Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gurkiratsingh
gurkiratsingh
Explorer
Member since:
03-16-2020
07-07-2021
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 03-16-2020 |
Activity Feed
- Karma Re: Change search query according to time in dashboard? for wmyersas. 06-05-2020 12:51 AM
- Got Karma for Re: Change search query according to time in dashboard?. 06-05-2020 12:51 AM
- Posted Re: Timechart in Local Timezone on Splunk Search. 05-13-2020 03:16 AM
- Posted Timechart in Local Timezone on Splunk Search. 05-12-2020 11:57 PM
- Tagged Timechart in Local Timezone on Splunk Search. 05-12-2020 11:57 PM
- Tagged Timechart in Local Timezone on Splunk Search. 05-12-2020 11:57 PM
- Tagged Timechart in Local Timezone on Splunk Search. 05-12-2020 11:57 PM
- Tagged Timechart in Local Timezone on Splunk Search. 05-12-2020 11:57 PM
- Tagged Timechart in Local Timezone on Splunk Search. 05-12-2020 11:57 PM
- Posted Re: Loop through event message on Splunk Search. 04-13-2020 05:44 AM
- Posted Loop through event message on Splunk Search. 04-13-2020 02:54 AM
- Tagged Loop through event message on Splunk Search. 04-13-2020 02:54 AM
- Tagged Loop through event message on Splunk Search. 04-13-2020 02:54 AM
- Tagged Loop through event message on Splunk Search. 04-13-2020 02:54 AM
- Tagged Loop through event message on Splunk Search. 04-13-2020 02:54 AM
- Posted Re: Change search query according to time in dashboard? on Dashboards & Visualizations. 04-02-2020 03:49 AM
- Posted Splunk search basic queries on Splunk Search. 04-02-2020 03:45 AM
- Tagged Splunk search basic queries on Splunk Search. 04-02-2020 03:45 AM
- Tagged Splunk search basic queries on Splunk Search. 04-02-2020 03:45 AM
- Tagged Splunk search basic queries on Splunk Search. 04-02-2020 03:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-13-2020
03:16 AM
No the timezone is set to default. I have many live dashboards on my account in which I am already using the conversion of timestamps from UTC to IST. So I do not want to make any sudden change which shall cause any malfunction in the dashboards as many people are using them. If I do the change will there be any such affect do you have any idea?
... View more
05-12-2020
11:57 PM
Hi I am trying to make a time chart visualisation but I want it to be in IST(Indian Standard Time).
| eval received = strptime('timestamp', "%Y-%m-%dT%H:%M:%S.%3N")
| eval received_IST = received + 19800
| eval IST = strftime(received_IST,"%Y-%m-%d %H:%M")
| timechart count by Status
Status is a column which is consisting of true and false in string data type. In IST variable I have the timestamp in IST but how to implement it in the timechart? It is automatically picking up the (_time) by default
... View more
04-13-2020
05:44 AM
Hi this is extracting all the 50+ dates correctly but can you also tell me where to put the compare sort of thing to get true or false for all. I have to compare with (IST_time_latest)
example: | eval flag_cat=if( (IST_time_latest=='message.abc.cat') ,"TRUE","FALSE")
... View more
04-13-2020
02:54 AM
Hi I want to compare a date time value with many entities in my message. I have an eval(IST_time_latest) with the value 2020-04-13 00:00:00 and I want to check whether this eval is equal to all the datetimes in (message.abc.cat, message.abc.dog, message.abc.man, message.abc. hello)
The event message is like this:-
{
message: { [-]
abc: { [-]
cat: 2020-04-13 00:00:00
dog: 2020-04-13 00:00:00
man: 2020-04-13 00:00:00
hello: 2020-04-13 00:00:00
} } }
| eval flag_cat=if( (IST_time_latest=='message.abc.cat') ,"TRUE","FALSE")
| eval flag_dog=if( (IST_time_latest=='message.abc.dog') ,"TRUE","FALSE")
|table flag_cat, flag_dog
So there are 50+ entities like this in the messages and I do not want to create a flag like this for all of them. Can you please suggest an alternative??
