Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About promukh
promukh
Path Finder
Member since:
02-19-2020
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 1 |
| Member Since | 02-19-2020 |
Activity Feed
- Posted Re: How to Schedule a Report for multiple Year-Month variables from a drop down list on Reporting. 10-15-2020 08:40 AM
- Karma Re: How to Schedule a Report for multiple Year-Month variables from a drop down list for gcusello. 10-15-2020 08:39 AM
- Posted How to Schedule a Report for multiple Year-Month variables from a drop down list on Reporting. 10-15-2020 07:54 AM
- Posted How to generate a Month-Year Series with 3 months interval ? on Splunk Search. 10-09-2020 01:04 PM
- Posted Re: How to select Year-Month from a search output 3 months ahead ? on Splunk Search. 10-08-2020 07:14 AM
- Karma Re: How to select Year-Month from a search output 3 months ahead ? for bowesmana. 10-08-2020 07:14 AM
- Got Karma for Re: How to select Year-Month from a search output 3 months ahead ?. 10-07-2020 03:43 PM
- Posted Re: How to select Year-Month from a search output 3 months ahead ? on Splunk Search. 10-07-2020 03:20 PM
- Karma Re: How to select Year-Month from a search output 3 months ahead ? for bowesmana. 10-07-2020 03:20 PM
- Posted How to select Year-Month from a search output 3 months ahead ? on Splunk Search. 10-07-2020 02:21 PM
- Posted Re: Splunk Date/Time comparison using _time generated through timechart for a Span of 1 Month on Splunk Search. 10-06-2020 06:35 PM
- Karma Re: Splunk Date/Time comparison using _time generated through timechart for a Span of 1 Month for thambisetty. 10-06-2020 06:35 PM
- Posted Splunk Date/Time comparison using _time generated through timechart for a Span of 1 Month on Splunk Search. 10-05-2020 07:16 PM
- Tagged Splunk Date/Time comparison using _time generated through timechart for a Span of 1 Month on Splunk Search. 10-05-2020 07:16 PM
- Posted Re: Use Regex to extract data from _raw and rename the extracted field on Splunk Search. 07-09-2020 09:07 PM
- Posted Re: Use Regex to extract data from _raw and rename the extracted field on Splunk Search. 07-09-2020 08:26 PM
- Karma Re: Use Regex to extract data from _raw and rename the extracted field for bowesmana. 07-09-2020 08:16 PM
- Posted Use Regex to extract data from _raw and rename the extracted field on Splunk Search. 07-09-2020 06:20 PM
- Posted How to Use Eval to add 2 Field Values on Splunk Search. 02-28-2020 09:49 PM
- Tagged How to Use Eval to add 2 Field Values on Splunk Search. 02-28-2020 09:49 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-15-2020
07:54 AM
Hello Experts, I do have a search with multiple appends on a Dashboard Panel , which is taking longer than usual to generate the results. There is dropdown in the panel with Month-Year values generated , which is feeded into the search as variable when end-user selects one. Drop Down Values are as shown below - ( 3 Months Interval ) Jan 2021 Apr 2021 Jul 2021 Oct 2021 Jan 2022 The search is feeded with one of the values from the above as shown below .. |search ..| fields MonthYear,field1,field2,field3 | where MonthYear="$month$" | table field1,field2,field3. Given the search is taking longer amount of time , we plan to schedule it through a report and run once a Day and store the results beforehand . Will it be possible to schedule the report run with all the above mentioned "MonthYear" values ? how can we achieve the same ? Any leads is appreciated , Thanks
... View more
Labels
10-09-2020
01:04 PM
Hello Experts, I need to generate a series of values in the form of Year-Month to part of the drop down list in the Panel I was trying the below but it only generates the data for 1 Month |makeresults | eval month = strftime(relative_time(now(), "+3mon@mon"), "%B %Y") | return $month Jan 2021 Expected Ouput : Jan 2021 April 2021 JULY 2021
... View more
Labels
- Labels:
-
eval
-
field extraction
10-08-2020
07:14 AM
thank you @bowesmana will add the suggested change.
... View more
10-07-2020
03:20 PM
1 Karma
Thank You , i was able to figure it out using below eval expression eval time_select=strftime(relative_time(now(), "+3mon"), "%b %Y") | where YearMonth=time_select
... View more
10-07-2020
02:21 PM
Hello Experts, I have the below output for a splunk search, i only want to display "Year-Month" rows 3 months ahead of current Year-Month.. YearMonth Upper95(Prediction) Sep 2020 5 Oct 2020 11 Nov 2020 15 Dec 2020 18 Jan 2020 21 Feb 2020 23 Mar 2020 26 I only want to display the row - Year-Month -- " Jan 2021 " from the above output ? If the current YearMonth is November-2020 , i want to display the row -- " Feb 2021 " Any Help appreciated Thanks
... View more
Labels
- Labels:
-
eval
-
field extraction
-
timechart
10-06-2020
06:35 PM
perfect thanks for the explanation ..appreciate it !!
