Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kirrusk
kirrusk
Communicator
Member since:
03-13-2020
07-18-2022
Community Statistics
| Posts | 73 |
| Solutions | 2 |
| Karma Given | 22 |
| Karma Received | 1 |
| Member Since | 03-13-2020 |
Activity Feed
- Posted Re: How to make X axis show dates not just date field on Splunk Search. 02-18-2022 01:23 AM
- Karma Re: Date is not coming in x axis for ITWhisperer. 02-18-2022 01:21 AM
- Posted Re: Date is not coming in x axis on Splunk Search. 02-16-2022 06:56 AM
- Posted Re: Date is not coming in x axis on Splunk Search. 02-16-2022 06:39 AM
- Posted How to make X axis show dates not just date field on Splunk Search. 02-16-2022 06:08 AM
- Tagged How to make X axis show dates not just date field on Splunk Search. 02-16-2022 06:08 AM
- Karma Re: when no events or any field contains contains zero for past hour through an alert using tstats for gcusello. 02-16-2022 05:47 AM
- Posted when no events or any field contains contains zero for past hour through an alert using tstats on Splunk Search. 02-08-2022 01:57 AM
- Karma Re: when no events or any field contains contains zero for past hour through an alert for gcusello. 02-08-2022 01:55 AM
- Posted Re: when no events or any field contains contains zero for past hour through an alert on Splunk Search. 02-08-2022 01:43 AM
- Karma Re: exclude time range in splunk query for gcusello. 02-07-2022 11:58 PM
- Posted when no events or any field contains contains zero for past hour through an alert on Splunk Search. 02-07-2022 11:52 PM
- Posted Re: exclude time range in splunk query on Splunk Search. 02-01-2022 07:13 AM
- Posted exclude time range in splunk query on Splunk Search. 02-01-2022 05:59 AM
- Karma Re: splunk query to get data last two or three months in week range for gcusello. 02-01-2022 05:42 AM
- Posted Re: splunk query to get data last two or three months in week range on Splunk Search. 01-26-2022 06:31 AM
- Posted Re: splunk query to get data last two or three months in week range on Splunk Search. 01-26-2022 04:30 AM
- Posted Re: splunk search query to get data last two months every friday with in time range on Splunk Search. 01-26-2022 02:23 AM
- Posted Re: splunk query to get data last two or three months in week range on Splunk Search. 01-26-2022 02:12 AM
- Posted splunk query to get data last two or three months in week range on Splunk Search. 01-26-2022 01:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-18-2022
01:23 AM
working if browser window minimized or may be by using rotating, but my requirement change to display weekly data. So the date is populating properly.
... View more
- Tags:
- wser
02-16-2022
06:56 AM
@ITWhisperer just found, using %d/%m/%y the format I can see the date in the x-axis, but only when a short time range selecting.
... View more
02-16-2022
06:39 AM
@ITWhisperer I appended some data to existing data in the index, which is coming from CSV, in that date format will be like 01/12/22 so I convert _time to %d/%m/%y
... View more
02-16-2022
06:08 AM
Hi
I'm trying to add a chart by using the below query, in chart lines Date is coming. But in x-axis shows only the Date field instead of Dates.
index=_internal FIELD1=* FIELD2=* | eval Date=(_time, "%d/%m/%y")
| sort Date
| eval Date=(_time, "%d/%m/%y")
| table Date FIELD1 FIELD2
... View more
- Tags:
- search
02-08-2022
01:57 AM
Hi, using the below query to trigger an alert. | tstats count WHERE index=your_index AND(TMPFIELD="FIELD1" OR TMPFIELD="FIELD2" OR TMPFIELD="FIELD3") GROUPBY index TMPFIELD _time latest=-1h@h earliest=@h
| timechart count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0 But problem is, it's giving zero in the table if data is present in the field also EXAMPLE, FIELD1 FIELD2 FIELD3 0 0 0 But in reality, field3 has values FIELD1 FIELD2 FIELD3 0 0 59 so it should through alert as well, because FIELD1 & FIELD2 are Zero. @gcusello
... View more
- Tags:
- alert
02-08-2022
01:43 AM
@gcusello Thank you, it's working it's my bad not tell about query what I'm using. I'm trying to use tstats So modified query like below | tstats count WHERE index=your_index AND(TMPFIELD="FIELD1" OR TMPFIELD="FIELD2" OR TMPFIELD="FIELD3") GROUPBY index TMPFIELD _time latest=-1h@h earliest=@h
| timechart count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0 But problem is, it's giving zero in the table if data is present in the field also EXAMPLE, FIELD1 FIELD2 FIELD3 0 0 0 But in reality, field3 has values FIELD1 FIELD2 FIELD3 0 0 59 so it should through alert as well, because FIELD1 & FIELD2 are Zero.
... View more
02-07-2022
11:52 PM
Hi, I'm trying to trigger an alert for the below scenarios (one alert). scenario one: when there are no events, trigger alert. Scenario two: When any of the fields contains (Zero) for the past hour. DATE FIELD1 FIELD2 FIELD3 2-8-2022 45 56 67 2-8-2022 54 67 87 2-8-2022 0 56 0 2-8-2022 543 56 676 Trigger an alert if (no events) are coming for any particular field or a field contains (Zero) in the past hour. For example : the above table needs to trigger an alert by giving a table as result.