... View more
04-02-2020
03:49 AM
1 Karma
Thanks guys now my query is resolved:-))
Could you also help me a little more:
(https://answers.splunk.com/answers/814817/splunk-search-basic-queries.html)
... View more
04-02-2020
03:45 AM
Hi so suppose in my results there are 2 logs that are being retrieved. There is a status message which is either true or false. I want the color to be set to green when both of them are true. What I want to ask is that when both the statuses are true then only does splunk set the color to be green? What if one is true and one is false? If I want to give this type of a condition a seperate color is that possible?
index=*** ----------
|eventstats count as message_count |eval number=message_count
|eval color=case( (number)>2,"#ff9933",(status=="true" AND number==2),"#008000",(status=="false" AND number==2),"#FF0000")
|table color
... View more
04-01-2020
01:15 AM
Hi this has worked correctly but now I need to do another thing. Suppose abc is a message string which contains certain numbers acc to the current time. For example:
Filename : (*****0000**)
|eval filter=case(
( (IST_time_hour=23 AND IST_time_min >= 00) OR (IST_time_hour=00 AND IST_time_min <30) ),0000
,( (IST_time_hour=00 AND IST_time_min >= 30) OR (IST_time_hour=01 AND IST_time_min <59) ),0130
,( (IST_time_hour=02 AND IST_time_min >= 00) OR (IST_time_hour=03 AND IST_time_min <30) ),0300
,( (IST_time_hour=03 AND IST_time_min >= 30) OR (IST_time_hour=04 AND IST_time_min <59) ),0430
,( (IST_time_hour=05 AND IST_time_min >= 00) OR (IST_time_hour=06 AND IST_time_min <30) ),0600
,( (IST_time_hour=06 AND IST_time_min >= 30) OR (IST_time_hour=07 AND IST_time_min <59) ),0730
,( (IST_time_hour=08 AND IST_time_min >= 00) OR (IST_time_hour=09 AND IST_time_min <30) ),0900
,( (IST_time_hour=09 AND IST_time_min >= 30) OR (IST_time_hour=10 AND IST_time_min <59) ),1030
,( (IST_time_hour=11 AND IST_time_min >= 00) OR (IST_time_hour=12 AND IST_time_min <30) ),1200
,( (IST_time_hour=12 AND IST_time_min >= 30) OR (IST_time_hour=13 AND IST_time_min <59) ),1330
,( (IST_time_hour=14 AND IST_time_min >= 00) OR (IST_time_hour=15 AND IST_time_min <30) ),1500
,( (IST_time_hour=15 AND IST_time_min >= 30) OR (IST_time_hour=16 AND IST_time_min <59) ),1630
,( (IST_time_hour=17 AND IST_time_min >= 00) OR (IST_time_hour=18 AND IST_time_min <30) ),1800
,( (IST_time_hour=18 AND IST_time_min >= 30) OR (IST_time_hour=19 AND IST_time_min <59) ),1930
,( (IST_time_hour=20 AND IST_time_min >= 00) OR (IST_time_hour=21 AND IST_time_min <30) ),2100
,( (IST_time_hour=21 AND IST_time_min >= 30) OR (IST_time_hour=22 AND IST_time_min <59) ),2230
)
|where LIKE('Filename','filter')
Now I need this where to search whether the filter value lies in the Filename. Again really thanks for your help!!!
What I have tried and it didnt work
|where LIKE('message.FileName','*filter')
|where LIKE('message.FileName','%filter%')
... View more
03-31-2020
11:44 PM
Hi this works perfectly now. Thanks a lot :-)) Btw can you also help me on another thing:
(https://answers.splunk.com/answers/810952/how-to-set-time-to-search.html)
... View more
03-31-2020
12:13 AM
Hi I tried using where but still I am not getting any results.The value from the CASE is getting extracted correctly and when I use ( |search abc=7) then the results are coming but not when I use ( |search abc='filter) or (|search abc=filter) or (|where abc='filter') or (|where abc=filter).
... View more
03-30-2020
10:32 PM
Hi even on doing the above mentioned still I am not getting any result. The case function is working perfectly fine. For example when I am doing (|search abc=7) I am getting the results but when I use it through the case function (|search abc='filter') then I am not getting any results. The value of filter is getting extracted correctly.
... View more
03-30-2020
10:31 PM
Hi even on doing the above mentioned still I am not getting any result. The case function is working perfectly fine. For example when I am doing (|search abc=7) I am getting the results but when I use it through the case function (|search abc='filter') then I am not getting any results. The value of filter is getting extracted correctly.
