About sumitnagal

sumitnagal · ‎06-29-2020

I am using tstats command from a while, right now we want to make tstats command to limit record as we are using in kubernetes and there are way too many events. I have looked around and don't see limit option. though as a work around I use `| head 100` to limit but that won't stop processing the main search query.

sumitnagal · ‎01-24-2017

@simpkins1958 would you mind sharing your httpevent stream code. we are trying to push the code via stream, and we are not able to setup the sourcetype and source. It is taking default values as http-stream-too_small or http-stream?

sumitnagal · ‎07-30-2015

I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers Counts=[100A=10,100B=1,100C=2,100D=1,100E=3,100A=20,100B=1,100C=2,100D=1,100E=3] I want to calculate 100A=30 100B=2 100C=4 100D=2 100E=6 I have ask similar question where I have different requirements http://answers.splunk.com/answers/185780/multi-pattern-string-calculation-on-fields.html

sumitnagal · ‎04-06-2015

this is way how I have handle it | tstats sum(DAC.time_ms) as agent_time_ms FROM datamodel=DataModel_DAC groupby _time|timechart span=10m avg(agent_time_ms) as agent_time_ms let me know if you have questions, though this command will work only when data model is accelerated.

sumitnagal · ‎01-27-2015

hhmmm so this solution doesn't work at all, as we are doing this at index time 😞 any other approach, or should i raise to to splunk support team. -Sumit

sumitnagal · ‎01-16-2015

This works with some workaround on data model , here is new query | tstats sum(ABC.time) as time FROM datamodel=DataModel_ABC groupby ABC.id,_time|| timechart avg(time) as time by id however, I was using post processing in my dashboard. so now I have to write one direct query in dashboard. second avg time value I am not able to round up, as after this search round function is not working, may be I am missing something eval time=round(time,2) third, I am plotting TPS, but using this model and printing below query doesn't give right information on data model. | eval count=1 | timechart per_second(count)

sumitnagal · ‎01-16-2015

Please check my last comment, it is just picking first value, not all.

sumitnagal · ‎12-17-2014

I found intersting observation not sure, if that is way how splunk works [apifields_min] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_min::$5 MV_ADD = 1 Not able to parse MV_ADD option, and showing only first occurrence only. [apifields_min1] WRITE_META = true REGEX = (\w+):(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_min::$5 MV_ADD = 1 Not able to parse MV_ADD option, and showing only first occurrence only. Not sure for key=value pair I have to add some special multi param in transform file, so that same pattern can be allowed. -Sumit

sumitnagal · ‎12-16-2014

My Bad, I thought indexer has been restarted. but it was not, I have restarted and things are started working as we thought. on slide node, underscore or ., both are working. Sorry about confusion and thanks a lot. -Sumit

sumitnagal · ‎12-16-2014

Lisa, I have same issue, from pivot I am not able to plot the timechart graph, though by _time I am able to get require graph. Not Working | pivot DataModel_AccessService perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD AUTO SPLITROW host AS hostname| timechart sum(execTime) Working | pivot DataModel_AccessService perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD AUTO SPLITROW host AS hostname| chart sum(execTime) by _time Thanks, Sumit

sumitnagal · ‎12-16-2014

Yes, I did. I am giving configuration too, which I have set. Transform.conf [apifields_total] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1.total::$2 [apifields_avg] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_avg::$3 [apifields_count] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1.count::$4 [apifields_min] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_min::$5 [apifields_max] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_max::$6 props.conf [fdpacq] pulldown_type = 1 TRANSFORMS-apifields = apifields_total,apifields_avg,apifields_count,apifields_min,apifields_max

sumitnagal · ‎12-11-2014

We have made change on indexer, and still not able to see any result. sorry to coming late on this, but I don't have access to make this change and has to work with splunk admin team.

