I have multiple Dashboards that I have cloned to make changes. What is the best method to rename the existing dashboards out to old and rename the new dashboards in? 1)rename the current to old 2)rename the new to current. or do I have to do the below. 1)clone the current to old 2)delete current 3) clone the new into current 4) delete the new
... View more
I would like some help creating a report that will show the seconds diff between my event timestamp and the Splunk landing timestamp. I have the below query which will give me the diff between _indextime and _time but I would also like the seconds difference between GenerationTime (ie...2024-04-23 12:49:52) and _indextime. index=splunk_index sourcetype=splunk_sourcetype | eval tnow = now() | convert ctime(tnow) | convert ctime(_indextime) as Index_Time | eval secondsDifference=_indextime-_time | table Node EventNumber GenerationTime Index_Time, _time, secondsDifference
... View more
Hi, In the below code for a panel on my dashboard, I am displaying whether a report/alert is being skipped.
If the _time field returned from the lookup.csv is > than 20 minutes ago. I would also like to display the value of _time as well as the message. Can this be done?
<query>
| inputlookup append=t Lookup.csv
| eval tnow = now()
| eval lastruntime_unix = _time
| eval time_diff = tnow - lastruntime_unix
| eval status=if(time_diff > 1200, "1", "0")
| table status
| rangemap field=status low=0-0 severe=1-5 default=severe
| replace "0" with "Alert Run is Up to Date" in status
| replace "1" with "Alert Run is Skipping" in status
</query>
... View more
Can someone please give me an explanation as to what the below rex command is doing.
I do not understand the w+ s+ d+ etc........
| rex field=_raw "(?ms)^\\w+\\s+\\d+\\s+\\d+:\\d+:\\d+\\s+\\w+\\s+\\w+\\s+\\w+:\\s+\\w+:\\s+\\w+\\s+\\w+:\\s+\\w+\\s+\\w+\\s+\\w+:\\s+\\d+\\s+\\w+\\s+\\w+:\\s+\\d+\\-\\d+\\-\\d+\\s+\\d+:\\d+:\\d+\\s+\\w+:\\s+
(?P<Time>[^ ]+)\\s+
(?P<Trn_Total>\\d+)\\s+
(?P<Trn_Interval>\\d+)\\s+
(?P<TPS>[^ ]+)\\s+
(?P<SW_Inbound>[^ ]+)\\s+
(?P<SW_Outbound>[^ ]+)\\s+
(?P<SW_Total>[^ ]+)\\s+
(?P<SW_Ext_Pmc>[^ ]+)\\s+
(?P<SW_Int_Pmc>\\d+\\.\\d+)" offset_field=_extracted_fields_bounds
... View more
Hi Giuseppe, I have fixed my issue by using the | return command as per below. index=a4_designeng_generic_app_audit_prd sourcetype=cba:designeng:nonstop:syslog [| inputlookup NonStop_Production_Health_Status.csv | tail 1 | eval earliest=strptime(Status_Check_Timestamp,"%m/%d/%Y %H:%M:%S"), latest=now() | fields earliest latest | return earliest=$earliest ]
... View more
Hi Giuseppe, I've used that exact syntax and got the below error. index=a4_designeng_generic_app_audit_prd sourcetype=cba:designeng:nonstop:syslog [| inputlookup NonStop_Production_Health_Status.csv | tail 1 | eval earliest=strptime(Status_Check_Timestamp,"%m/%d/%Y %H:%M:%S"), latest=now() | fields earliest latest ] Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side. The search job has failed due to an error. You may be able view the job in the
... View more
Hi Giuseppe, My apologies for my delayed response. The results of the sub search is the value of "earliest", however, I am wanting to use this value as the search time window for a report. earliest=Status_Check_Timestamp latest=(now)
... View more
Hi Giuseppe, Thanks for your suggestion. I no longer get the invalid value error, however the "earliest" time modifier does not use the value of Status_Check_Timestamp from my lookup.csv???? It uses the value from preset (ie... last 15 min) Sample value of Status_Check_Timestamp - 09/28/2022 18:56:00
... View more
I am trying to use a timestamp field from a lookup.csv as the earliest time marker, but it will not set the value of earliest when the report runs. Can you help, please. The earliest and latest always use the defaul preset value.
index=a4_designeng_generic_app_audit_prd sourcetype=cba:designeng:nonstop:syslog
[| inputlookup Production_Health_Status.csv | tail 1 | eval earliest=Status_Check_Timestamp <--- this value is being set each time the report runs. | fields earliest ]
! Invalid value "09/28/2022 13:06:00" for time term 'earliest'
... View more
Hi Giuseppe, Thanks for responding. Unfortunately, I can not answer all those questions. I work for a large bank in Australia and am deemed a user of Splunk with no access to our Splunk environment. I suppose, I was hoping for a magic formula to make sure my report runs on time.
