks on graph it will show the events in that specific point in time but I want the sparkline to show the trend of that event starting from 14 days before the "time_token".

kiamco · ‎07-02-2018

Try using the join command eg: your first search.. |join "License key" [|search second search]

kiamco · ‎07-02-2018

I have this query index=summary source="summary_events_2" orig_source=*pnr* ms_region=us-west-1 (ms_level=ERROR OR ms_level=error) NOT event=no-event | stats sum(count) as count by event, ms_level,_time |appendcols [|search earliest=-14d index=summary source="summary_events_2" orig_source=*pnr* ms_region=$region$ (ms_level=ERROR OR ms_level=error) | stats sparkline(sum(count),1d) as trend_span_1d sparkline(sum(count),7d) as trend_span_7d by event, ms_level] | where count!="" my problem is that I want to create a specific time range for sparkline. Keep in mind that I am using a drill down time token with this query. I have been searching for a way to return a range based on a time token, any ideas? eg: starting at the $time_token$ and the past 14 days

Posts	44
Solutions	3
Karma Given	10
Karma Received	5
Member Since	‎03-29-2018

Online Status	Offline
Date Last Visited	‎11-23-2020 01:08 PM

In a search, how would I get the difference betwee...

How do I create new columns with the foreach comma...

Is there a way to setup a condition for drilldown ...

need help with streamstats

How to rename all the fields with "s0" at the end ...

Is there a way to specify a different time range f...

how can I set a time range based on a time token

when using predict fields become null

question about predict

I need to fill missing logs in summary index

Re: Write Regex to capture words between container...

Re: How to build a chart on unique field

Re: How to Calculate Splunk User Password Age

Re: How to Calculate Splunk User Password Age

Re: How to search two Indexes based on matching fi...

Re: extract uri

Re: In a search, how would I get the difference be...

In a search, how would I get the difference betwee...

How do I create new columns with the foreach comma...

Is there a way to setup a condition for drilldown ...

Re: need help with streamstats

Re: need help with streamstats

need help with streamstats

How to rename all the fields with "s0" at the end ...

Re: Is there a way to specify a different time ran...

Re: Is there a way to specify a different time ran...

Is there a way to specify a different time range f...

Re: How to list multiple fields separately and cal...

Re: Equivalent of SQL WHERE IN Subquery clause?

Re: Equivalent of SQL WHERE IN Subquery clause?

Re: Managing Tokens on my Dashboard

Re: How can I identify which dashboards include a ...

Re: how can I set a time range based on a time tok...

Re: Is there a way to make tables in a dashboard w...

how can I set a time range based on a time token