About Vani_26

Vani_26

@yuanliu , pleas find my answers below: 1. What I meant was for you to run that query standalone, not embedded in a complex search. The purpose is to directly confirm/demonstrate that your Splunk instance performs fillnull as designed. Nevertheless, your results with my silly test still demonstrates that fillnull works perfectly in your Splunk. yes correct when i run the query makeresults i am getting the output same like you as shown below: ATM DMM Income Rej_app Rej_log< Rej_app Reject 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2. Your search does not return events with the following strings: "Letter published correctley to DMM subject", "Letter rejected due to: DOUBLE_KEY", and "Letter rejected due to: UNVALID_LOG"; but it does return events with "Letter rejected due to: UNVALID_DATA_APP". (You can verify this by, e.g., search without stats and observe; there are many other ways to verify.) Here i gave an example, but the issue is with all the 6 strings. like if i search data for last 15 mins, if logs is present for a particular it showing the count, but if logs are not present its showing null. 3. makeresults in appendcols subsearch only fills 3 rows. (Do run it standalone so you understand what it does.) When i run it as standalone also i am seeing same 3rows only ATM DMM Income Rej_app Rej_log< Rej_app Reject 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4. Now that we have established that fillnull works correctly, let me point out that this latest illustrated output contains no "empty" cells in ATM (aka "Letter published correctley to ATM subject") and Rej_app (aka "Letter rejected due to: UNVALID_DATA_APP"), the only two columns where your present search actually returns results. Can you reproduce the problem you described? (No appendcol-makeresults business.) Here i gave an example, but the issue is with all the 6 strings. when i select a particular time range if logs are present then i see the count otherwise it is displaying null. 5. I also want to point out that your OP illustrated drastically different column names as your later comments. This type of unexplained differences make volunteers' mind-reading a lot more difficult. Always explain your dataset, desired results, logic between the two in plain language (preferably without SPL), attempted SPL and actual results, then explain how actual results differ from desired results if that's not painfully obvious - oftentimes it is not to outsiders. If you need to change mock data/results from a previous message, immediately point out and explain those changes. I apologies for that will make sure to provided uniform data 6. The biggest discrepancy I see in your case is that, it is impossible for countin any stats command (including chart and timechart) to give "empty" output. So, there must be some other commands AFTER stats that gives bad output. You need to first examine/exemplify output from chart, then scrutinize every command after that to find which one/ones. Sorry i did not get you, can u pls let me know the query

Vani_26

Tried below query: Where is no data for any Msgs it displaying zero only for 1st 3 rows remaining rows are displaying null. index=app-index source=application.logs |rex field= _raw "application :\s(?<Application>\w+)" | rex field= _raw "(?<Msgs>Initial message received with below details|Letter published correctley to ATM subject|Letter published correctley to DMM subject|Letter rejected due to: DOUBLE_KEY|Letter rejected due to: UNVALID_LOG|Letter rejected due to: UNVALID_DATA_APP)" |chart count over Application by Msgs |rename "Initial message received with below details" as Income, "Letter published correctley to ATM subject" as ATM, "Letter published correctley to DMM subject" as DMM, "Letter rejected due to: DOUBLE_KEY" as Reject, "Letter rejected due to: UNVALID_LOG" as Rej_log, "Letter rejected due to: UNVALID_DATA_APP" as Rej_app |table Income Rej_app ATM DMM Reject Rej_log Rej_app |appendcols [| makeresults format=csv data="Income, Rej_app, ATM, DMM, Reject, Rej_log, Rej_app ,,,,, ,,,,, ,,,,," | fillnull] output: Application ATM DMM Income Rej_app Rej_log Reject Login 10 0 0 2 0 0 Success 12 0 0 1 0 0 Error 23 0 0 11 0 0 Debug 2 3 logout 1 50 error-state 61 20 normal-state 1 10

Vani_26

How did you apply fillnull? |fillnull value=0 Do you mean to say that the following doesn't give you 0 when the value is null? yes

