About gowtham495

gowtham495 · ‎05-11-2020

I am struggling to send Splunk results to Teams in table format. Can you please tell how did you achieve that ?

gowtham495 · ‎07-30-2019

@agoyal thank you. I am having same issue. is there any workaround instead of updating to v7.0.3 (Actually, my second panel depends on token from first panel)

gowtham495 · ‎03-21-2019

i have lookup like following : ID jobname start_time end_time frequency 1 abc 0:00 21:00 60 2 def 3:00 4:00 10 ..... . . . i need to populate the lookup in such a way that i should have my 1st row repeated 21 times (i.e no of times the job gets repeated between the start time and end time, having 60 minutes of frequency) similarly, def row should repeat for 10 times (i.e. 3:10, 3:20, 3:30,....4:00) is there any SPL command to populate the lookup like this ? Thanks.

gowtham495 · ‎02-28-2019

I'm working on a similar problem @skoelpin . Could you please elaborate your approach of solving this. Problem i'm facing is like, single host has multiple mounts(C:, D:, etc). my approach is good when servers list is less but when # of servers increase, it's difficult. Thanks is advance.

gowtham495 · ‎02-26-2019

i tweaked this query to suit my requirements. Worked well ! Thanks a lot @whrg

gowtham495 · ‎02-21-2019

See if you can do this way : Create a Report with your search query and schedule it. Create a Dashboard and add a panel containing that Report. In Dashboard, Export >> Schedule PDF Delivery >> here you can edit settings like that of an alert (for ex: to, cc, cron, message, etc..) This way, at the time of any updates, you can edit the Report alone. Other things will be automatically taken care of.

gowtham495 · ‎02-20-2019

is there any workaround available now to do what is asked in the question ?

gowtham495 · ‎02-20-2019

Is success/failed is captured in any field name?

gowtham495 · ‎02-20-2019

i recently came across same situation @agoyal in alert both statistics table and visualization will be included. so to send only timechart in mail, i created a dashboard and scheduled that as a PDF attachment , like @chrisyoungerjds mentioned above. it worked !

gowtham495 · ‎02-13-2019

this one worked.. thanks !!!

gowtham495 · ‎02-13-2019

@nickhillscpl thanks for the query. but it does not showing the desired output. btw,i need the text between 2nd and 3rd CR too.

gowtham495 · ‎02-13-2019

thanks for the reply . can you please explain how this takes care of "3rd CR "

gowtham495 · ‎02-13-2019

I have following sample event jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 CR sagdiugsds 7126372 nklsdlkCR i need to extract field upto 3rd CR my output string should be like this : jaskdjkasdkjas CR akjhdjhdjsdhCR 1231jljk23klj3 Can this be done using rex command ? any help is appreciated !

gowtham495 · ‎01-17-2019

thanks for your response @niketnilay. Actually i have simplified the problem for easy understanding. real problem is like we have 50 lines of query, we need to create separate csv's for each host (which has a child query take host name and do some more process...that's too technical). currently we are manually updating host names for 50 occurrences in the query (and repeat this process for 20 other servers ), instead of that we need a user defined token, so that we change host name only once and other places where the host name appear should be taken care of. hope i made it clear. please tell if some other info is needed. thank you

gowtham495 · ‎12-24-2018

i have a lookup hostlist.csv which have list of host names and other metrics related to it. i need to filter out each host and their corresponding metrics into separate lookup file. for ex: |inputlookup hostlist.csv |eval hostname="abc" |table $hostname$,metrics |outputlookup $hostname$.csv so if i manually change the hostname 's value and run the search query, it should save the metrics of that host in a lookup file with above mentioned naming convention. Is it possible in Splunk? thanks in advance.

gowtham495 · ‎12-14-2018

I have a result like: _time HostA HostB HostC... 01:00 1 4 2 02:00 5 2 4 03:00 3 1 2 and i also have a lookup host.csv , which contains host names like: Host HostA HostB HostC .. Will i get a query which will run through host.csv and iterate over host name and pass those values to outside predict command, which in turn predicts future value for all the hosts listed in the outside result. something like : [outside result] | predict [host names from host.csv ] Any help is appreciated !

Posts	16
Solutions	0
Karma Given	6
Karma Received	1
Member Since	‎11-01-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

SPL command to copy paste rows in lookup with incr...

Extract field till nth repetition of a string

Can a eval field name used as string in SPL search...

In the Splunk Machine Learning Toolkit, how do you...

Re: Can we add search query to the output in Teams

Re: Why "done" tag is disappeared when I edit pane...

SPL command to copy paste rows in lookup with incr...

Re: How to get Capacity planning and Availability ...

Re: Can a eval field name used as string in SPL se...

Re: How can I have one query for both a dashboard ...

Re: How to send a dashboard in the body of an emai...

Re: consolidate the alert

Re: Timeline chart as attachment with email alert.

Re: Extract field till nth repetition of a string

Re: Extract field till nth repetition of a string

Re: Extract field till nth repetition of a string

Extract field till nth repetition of a string

Re: Can a eval field name used as string in SPL se...

Can a eval field name used as string in SPL search...

In the Splunk Machine Learning Toolkit, how do you...