sumitnagal · ‎12-09-2014

We have few data model, but we are not able to pass the span / PERIOD other then default values. this is creating problem as we are not able to put different bucket options (1m, 10 m, 1 h ...) and our chart data is exceeding more then 1000 points. here is simple data model query | pivot DataModel_ABC perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD auto SPLITROW host AS hostname Please let me know

sumitnagal · ‎12-09-2014

I have simple datamodel, which I am using as query and want to plot time chart series. Now I am not able to plot anything using timechart, but can plot from chart <> by _time. I don't know what I am missing, due to this I am not able to that in dashboard. | pivot DataModel_AccessService perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD AUTO SPLITROW host AS hostname This query is working | pivot DataModel_AccessService perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD AUTO SPLITROW host AS hostname| chart sum(execTime) by _time This query is not working | pivot DataModel_AccessService perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD AUTO SPLITROW host AS hostname| timechart sum(execTime) Please help me out.

sumitnagal · ‎11-08-2014

transform [apifields_totaltime] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1.totaltime::$2 SOURCE_KEY = _raw MV_ADD = 1 [apifields_avgtime] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_avgtime::$3 SOURCE_KEY = getDataStack MV_ADD = 1 [apifields_totalno] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_totalno::$4 SOURCE_KEY = getDataStack MV_ADD = 1 [apifields_mintime] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_mintime::$5 SOURCE_KEY = getDataStack MV_ADD = 1 [apifields_maxtime] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_maxtime::$6 SOURCE_KEY = getDataStack MV_ADD = 1 props [fdpacq] REPORT-REPORT-getDataAcq = extractserverStack,apifields_totaltime,apifields_avgtime,apifields_totalno,apifields_mintime,apifields_maxtime

sumitnagal · ‎11-08-2014

No success .. I have same configuration, I have multiple of this values in and event I feel somehow, adding to extracted value with string causing issue ..

sumitnagal · ‎11-08-2014

I have done above formatting but it is not working as we are expecting. though it is putting value on total,avg,min and max but not with $1. Not sure formatting is concat $1 and string value ?? BTW, my other pattern are working fine where I am assigning the value as $1::$2

sumitnagal · ‎11-08-2014

This time is it not about key and value, We are doing this, but for any API getting this value using key-pair will take long log message. hence we made little effective and producing this in above manner. I am doing below parsing getOAuthToken=(?(getOauth_totalExecTime>\d+):(?(getOauth_avgExecTime>\d+):(?(getOauth_noOfExecutions>\d+):(?(getOauth_minTime>\d+):(?(getOauth_maxTime>\d+) I want a way to effectively use the api name and associate with new key values like. getCall_TotalTime getCall_AvgTime getCall_AvgTime getCall_Occurance getCall_MInTime getCall_MaxTime

sumitnagal · ‎11-08-2014

I have log which is printing value of an API in this manner getCall=144:144:1:144:144 where I am parsing the value like this and getting desire values for this call getCall=(?\d+):(?\d+):(?\d+):(?\d+):(?\d+) I want to know if there is effective way to calculate this values, as I have ton's of api, adding this logic and building is not a great solution. please share your thought to optimize this query so that it will be applicable to all calls

sumitnagal · ‎11-08-2014

I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers Counts=[100A=0,100B=1,100C=2,100D=1,100E=3] I want to first calculate how many form I have collected in this example FormCount=5 I want to calculate Total Form calculated FormTotal=7 Please let me know

sumitnagal · ‎05-05-2014

I got this, but now when I am editing using sideview editor it is not creating above mentioned param null value, it create below. which make difficult to find, as same example is working in help modules. Select...