... View more
Hi,
Can someone suggest to me a method to ensure, my scheduled report will run without being skipped.
Cron = 8,18,28,38,48,58 * * * * with a schedule window of 15 minutes. I use a custom timeframe larger than required to cater for when the report is skipped.
Generally the report will run 2 times an hour sometimes 3, but at times does not run for a full hour. When I run the report adhoc, it takes less than a minute.
... View more
Thanks again. I'll have a play with this, but think it does not quite meet my needs. I need to return 10 fields with a count of how many matches have occurred, which I will have my report output to my alert_status_lookup.csv f_ignore f_chkr f_disk f_power f_not_run f_severiry f_proc f_test f_inc f_link f_clim 0 0 2 3 0 1 0 0 0 0 0 I then will have my dashboard reference the alert_status_lookup.csv.
... View more
Hi, Can you show me how you would create rex commands to create fields from the below search, seems tricky for an old Cobol programmer like myself. So I need 10 fields, one for each search item I am looking for. index=a0_test_index sourcetype=dr:syslog | search "IGNORE THIS" OR ("*$CHKR*" "*disk*") OR "*Power_Issue*" OR ("*$CHKR*" "*NOT RUNNING*") OR "*Severity: Major*" OR "*Processor Down*" OR "*TEST DRDOWN" OR "Incident Report Delivery Failure" OR "*link pulse is down*" OR "*CLIM Link Pulse Down*" Regards, David
... View more
Hi, I appreciate your feedback. The data is free text, so I will try to work out the regex command to isolate the values I'm searching for into field names and then try your suggested stats command. Regards, David
... View more
Hi, I have no issue creating my lookup.csv and I have no issue outputting to my lookup.csv and I do not have any issue retrieving into my dashboard from the lookup.csv. What I can't work out is how to have my search within my scheduled report access the index 1 time (ie... a basesearch) and retrieve multiple count values which I then populate my lookup.csv with. Scheduled report sample... System_Error_Cnt1 and System_Error_Cnt2 do not show a count but System_error_Cnt3 does. index=a0_designeng_generic_app_audit_npd sourcetype=cba:designeng:nonstop:syslog | search "IGNORE THIS" OR ("*$CHKR*" "*disk*") | stats count as System_Error_Cnt1 | search "*Power_Issue*" OR ("*$CHKR*" "*NOT RUNNING*") | stats count as System_Error_Cnt2 | search "*Severity: Major*" OR "*Processor Down*" OR "*TEST DRDOWN" OR "Incident Report Delivery Failure" | stats count as System_Error_Cnt3 | table System_Error_Cnt1 System_Error_Cnt2 System_Error_Cnt3 System_Error_Cnt1 System_Error_Cnt2 System_Error_Cnt3 0 Regards, David
... View more
Hi Ismo, I have used a basesearch before in a dashboard. What I'm trying to achieve is a scheduled report outputting multiple count values to a lookup.csv. I would then use the values of the lookup.csv to utilise in a traffic light type dashboard as well as a secondary dashboard drilled down from the traffic light dashboard. 1. Report runs every 5 to 10 minutes loading a lookup.csv 2. Traffic Light Dashboard utilizes the lookup.csv to decide Green(ok) Red (Bad) 3. Secondary Dashboard drilled down from Traffic Light Dashboard will show multiple panels using the lookup.csv to highlight the area of concern in one of the panels. 4. Drilldown from secondary Dashboard Panel of concern to look at events of concern. the lookup.csv will have Error/Issue counts columns (ie..Ingestion count, system error count, backup error count etc... So I basically want to load this lookup.csv from the scheduled report but only having to hit the index once. Regards, David
... View more
I'd like to create a base search in a report that will allow me to do a stats count against the different type of values searched for ie... Disk_Error_Count, Power_issue_Count, Severity_Major_Count etc.....
index=testindex
| search ("*$CHKR*" "*disk*") OR "*Power_Issue*" OR "*Severity: Major*" OR "*Processor Down*" OR "*TEST Msg" OR "Report Delivery Failure"
outputting the values to a lookup.csv
I'm trying to prevent the report having to hit the index for the individual counts.
I have a dashboard that will then output the counts for visualization.
... View more