Vani_26

Please find the query and sample logs, Issue is when there are no logs with any of the Msgs, that coloumns are showing null, tried fill null command but not working. index=app-index source=application.logs |rex field= _raw "application :\s(?<Application>\w+)" | rex field= _raw "(?<Msgs>Initial message received with below details|Letter published correctley to ATM subject|Letter published correctley to DMM subject|Letter rejected due to: DOUBLE_KEY|Letter rejected due to: UNVALID_LOG|Letter rejected due to: UNVALID_DATA_APP)" |chart count over Application by Msgs |rename "Initial message received with below details" as Income, "Letter published correctley to ATM subject" as ATM, "Letter published correctley to DMM subject" as DMM, "Letter rejected due to: DOUBLE_KEY" as Reject, "Letter rejected due to: UNVALID_LOG" as Rej_log, "Letter rejected due to: UNVALID_DATA_APP" as Rej_app |table Income Rej_app ATM DMM Reject Rej_log Rej_app Sample logs: 2024-01-24 11:21:55,123 [app-product-network-thread | payments_acoount_history_app_hjutr_12nj567fghj5667_product] INFO STREAM_APPLICATION - Timestamp:2024-01-24 11:21:55,123 Initial message received with below details: Application:Login Code name: payments_acoount_history_app_hjutr_12nj567fghj5667_product Code offset: -12 Code partition: 4 2024-01-24 11:21:55,123 [app-product-network-thread | payments_acoount_history_app_hjutr_12nj567fghj5667_product] INFO STREAM_APPLICATION - Timestamp:2024-01-24 11:21:55,123 Letter published correctley to ATM subject: Application:Success Code name: payments_acoount_history_app_hjutr_12nj567fghj5667_product Code offset: -1 Code partition: 10 2024-01-24 11:21:55,123 [app-product-network-thread | payments_acoount_history_app_hjutr_12nj567fghj5667_product] INFO STREAM_APPLICATION - Timestamp:2024-01-24 11:21:55,123 Letter published correctley to DMM subject: Application:normal-state Code name: payments_acoount_history_app_hjutr_12nj567fghj5667_product Code offset: -1 Code partition: 6 2024-01-24 11:21:55,123 [app-product-network-thread | payments_acoount_history_app_hjutr_12nj567fghj5667_product] INFO STREAM_APPLICATION - Timestamp:2024-01-24 11:21:55,123 Letter rejected due to: DOUBLE_KEY: Application:error-state Code name: payments_acoount_history_app_hjutr_12nj567fghj5667_product Code offset: -1 Code partition: 4 2024-01-24 11:21:55,123 [app-product-network-thread | payments_acoount_history_app_hjutr_12nj567fghj5667_product] INFO STREAM_APPLICATION - Timestamp:2024-01-24 11:21:55,123 Letter rejected due to: UNVALID_LOG: Application:Debug Code name: payments_acoount_history_app_hjutr_12nj567fghj5667_product Code offset: -18 Code partition: 2 2024-01-24 11:21:55,123 [app-product-network-thread | payments_acoount_history_app_hjutr_12nj567fghj5667_product] INFO STREAM_APPLICATION - Timestamp:2024-01-24 11:21:55,123 Letter rejected due to: UNVALID_DATA_APP: Application:logout Code name: payments_acoount_history_app_hjutr_12nj567fghj5667_product Code offset: -4 Code partition: 0

Vani_26

We have a table where i see no data for few coloumns tried fillnull value=0 but its not working. But this is happening only when there no count for complete column, for example, For invalidcount we have data for Login but no data for other applications so it automatically filled zero values, but for rejectedcount, trmpcount, topiccount there is no data for any application 0 value is not getting filled up. Application incomingcount rejectedcount invalidcount topcount trmpcount topiccount Login 1 2 5 Success 8 0 2 Error 0 0 10 logout 2 0 4 Debug 0 0 22 error-state 0 0 45 normal-state 0 0 24

Vani_26 · ‎09-26-2023

Hi @bowesmana , i tried the suggested query buts its not working.

