About balash1979

balash1979 · ‎03-28-2021

I got the answer for my previous question here : https://community.splunk.com/t5/Splunk-Search/Join-searches-and-make-a-calculation/m-p/545615#M154587 Here is my current search <search A> | bin span=1d _time | stats count max(size) AS Users_Waiting by _time | append [search <search B> | bin span=1d _time | stats count as Daily_Users by _time | streamstats sum(Daily_Users) as Cumulative_Users ] | stats values(*) as * by _time | eval Users_Not_Waiting = Cumulative_Users - Users_Waiting | timechart span=1d Users_Not_Waiting The issue that I am having is the following: Search A - Has events for the last 9 days so I can get Users_Waiting data Search B - Doesnt have events for the last 2 days so I dont get any data Because Search B doesnt have events for the last 2 days, when I do the eval, I am not able to difference for the last 2 days. I want Search B (which is cumulative data) to continue to show 3765156 so the diff is calculated.

balash1979 · ‎03-27-2021

I am trying to plot only cumulative users in timechart but daily user value also comes in the timechart. How can I ignore the daily user to be shown Here is my search: <search> | timechart span=1d count as Daily_Users | streamstats sum(Daily_Users) as Cumulative_Users --Sunray

balash1979 · ‎03-26-2021

Sorry if i wasnt very clear. This is search1 <search A> | stats count max(size) AS Users_Waiting This is search 2 join [search <search B> | stats count as Daily_Users | streamstats sum(Daily_Users) as Cumulative_Users Is there a way to do Cumulative_Users-Users_Waiting (basically difference between these 2 numbers) and then timechart the difference ? Yes, I dont have any common fields between the 2 searches.

balash1979 · ‎03-26-2021

I would like to run 2 searches and calculate the difference between 2 fields and plot the result using timechart I have tested both these searches independently and it works fine. I am trying this out <search A> | stats count max(size) AS Users_Waiting | join [search <search B> | stats count as Daily_Users | streamstats sum(Daily_Users) as Cumulative_Users | timechart span=1d Cumulative_Users-Users_Waiting So basically, I want to take the count of first search which is Users_Waiting Take the count of 2nd search which is Cumulative_Users Draw a timechart with (Cumulative_Users - Users_Waiting) Is my approach correct ?

balash1979 · ‎12-26-2020

I would like to predict when a task is going to get completed and present that as a forecast graph. here is what i have got so far <<my search>> | timechart span=1d count(path) as path | predict path I am getting an average count of 10000 per day and the goal of my task is to reach 100000 (as an example). Basic math shows it would take 100000/10000 = 10 days but is there a way i can show that in a splunk chart ? --Sunray

balash1979 · ‎12-25-2020

Thanks. If i add "table completed, perc" , i can get the correct data. How can i display this as a pie chart ? in the pie chart, i would like to see % completed out of the total. Thanks

balash1979 · ‎12-25-2020

I have total of 7M users. My splunk query shows the count of completed users. I want to draw a pie chart showing completed users vs Total users. So far I have gotten this far << my query>> | eval TotalMax=7000000 | stats count(Path) as completed | eval perc=(completed/TotalMax)/100 | table completed,perc count(Path) which is same as completed comes out as 200000 But perc is not getting calculated. Am I missing anything ? --Sunray

balash1979 · ‎12-25-2020

I got the query that shows count every hour using timechart command <<my query>> | timechart span=1h count(path) What I would like is to show both count per hour and cumulative value (basically adding up the count per hour) How can I show the count per hour as column chart but the cumulative value as a line chart ? --Sunray

balash1979 · ‎04-03-2020

Never mind. I was looking at the wrong values. Thanks for pointing it out.

balash1979 · ‎04-03-2020

Here is the message in splunk and I am trying to extract customer and channel {"line":"2020-04-03T12:24:54.589Z LCS {\"customer\":5,\"channel\":\"sqs\",\"notificationId\":213546} When I run something like this index=docker "Exception" | rex "CustomerID: (?<customer>\S+)," | rex "channelName\\\\\":\\\\\"(?<channel>\w+)" | stats count(notificationId) by CustomerID I am able to see the CustomerID extracted but when I do index=docker "Exception" | rex "CustomerID: (?<customer>\S+)," | rex "channelName\\\\\":\\\\\"(?<channel>\w+)" | stats count(notificationId) by CustomerID, channelName It is not displaying any results which tells me I am not extracting the channelName correctly. How can I fix this ?

balash1979 · ‎02-27-2020

When I run my Splunk query, I get url field and the value of the field is like this https://location-server-aks-611ab294.test.australia.azm.io:443/api I would like to extract the words "location" and "server" from the above value. How can I accomplish this ?

balash1979 · ‎12-17-2019

I actually dont know the architecture as I personally dont manage the splunk. Not sure about ingest volumes. The query is propriety and hence not able to share. The query is basically getting events from lot of different cloud stacks we have and then I sort the data before displaying in the dashboard. When I run the search, I see lot of events getting processed (in the order around 10 million+) with no event sampling. So wondering if there is anything i can do to speed things up.

balash1979 · ‎12-17-2019

I have the following source in my dashboard. The dashboard loads fine but it takes a long time (around 5 to 10 mins) for the search to complete. I am interested in looking at last 24 hrs data in this panel. Is there any options that I can use in my source to speed things up ? <form theme="dark"> <fieldset submitButton="false"> <input type="time" token="field1"> <label>TimeRange</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>MY ENTIRE QUERY SEARCH</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel>

balash1979 · ‎12-12-2019

Here is my log line {"line":"2019-12-09T11:40:13.049Z LCS LCE [pool-8-thread-13] INFO i.r.rest.- job:{id=cd254f615c304c028c85c28a3356a432, status=ready, createdOn=1575891540031, timeTaken=73017, lastModified=1575891613048} I would like to extract timeTaken from the above line and divide that by 60000. What regex should I use.