... View more
- Tags:
- alert
02-01-2022
07:13 AM
@gcusello date_wday not working properly, it's giving results with two days events (timestamps). So I'm using eval to take from _time
... View more
02-01-2022
05:59 AM
Hi, I'm trying to exclude events from the time range. index = _internal
| eval Hour=strftime(_time,"%H")
| eval Minute=strftime(_time,"%M")
| eval DayofWeek=strftime(_time,"%w")
| eval Month=strftime(_time,"%m")
| eval WeekOfYear=strftime(_time,"%U")
| search NOT DayofWeek=3 AND Hour>10 Hour<13 from the above query trying to exclude Wednesday and in between 10 to 13, but it excludes all the day. Can anyone have suggestions? Have one more scenario, need to exclude Monday and Wednesday particular hours.
... View more
01-26-2022
06:31 AM
@gcusello it is not working as expected, I think as we kept span=7d in (days) for example if i run today, by putting span=7d Date should be like DATE 26/01/22 19/01/22 12/01/22 which we Wednesday of every week
... View more
01-26-2022
04:30 AM
@gcusello Thank you, trying to run the below query giving earliest=-90d@d latest=now as I want data for the last three months but it is giving a date in DATE field is Thursday(should be Friday), DATE 06-01-22 13-01-22 20-01-22
... View more
- Tags:
- @gcu
01-26-2022
02:23 AM
Can you please help to have some sample search, how to use these "earliest " and "latest" in search @ITWhisperer
... View more
01-26-2022
02:12 AM
@gcusello Thank you, Data I'm using from the summary index, I don't want to increase the memory of the summary index.
... View more
01-26-2022
01:52 AM
Hi, I'm trying to figure out how to get data for the past few weeks and data will be filtered. week start should be from every (previous week)Saturday to Friday. I will send a report every Friday. the report should be like this DATE COUNT NAME 21-01-22 58 one 14-01-22 58 one 07-01-22 45 two Thus on next Friday one more value-added to report. DATE COUNT NAME 28-01-22 61 one 21-01-22 58 one 14-01-22 58 one 07-01-22 45 two @ITWhisperer @gcusello
... View more
- Tags:
- splunk search
01-25-2022
06:10 AM
Hi, Splunk search query to get data last two months data. need only every Friday data in the time range for 15 mins (i.e 08 AM to 08:15 AM every friday) . example: Date fieldA 21/01/2022 value1 14/01/2022 value2 07/01/2022 value3 Can anyone pls suggest how can I achieve this?
... View more
- Tags:
- splunksearch
10-23-2021
06:27 AM
Hi, I'm trying to pass the aggregate function from the dropdown menu in the Splunk dashboard to the time-series chart. for example from dropdown, I want to pass actual, Avg(), max() to below search index = _internal sourcetype = * | search field=* Exhost=* | chart max(value) by _time,Exhost
... View more
09-29-2021
12:30 AM
@gcusello @gcusello Thank you, but my intention is to trigger an alert with the remaining data in Field2. if there is no string("Successful") at all in Field2. sample alert, no log found for successful, Please find logs Field1 Field2 9/2/10 creating the file 9/2/10 created
... View more
09-28-2021
11:40 PM
Hi, I want to check for a string in the field, but if the string is not found in the field then need to print the remaining data. (last 15 mins data) for example, Field1 Field2 9/2/10 successful 9/2/10 creating the file 9/2/10 created from the above table, I want to check the Field2 for the last 15mins for string "successful", if no string is found in Field2 with "successful", Then need to trigger an alert with the remaining data like below. Field1 Field2 9/2/10 creating the file 9/2/10 created is this possbile in splunk.
... View more
- Tags:
- alert
09-07-2021
01:08 AM
Hi , I'm trying to add a table right side of the dashboard. But not able to achieve. Can anyone suggest? not using Html dashboard, using XML dashboard. Exisiting new New one - expecting new
... View more
Labels
- Labels:
-
CSS
-
panel
-
simple XML
-
single value
-
table
-
trellis layout
09-01-2021
08:25 PM
@efavreau Thank you, but it is not exactly what I'm looking for. I'm using the hyper link. So if there is no data also hyperlink is still enabled on custom message, which should not.
... View more
09-01-2021
09:36 AM
Hi, I tried the below logic, to replace the "no results found "message with a custom message. But after adding append count the, at end of the query. logic is not working as expected. Can anyone please help? base search | fields version, time | appendpipe [stats count | where count=0] <done>
<condition match=" 'job.resultCount' == 0">
<set token="show_html">true</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
<done> <chart rejects="$show_html$">
...
</chart>
<html depends="$show_token$">
<div style="font-weight:bold;font-size:150%;text-align:center;color:red">
No data, Please check later
</div>
</html>
... View more
Labels
08-17-2021
05:44 AM
@ITWhisperer I have data like sum(res) in the table, It will give only a single result. sum(res)
256 Want to display this value in time series, each point of time has to show sum(res) only. Is that possible?
... View more
08-17-2021
05:04 AM
@ITWhisperer is giving time chart series in exponential form, But I need cumulative data on the time chart.
... View more
08-17-2021
02:12 AM
I'm trying to display the cumulative sum in the timechart. two sourcetypes index= _internal | [search sourcetype=source1 clu=* value=* | rename value as source1value]
| appendcols [search sourcetype=source2 clu=* value=* | rename value as source2value]
| table source1value source2value
| eval res=source2value-source1value
| stats sum(res) up to here giving the sum of res, I need to display this cumulative sum in the time chart. Can anyone suggest how I can achieve this?
... View more
Labels
- Labels:
-
using Splunk Enterprise
08-03-2021
12:08 AM
@ITWhisperer I'm trying to compare pronames2 fields values against pronames1 & pronames3 against pronames1
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-18-2022
09:18 AM
|
Karma given to
