Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About naveenalagu
naveenalagu
Explorer
Member since:
07-22-2018
03-23-2024
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 07-22-2018 |
Activity Feed
- Karma Re: Alerting for entries not found in given time period for bowesmana. 03-23-2024 06:42 AM
- Karma Re: Alerting for entries not found in given time period for bowesmana. 03-23-2024 06:42 AM
- Karma Re: Alerting for entries not found in given time period for ITWhisperer. 03-23-2024 06:41 AM
- Posted Re: Alerting for entries not found in given time period on Alerting. 03-23-2024 06:40 AM
- Posted Re: Alerting for entries not found in given time period on Alerting. 03-20-2024 09:09 AM
- Posted Re: Alerting for entries not found in given time period on Alerting. 03-20-2024 07:21 AM
- Posted Re: Alerting for entries not found in given time period on Alerting. 03-19-2024 05:50 PM
- Posted Re: Alerting for entries not found in given time period on Alerting. 03-19-2024 05:46 PM
- Posted Re: Alerting for entries not found in given time period on Alerting. 03-19-2024 01:03 AM
- Posted Alerting for entries not found in given time period on Alerting. 03-18-2024 07:54 PM
- Posted How to rearrange columns in the .csv that is created via outputlookup command? on Dashboards & Visualizations. 03-01-2023 04:17 AM
- Posted Re: How to calculate the total count of occurances of a timestamp ? on Splunk Search. 02-02-2023 07:45 AM
- Karma Re: How to calculate the total count of occurances of a timestamp ? for ITWhisperer. 02-02-2023 07:44 AM
- Karma Re: How to calculate the total count of occurances of a timestamp ? for ITWhisperer. 02-02-2023 07:44 AM
- Posted Re: How to calculate the total count of occurances of a timestamp ? on Splunk Search. 02-02-2023 02:58 AM
- Posted Re: How to calculate the total count of occurances of a timestamp ? on Splunk Search. 02-02-2023 02:54 AM
- Posted How to calculate the total count of occurances of a timestamp ? on Splunk Search. 02-01-2023 05:47 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-23-2024
06:40 AM
Thanks @bowesmana @ITWhisperer . I was able to concoct a solution based on our inputs.🙏 @bowesmanaIn your below solution count=1 can also denote if the value was present in the live search and not in the inputlookup. However, your solution of using append works in this case. | stats count by Time Value
| append [
| inputlookup lookup.csv
``` Filter the entries you expect here, e.g. using addinfo ```
``` | where Time is in the range you want ```
]
| stats count by Time Value
| where count=1 @ITWhispererYour solution of using a variable Flag worked for me as it also handled the scenario where a particular value was found only in the live index search but not on the lookup. Thanks for this. <your index>
| bin _time as period_start span=1h
| dedup period_start Value
| eval flag = 1
| append
[| inputlookup lookup.csv
[ eval period_start = ``` convert your time period here ```
| eval flag = 2]
| stats sum(flag) as flag by period_start Value
``` flag = 1 if only in index, 2 if only in lookup, or 3 if in both ```
| where flag = 2
... View more
03-20-2024
09:09 AM
So lookup here is being considered as a sub search and hence only those events which match with the main search, are being displayed. Is my understanding correct?
... View more
03-20-2024
07:21 AM
Thanks for this. Is it possible to pass the TIme value, which is calculated in the real time search, to the inputlookup, to filter out the required 'Values' for compare? I checked the documentation on lookup and tried the solution you shared earlier, however, I am not getting the desired results. E.g. my lookup has 20 entries and real-time count only has 18, the final result is 18 entries with Found containing values only of those present in real-time check. The two missing entries are not displayed( null values under Found ). Any suggestions on what might be the possible issue ?
... View more
03-19-2024
05:50 PM
Apologies, my Value field is a combination of two separate field values from my index. It's to uniquely classify an event. Like you mentioned the count will not give a non numeric value. The command would be | stats count by Time Value| fields - count For using the lookup, should I sort the lookup or the live data from the index before compare ? Reason for asking is even though I can manually confirm that there is a mismatch, the script is unable to locate that. E.g if the live data has 18 entries and the lookup as 20, the 2 missing entries are not showing up in the script.