balash1979 · ‎11-27-2019

Same issue as before. it says invalid date in the dashboard. Sounds like some server side settings that need to change ?

balash1979 · ‎11-27-2019

I am using the following code in my dashboard <search> <query>| makeresults</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <done> <eval token="tokTime">$job.earliestTime$</eval> <eval token="tokEarliestTime">strftime(strptime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S %p"),"%m/%d/%y %I:%M:%S %p") </eval> <eval token="tokLatestTime">strftime(strptime($job.latestTime$,"%Y/%m/%dT%H:%M:%S %p"),"%m/%d/%y %I:%M:%S %p")</eval> </done> </search> In my panel, i use this <title>from $tokEarliestTime$ to $tokLatestTime$</title> When I save my dashboard it shows up as from invalid date to invalid date Do I need to change any personal settings in splunk to get this working ?

balash1979 · ‎11-21-2019

I gave the log line as an example so using the makeresults wont work for me. Lets say I have different log lines with different custName and different cloudAccount, how can i do a generic search that will show me only the lines associated with cloudAccount="ABC-Cloud" ?

balash1979 · ‎11-21-2019

Here is the output of my log message: {"line":"2019-11-21T22:09:29.982Z LCS LCE [abc-75] INFO i.r.queue.poller.SqsMessagePoller - Tags: {accountId=111222333, jobId=1002207394, cloudAccount=ABC-Cloud, jobAttributes={\"serviceIds\":[\"ABC\"]}, jobType=awsAccountService, custName=ABC} How can I extract the cloudAccount and CustName from the above log so I can search like this: index="*" | search cloudAccount=ABC-Cloud | search CustName=ABC ?

balash1979 · ‎11-03-2019

great. This works. Is there a way I can use timechart and show between the 2 times (that I use for the search), when the count > 1 was higher or lower

balash1979 · ‎11-03-2019

There was an issue with our Splunk forwarders and it appears our application sent duplicate logs. I am seeing a sudden spike of log count around a certain time. Is there a way to know there was, in fact, duplicate logs? What can I add to my search to find that index="docker_index" <== This is the search that i am using.

balash1979 · ‎10-08-2019

I am running a query and it provides me the following result (as an example) ENV VALUE env1 1234 env2 2345 env3 1234 env4 2345 Is there a way I can color code the lines that are same, meaning, i would like in my panel to show a color for the lines env1 1234 env3 1234 and some other color for lines env2 2345 env4 2345 Basically, I am trying to do a color coding scheme so in my dashboard if my panel has different colors its an alarm for me that something is different. Ideally, I shud have the same value for all the lines, meaning all the VALUE should be 1234 for different ENV.

balash1979 · ‎10-07-2019

I have the following line. I would like to parse the githash from it. [08/Oct/2019:05:08:31 +0000] 200 \"GET / HTTP/1.1\" 1203 \"-\" ,"source":"stdout", "tag": test/test-ui:b1cd4er8590rj39d39309e9e9/test-ui/03e020671f70 When I run my splunk query, I want to display "b1cd4er8590rj39d39309e9e9".

balash1979 · ‎10-03-2019

Thanks. I just removed by channel and it worked. I was just overthinking.

balash1979 · ‎10-03-2019

Here is my query index="search_index" search processing_service | eval time_in_mins=('metric_value')/60 | stats avg(time_in_mins) by channel By running this query, i get the following results channel1 5.25 channel2 6.25 channel3 10.25 Basically, i get output of all the channels and their averages. how can I get only 1 value with the average of all the channel averages ? I would like an output of my query as Avg_of_all_channels 7.25

balash1979 · ‎10-02-2019

You are correct. There is a typo in my original code.

Posts	46
Solutions	0
Karma Given	7
Karma Received	0
Member Since	‎08-03-2019

Online Status	Offline
Date Last Visited	‎03-28-2021 02:35 PM

Appending 2 searches but 1 search doesnt contain v...

Ignore a certain value to be shown in timechart

Join searches and make a calculation

Predicting future time series based on current tre...

Calculate percentage of total and display as pie c...

Timechart value every hour + cumulative line

Extracting field with quotes doesnt seem to work.

Split url and extract values

Improve dashboard performance

Extract timetaken from line

Appending 2 searches but 1 search doesnt contain v...

Ignore a certain value to be shown in timechart

Re: Join searches and make a calculation

Join searches and make a calculation

Predicting future time series based on current tre...

Re: Calculate percentage of total and display as p...

Calculate percentage of total and display as pie c...

Timechart value every hour + cumulative line

Re: Extracting field with quotes doesnt seem to wo...

Extracting field with quotes doesnt seem to work.

Split url and extract values

Re: Improve dashboard performance

Improve dashboard performance

Extract timetaken from line

Re: Dashboard not showing date correctly

Dashboard not showing date correctly

Re: How to search for a specific field

How to search for a specific field

Re: How to determine if duplicate logs are sent

How to determine if duplicate logs are sent

How to set color code result based on uniqueness

How can i parse the value in this line

Re: Find average when using group by

Find average when using group by

Re: Add spaces between rows in dashboard