... View more
10-05-2020
07:16 PM
Hello Experts, I am having a search as below |search | eval _time=new_t | timechart span=1mon sum(alloc) as used | streamstats sum(used) as "Total" | predict "Total" as "Projected" future_timespan=8 Output from the search is as below _time Used Total Projected lower95 2019-09 1 1 <some numbers> <some numbers> 2020-03 2 3 <some numbers> <some numbers> 2020-04 4 7 <some numbers> <some numbers> 2020-05 4 11 <some numbers> <some numbers> 2020-09 5 16 <some numbers> <some numbers> 2020-10 <some numbers> <some numbers> 2020-11 <some numbers> <some numbers> 2020-12 <some numbers> <some numbers> 2021-01 <some numbers> <some numbers> How can i compare the "_time" field with current "month-year" and display only those rows greater than the current Year-Month. | search _time>strftime(now(),"%Y-%m-%d") Any hep will be appreciated ..Thanks
... View more
- Tags:
- now()
Labels
- Labels:
-
eval
-
field extraction
-
timechart
07-09-2020
09:07 PM
for extract pairdelim="," kvdelim=":" , i am having trouble extracting the data from _raw for below specific formats , for the rest it works fine , any clue how we can we fix this ? "j_yul_flt.name":"3-4tux","b_ccl_flt.guv":"7-6bno","j_nyc_flt.name":"3-4iot","b_chp_flt.guv":"7-6ews"
... View more
07-09-2020
08:26 PM
Thank you @bowesmana , how can i extract multiple fields , is the below syntax correct for extracting multiple fields , its not giving me any o/p. | rex field=_raw "\"group_na\":\"(?<assigned_to>[^\"]*) \cutom_id\":\"(?<cust_id>[^\"]*)" | table assigned_to,cust_id
... View more
07-09-2020
06:20 PM
Hello Splunkers, Please advise how to use regex to extract the below specific fields from _raw data and also add/rename the field name.The Index is a summary Index Sample Raw Data: "cutom_id":"nuyc0989","group_na":"vc_iod","kit_num":"tach-98"
"cutom_id":"nuyc0989","group_na":"no_eng","kit_num":"vch-76"
"cutom_id":"nuyc0989","group_na":"vc_hk","kit_num":"tach-k89" I only want to extract {field:value} of "group_na" (rename field to assigned_to) & "kit_num" (rename field to Tax_ID) in the search results for all the _raw data of the summary index. Below search query is not extracting the required field from the raw data ,please advise Search Query - index=<summary_index> | rex field=_raw "\"group_na\": (?<assgined_to>*)"
... View more
02-28-2020
09:49 PM
Search --
|source1 | stats count(source1.field1) by (source1.field2) | sort 0 source1.field2
Search Output
source1.field2 | count
dev | 6
prod | 5
uat | 7
qa | 8
How can we add count values of 'prod' and 'uat' & also to display the field value as below , Is this doable ? *
source1.field2 | count
dev | 6
prod + uat | 12
qa | 8
... View more
02-28-2020
06:04 PM
search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098"
Y-098 || Count
1.Instagram -- 56
2.twitter -- 78
search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234"
Vr-234 || Count
1.Instagram_active_user -- 34
2.twitter_active_user --21
How can i combine the above 2 searches to be displayed under one output as shown below to be used in Overlay Chart , also is there any way to rename the "Count" Field
Field-Name-1 | Count | Field-Name-2 | Count
Instagram | 56 | Instagram_active_user | 34
twitter | 78 | twitter_active_user | 21
... View more
02-19-2020
04:34 PM
ok , I was able to resolve using a single quote around the field name along with a where clause.
|splunk command | where 'db_1'!='server_2'
Found the below input in the splunk documentation which helped ..
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/WhereCommandOverview
where 'host-name'="buttercup" If the expression references a field name that contains characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character, the field name must be surrounded by single quotation marks.
Thank You
... View more
02-19-2020
03:48 PM
yes want to exclude those 2 values in the final output
... View more
02-19-2020
02:53 PM
yes ..correct .. i want to exclude the matching records from both fields
... View more
02-19-2020
02:39 PM
field names are -- source1.db_1 & source1.server_2
... View more
02-19-2020
01:43 PM
Below is my search output for the SPL i am running.
`
db_1
oracle_test
db2_bio
oracle_890
n88888
n7777
server_2
n87896
bg8768
j987653
n88888
n7777
How do i exclude the field records which are identical between 2 fields like in this case -- (n88888 & n7777)
I tried using there where clause /Search , but without any success ..
SPL used to display fields records which are not identical ---
|splunk command | where db_1 != server_2 ( Not wokring )
|splunk Command | fields db_1,server_2 | search db_1 !=server_2 ( Not working )
Any clue/help will be appreciated ?
... View more