... View more
03-19-2024
05:46 PM
My lookup file already has the entry for Time, in the expected format. Should I still proceed with the time formatting ?
... View more
03-19-2024
01:03 AM
Hello, The time is created from the below script | bin _time span=60
| eval Time1=strftime(_time+3600,"%A %H")
| eval eventstart = strftime(_time, "%H")
| eval eventend=01
| eval eventrange = eventstart+(eventend)
| eval eventrange=if(eventrange=-1, 23,eventrange )
| replace 0 with 00, 1 with 01, 2 with 02, 4 with 04, 5 with 05, 6 with 06, 7 with 07, 3 with 03, 9 with 09, 8 with 08
| eval Time2 = Time1.": [".eventstart."00 - ".eventrange."00] " So, the TIME format actually is Day TIME_TOHour [TIME_FROM - TIME_TO]
... View more
03-18-2024
07:54 PM
Hello good folks, I've this requirement, where for a given time period, I need to send out an alert if a particular 'value' doesn't come up. This is to be identified by referring to a lookup table which has the list of all possible values that can occur in a given time period. The lookup table is of the below format Time Value Monday 14: [1300 - 1400] 412790 AA Monday 14: [1300 - 1400] 114556 BN Monday 15: [1400 - 1500] 243764 TY Based on this, in the live count , for the given time period ( let's take Monday 14: [1300 - 1400] as an example ), if I do a stats count as Value by Time and I don't get "114556 BN" as one of the values, an alert is to be generated. Where I'm stuck with is matching the time with the values. If I use inputlookup first, I am not able to pass the time from Master Time picker which will not allow me to check for specific time frame ( in this case an hour ). If I use the index search first, I am able to match the time against the lookup by using | join type=left but I am not able to find the missing values which are not there in the live count but present in the lookup. Would appreciate if I could get some advice on how to go about this. Thanks in advance!
... View more
Labels
- Labels:
-
alert action
-
alert condition
03-01-2023
04:17 AM
Hi,
As the query states, I have a stats command that gives me a table with all the required columns. While viewing the stats during search, using table command I am able to reorder the columns to the desired view. However, when I write the output to a csv using outputlookup, the columns get re arranged in alphabetical order of their names. Is there any way we can override this?
Thanks for the help!
... View more
02-02-2023
07:45 AM
Thanks! That did the trick.🙂
... View more
02-02-2023
02:58 AM
Thanks a lot for this. However, the Table comes out with repeated values for Year and Month. DEDUP seems to remove entries of other Columns as well. Is there any way to remove those duplicates? Thanks in advance!
... View more
02-02-2023
02:54 AM
Just to point out: the desired output your illustrated is not "occurrences of CCYY then MM then DD," but occurrences of CCYY, then CCYYMM, then CCYYMMDD. This is correct. I would have to further drill down to HH MM SS as well, which would be CCYYMMHHMMSS. Thanks for the info. Additionally, 2022-27 is not a very good illustration of Month. Apologies for this.
... View more
02-01-2023
05:47 PM
Basically I have a set of raw data with different time stamp in CCYYMMDDHHMMSS format. I want to list out the stats which shows how many occurrences of CCYY then MM then DD . I am able to use STRFTIME to get the segregate the data into desired format as year month and day. My expected result output is Year Year Count Month Month Count Day DayCount 2022 1000 2022-11 250 2022-11-27 20 2023 10 2022-12 100 2022-11-12 5 2022-11-27 35 I used the below |stats count as total by year, month day But the actual output is not as expected Year Year Count Month Month Count Day DayCount 2022 20 2022-11 20 2022-11-27 20 2022 5 2022-12 5 2022-11-12 5 2022 35 2022-27 35 2022-11-27 35 Should be simple enough, just not for me. Please help. Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-23-2024
01:06 PM
|