Vani_26 · ‎09-24-2023

original query: index=splunk-index |where message="start" |where NOT app IN("ddm", "wwe", "tygmk", "ujhy") |eval day= strftime(_time, "%A") |where _time >= relative_time(_time, "@d+4h") AND _time <= relative_time(_time, "@d+14h") |where NOT day IN("Tuesday", "Wednesday", "Thursday") To suppress my alert, i created a lookup file and added the alert name and holidays dates as shown below: Alert Holidays_Date App Relative Logs Data 8/12/2023 App Relative Logs Data 8/13/2023 App Relative Logs Data 8/14/2023 App Relative Logs Data 8/18/2023 Query with inputlookup holiday list: |inputlook HolidayList.csv |where like(Alert, "App Relative Logs Data") AND Holidays_Date=strftime(now(), "%m/%d/%y") |stats count |eval noholdy=case(count=1, null(), true(), 1) |search noholdy=1 |fields noholdy |appendcols [search index=splunk-index |where message="start" |where NOT app IN("ddm", "wwe", "tygmk", "ujhy") |eval day= strftime(_time, "%A") |where _time >= relative_time(_time, "@d+4h") AND _time <= relative_time(_time, "@d+14h") |where NOT day IN("Tuesday", "Wednesday", "Thursday")] When i used this query i am still receiving alert on the dates mentioned in the .csv file. But i don't want to receive the alerts. is there something wrong in my query, please help

Vani_26 · ‎05-30-2023

Original query: index=app-data sourcetype=clientapp-code |rex field=_raw "\Status\:(?<Code>.*?)\|" |eval Failed=if(Code!=0, "Failed", null()) |bucket _time span=1d |stats count(Failed) as Fail by _time OUTPUT: _time Fail 2022-01-22 6 2022-01-23 0 2022-01-24 8 2022-01-25 0 2022-01-26 0 2022-01-27 12 2022-01-28 0 2022-01-29 0 tstats query: |tstats count where index=app-data sourcetype=clientapp-code by PREFIX(status:) _time span=1d |rename status: as Code |eval Failed=if(Code!=0, "Failed", null()) |where Code!=0 |stats values(count) by _time OUTPUT: _time Fail 2022-01-22 6 2022-01-24 8 2022-01-27 12 I want to see original query output with tstats query but 0 data rows are not showing up in tstats command. How can i get the 0 data rows using tstats query???

Vani_26 · ‎05-26-2023

below is my tstats query, how to pass this token (prodct="$eppProduct$") OR site="$eppProduct$") in this query: i pasted original query also, in original query tokens are there but when i trying to pass in tstats its not working |tstats avg(duration) as Duration where index=epp-prd-clc TERM(variable) TERM("ap")TERM(virginal) TERM("ssc") TERM(deposit) TERM("calp") BY PREFIX(deposit:) _time |rename deposit: as Deposit |eval Deposit=upper(deposit) |timechart |eval Duration=round(Duration,2) orginal query: index=epp-prd-clc variable="ap" virginal="ssc" (prodct="$eppProduct$") OR site="$eppProduct$") deposit="calp" |eval Deposit=upper(deposit) |timechart avg(duration) as Duration |eval Duration=round(Duration,2)