... View more
03-30-2020
04:59 AM
Hi can I perform a search on a value that is returned from a CASE function in the same search.
eval filter=case(
( (IST_time_hour=23 AND IST_time_min>=00) OR (IST_time_hour=00 AND IST_time_min<30) ),"1"
,( (IST_time_hour=00 AND IST_time_min>=30) OR (IST_time_hour=01 AND IST_time_min<59) ),"2"
,( (IST_time_hour=02 AND IST_time_min>=00) OR (IST_time_hour=03 AND IST_time_min<30) ),"3"
,( (IST_time_hour=03 AND IST_time_min>=30) OR (IST_time_hour=04 AND IST_time_min<59) ),"4"
,( (IST_time_hour=05 AND IST_time_min>=00) OR (IST_time_hour=06 AND IST_time_min<30) ),"5"
,( (IST_time_hour=06 AND IST_time_min>=30) OR (IST_time_hour=07 AND IST_time_min<59) ),"6"
,( (IST_time_hour=08 AND IST_time_min>=00) OR (IST_time_hour=09 AND IST_time_min<30) ),"7"
,( (IST_time_hour=09 AND IST_time_min>=30) OR (IST_time_hour=10 AND IST_time_min<59) ),"8"
,( (IST_time_hour=11 AND IST_time_min>=00) OR (IST_time_hour=12 AND IST_time_min<30) ),"9"
,( (IST_time_hour=12 AND IST_time_min>=30) OR (IST_time_hour=13 AND IST_time_min<59) ),"10"
,( (IST_time_hour=14 AND IST_time_min>=00) OR (IST_time_hour=15 AND IST_time_min<30) ),"11"
,( (IST_time_hour=15 AND IST_time_min>=30) OR (IST_time_hour=16 AND IST_time_min<59) ),"12"
,( (IST_time_hour=17 AND IST_time_min>=00) OR (IST_time_hour=18 AND IST_time_min<30) ),"13"
,( (IST_time_hour=18 AND IST_time_min>=30) OR (IST_time_hour=19 AND IST_time_min<59) ),"14"
,( (IST_time_hour=20 AND IST_time_min>=00) OR (IST_time_hour=21 AND IST_time_min<30) ),"15"
,( (IST_time_hour=21 AND IST_time_min>=30) OR (IST_time_hour=22 AND IST_time_min<59) ),"15"
)
|search abc=filter
Please help guys as to how to proceed in a situation like this. If this is not possible whether is it possible to store the filter value in a token which can be used in another search simultaneously.
... View more
03-30-2020
04:50 AM
Hi I made the case expression as you told but when I am using it in a search it is showing no result found. Can the Returned Value From a Case Function be used in a Search? The case function that I made is working fine.
... View more
03-25-2020
10:13 PM
Hi I want it to change automatically with no use of dropdown & no user selectable option.
... View more
03-25-2020
04:27 AM
Hi I tried what you mentioned. The latest variable is correctly extracting the next days time but when the search is happening it is taking (latest=now) instead of taking the value of latest.
earliest="03/23/2020:00:00:0" |eval earliest="03/23/2020:00:00:0"
| eval earliest_epoch = strptime(earliest,"%m/%d/%Y:%k:%M:%S"),latest_epoch=relative_time(earliest_epoch, "+d"), latest=strftime(latest_epoch,"%m/%d/%Y:%k:%M:%S")
|table earliest, latest
6 events (23/03/2020 00:00:00.000 to 25/03/2020 12:21:23.080)
latest earliest
03/24/2020: 0:00:00 03/23/2020:00:00:0
03/24/2020: 0:00:00 03/23/2020:00:00:0
03/24/2020: 0:00:00 03/23/2020:00:00:0
03/24/2020: 0:00:00 03/23/2020:00:00:0
03/24/2020: 0:00:00 03/23/2020:00:00:0
03/24/2020: 0:00:00 03/23/2020:00:00:0
... View more
03-25-2020
03:57 AM
I want to change my search query according to the time of the day
<query>index=--- application=------ |search abc=1
</query>
So in my dashboard I want the query to change acc to the time of the day. Like for example
from 12:00am to 1:30am
|search abc=1
from 1:30am to3:00am
|search abc=2
& so on
Please help guys!!!
... View more
03-16-2020
12:52 AM
Hi am getting the earliest tie through a text box and I want to set the latest time automatically to (earliest+24h). Please help me how to do that. I do not want to use the time picker input.
<fieldset submitButton="false">
<input type="text" token="time" searchWhenChanged="true">
<label>Enter Date</label>
</input>
</fieldset>
<search>
<query>
index=abcd application="abcd" earliest="$time$" |---------
</query>
<refresh>5m</refresh>
</search>
For example the user will enter the date as 03/15/2020:18:30:00 in the text field and I want the latest to be updated to this time+24h( 03/16/2020:18:30:00)
... View more
- Tags:
- splunk-enterprise