sumitnagal · ‎05-04-2014

I am try to implement this basic example using , I have lookup host_env_mapping which execute below search from there I am doing pulldown for environment and setting static options as follow. I am not able to proceed as I am getting "Pulldown.html - View CONFIGRATION ERROR - you have specified a element with no element" on second pulldown. I am not sure if my lookup have some issue. though my below lookup command is working fine. I am giving sample host_env_mapping file for reference in end, <![CDATA[ | inputlookup host_env_mapping | dedup environment,zone,datacenter | table host hostname datacenter environment information nodetype project zone ]]> <module name="Pulldown"> <param name="postProcess">dedup $name$ | sort $name$</param> <param name="template">environment="$value$"</param> <param name="name">environment</param> <param name="label">environment</param> <param name="valueField">$name$</param> <param name="staticOptions"> <list> <param name="label">Select...</param> <param name="value">ZOMG</param> </list> </param> <module name="Search"> <param name="search"><![CDATA[ | inputlookup host_env_mapping | search $environment$ ]]> <module name="Pulldown"> <param name="postProcess">dedup $name$ | sort $name$</param> <param name="template">hostname="$value$"</param> <param name="name">hostname</param> <param name="label">hostname</param> <param name="valueField">$name$</param> <param name="staticOptions"> <list> <param name="label">Select...</param> </list> </param> <module name="Gate"> <param name="requiredKeys">environment,hostname</param> <module name="Search"> <param name="search"><![CDATA[ | inputlookup host_env_mapping| search $environment$ $hostname$ |table environment,zone,datacenter ]]> <module name="HiddenChartFormatter"> <param name="charting.chart">line</param> <module name="JSChart" /> </module> </module> </module> </module> </module> </module>  host_env_mapping.csv datacenter,environment,host,hostname,information,nodetype,other1,other2,project,zone ABC,XYZ,test123.test.com,test123,Execution,web-01,test,test1,Agg,Zone-A

sumitnagal · ‎05-03-2014

is there any other option to solve this without specifying regex? can we have some negate option handy, like abc11 and abc21 to be ignored, and rest all host comes. in case we have multiple arguments say sourcetype with same regex pattern how it would look like? mymacro(host=,source=)

sumitnagal · ‎05-03-2014

found the problem, it looks for double quote, adding that fix the problem search xyz | regex host="$host$"

sumitnagal · ‎05-03-2014

I have use case where i have to pass host in macro argument. I also want to pass argument in regex way apart from * way. here is snippet mymacro(host=*) My host listing is in big number, more than 35 hosts example:- abc1, abc2 , abc11, abc21, abc22, abc24, abc25 Now I want to pass only 2 hosts only say abc11 and abc21 as argument, how can I do that. as abc I know I can pass below mymacro(host=abc1*) or mymacro(host=abc2*) but how to pass both in same parameter?

Posts	39
Solutions	0
Karma Given	2
Karma Received	6
Member Since	‎05-04-2011

Online Status	Offline
Date Last Visited	‎06-29-2020 05:30 PM

How can we limit the tstats record?

multi pattern string calculation on fields and cou...

how to pass time span in datamodel

datamodel not able to plot timechart

effective way to parse similar pattern

multi pattern string calculation on fields

sideview util using simple gate blocking search

macro with regex

data model support

sideview utils work with Datamodels

How can we limit the tstats record?

Re: What is best way to use sourcetype with HTTP E...

multi pattern string calculation on fields and cou...

Re: datamodel not able to plot timechart

Re: effective way to parse similar pattern

Re: how to pass time span in datamodel

Re: effective way to parse similar pattern

Re: effective way to parse similar pattern

Re: effective way to parse similar pattern

Re: How to create a timechart using a root search ...

Re: effective way to parse similar pattern

Re: effective way to parse similar pattern

how to pass time span in datamodel

datamodel not able to plot timechart

Re: effective way to parse similar pattern

Re: effective way to parse similar pattern

Re: effective way to parse similar pattern

Re: effective way to parse similar pattern

effective way to parse similar pattern

multi pattern string calculation on fields

Re: sideview util using simple gate blocking searc...

sideview util using simple gate blocking search

Re: macro with regex

Re: macro with regex

macro with regex