About shanecifaldi

shanecifaldi · ‎08-16-2021

I need some help with an alert i have been stuck on. I have a DBCONNECT lookup that returns a value once a day. This value contains 18 IPs at the moment all separated by "," - for example value=1.1.1.1/24,2.2.2.2, 5.5.5.5/16. I need an search i can create an alert off of if there is an IP added to this compared to when it was last ran. IE - search 1 at 6am had 5 IPs search 2 the next day has 6 IPs - alert. right now i get the all the IPs in one field called "Value=" - looks like the below (ips changed for this post) value="1.526.323.176/2,133.58.35.4/2,10.199.0.99/14 I basically need the alert to send our team an email letting us know an IP has been added and we should look into it.

shanecifaldi · ‎04-23-2019

We're running into an issue where are RT searches are being delayed due to the amount of concurrent searches being ran. priority=default, status=delayed, reason="The maximum number of concurrent running jobs for this real-time scheduled search on this instance has been reached", concurrency_category="real-time_scheduled", concurrency_context="saved-search_instance-wide", concurrency_limit=1, scheduled_time=1556040360, window_time=0 I have double checked everything in my limits.conf that could stop these searches. base_max_searches = 7 max_rt_search_multiplier = 4 max_searches_per_cpu = 4 (4 cpu 18gb ram) max_searches_perc = 100 auto_summary_perc = 100 We're on version 7.2.4.2 - cron alerts fire with no issues but RT do not. I know several people will say dont use RT alerts - not interested in your opinion in that regards - just whats holing up my own RT searches. As you can see below - we dont have that many searches running.

shanecifaldi · ‎09-06-2018

Wow..something so simple, duh! Thanks for the help!

shanecifaldi · ‎09-06-2018

I have data coming in from our NetApp storage controllers that shows aggregate space free every day. I need to plot each day's values and then show a chart that shows the last 60 days as dots on a line chart. Management wants to see if storage is trending up or down. i have this search so far but it is messing up and plotting the sum of all of them over 60 days. I want each day's values plotted: index=netapp_vault_utilization sourcetype=dbx3_netapp_vault_aggregate earliest=-60d@d latest=@h | timechart span=60d@d sum(SpaceFree) AS aggregate_space_free_60d by name | append [search index=netapp_vault_utilization sourcetype=dbx3_netapp_vault_aggregate earliest=-48h@h latest=24h@h | timechart span=60d@d sum(SpaceFree) AS aggregate_space_free_60d by name] It will show the correct amount for the current day but the larger numbers above are a sum of when the oldest event is. How did i fix this? Am i even on the right path?

shanecifaldi · ‎08-22-2018

thanks for your help i figured it out with the limit=0 syntax.

shanecifaldi · ‎08-22-2018

this works well but there is one issue - for some reason almost 1/2 of the volumes are being grouped as "other".

shanecifaldi · ‎08-21-2018

Hi All. I run the below search sourcetype=dbx3_netapp_vault_utilization it returns the below: (names redacted) I need to create a line chart that shows the "name" and "volumeUsed" from 48 hours ago compared to 24 hours ago so we can trend our snapshot size.

shanecifaldi · ‎08-21-2018

Hello All, I have some data coming in from NetApp that shows snapshot name and snapshot volume used. I need to show all the volume names/space used from 48 hours ago on-top of one from 24 hours ago. The goal is to show growth of our snapshots each day. by base search is : sourcetype=dbx3_netapp_vault_utilization this will return the below data: (server/host names redacted) I need the chart to show the name with Volume Used at 24h and 48 on the same line graph...any help?

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎08-21-2018

Online Status	Offline
Date Last Visited	‎08-19-2021 01:32 PM

How to Alert if an IP is added to a field

Real Time Search Issues

How do I plot 60 days worth of data on the line ch...

How to plot multiple values on single line chart

Show two plots on chart with different values?