Vani_26 · ‎05-26-2023

Below is my original xml code for dashboard. from the panel of EPP TimeZone , i have modified the query using tstats, query is working fine, but when i compare with original xml code query i am not able to pass tokens ((prodct="$eppProduct$") OR site="$eppProduct$")) in my tstats query. can anyone please help on this. <form> <label>EPP Mode Dashboard</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="eppProduct" searchWhenChanged="true"> <label>Product</label> <fieldForLabel>all_product</fieldForLabel> <fieldForValue>all_product</fieldForValue> <search> <query> |tstats count where index=epp-prd-clc by site host host_ip |eval prodct= case(like(host, "%prod%"), "PROD", like(host, "%pat%"), "PAT", like(host, "%sit%"), "SIT", like(host, "%dev%"), "DEV") |stats count by site prodct |eval all_product=if(like(prodct, "PROD"), site, prodct)</query> <earliest> -4h@h </earliest> <latest>now</latest> </search> <default>*</default> <intialValue>*</intialValue> <choice value="*"> ALL </choice> </input> <input type="time" token "eppTime" searchWhenChanged="true" <label>Time</label> <default> <earliest> -60m@m </earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>EPP TimeZone</title> <chart> <title> Average Response Time</title> <search> <query> index=epp-prd-clc variable="ap" virginal="ssc" (prodct="$eppProduct$") OR site="$eppProduct$") deposit="calp" |eval Deposit=upper(deposit) |timechart avg(duration) as Duration |eval Duration=round(Duration,2)</query> <earliest> $eppTime.earliest$ </earliest> <latest>$eppTime.latest$</latest> </search> <option nmae="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle </option> <option nmae="charting.axisLabelsX.majorLabelStyle.rotation">0 </option> <option nmae="charting.chart"> line </option> <option nmae="charting.chart.nullValueMode"> zero </option> <option nmae="charting.chart.showDataLabels">minmax </option> <option nmae="charting.drilldown>all </option> <option nmae="charting.layout.splitSeries"> 1 </option> <option nmae="referesh.display"> none </option> </chart> </panel> </row> </form> below is the modified xml dashboard code using tstats. <form> <label>EPP Mode Dashboard</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="eppProduct" searchWhenChanged="true"> <label>Product</label> <fieldForLabel>all_product</fieldForLabel> <fieldForValue>all_product</fieldForValue> <search> <query> |tstats count where index=epp-prd-clc by site host host_ip |eval prodct= case(like(host, "%prod%"), "PROD", like(host, "%pat%"), "PAT", like(host, "%sit%"), "SIT", like(host, "%dev%"), "DEV") |stats count by site prodct |eval all_product=if(like(prodct, "PROD"), site, prodct)</query> <earliest> -4h@h </earliest> <latest>now</latest> </search> <default>*</default> <intialValue>*</intialValue> <choice value="*"> ALL </choice> </input> <input type="time" token "eppTime" searchWhenChanged="true" <label>Time</label> <default> <earliest> -60m@m </earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>EPP TimeZone</title> <chart> <title> Average Response Time</title> <search> <query> |tstats avg(duration) as Duration where index=epp-prd-clc TERM(variable) TERM("ap")TERM(virginal) TERM("ssc") TERM(deposit) TERM("calp") BY PREFIX(deposit:) _time |rename deposit: as Deposit |eval Deposit=upper(deposit) |timechart |eval Duration=round(Duration,2)</query> <earliest> $eppTime.earliest$ </earliest> <latest>$eppTime.latest$</latest> </search> <option nmae="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle </option> <option nmae="charting.axisLabelsX.majorLabelStyle.rotation">0 </option> <option nmae="charting.chart"> line </option> <option nmae="charting.chart.nullValueMode"> zero </option> <option nmae="charting.chart.showDataLabels">minmax </option> <option nmae="charting.drilldown>all </option> <option nmae="charting.layout.splitSeries"> 1 </option> <option nmae="referesh.display"> none </option> </chart> </panel> </row> </form>

Vani_26 · ‎03-15-2023

Hi @PickleRick i tried sum(count) but its not coming. no values are displaying under count

Vani_26 · ‎03-15-2023

Query: index=xxx application_code=mobile NOT feature |stats count by code message |sort -count |eval message-substr(message, 1, 40) output: code message count mobile-job-115 application error occured 100 mobile-app-180 application is stable 240 app-job-800 information good 34 project-job-100 system error occured 10 project-job-100 system error occured 20 project-job-100 system error occured 34 project-job-100 system error occured 23 project-job-100 system error occured 50 expected output: code message count mobile-job-115 application error occured 100 mobile-app-180 application is stable 240 app-job-800 information good 34 project-job-100 system error occured 137 i want to get my table display count as one value for similar messages like for example(system error occured) as shown above.

Vani_26 · ‎03-06-2023

Hi @bowesmana, i have created the query, and i have created a new summary index in indexs.conf Now what i should create a report and now how i can send the send data to summary index, Do i need to add like collect at the end of my query?? Do i need to create a 2 reports one for daily and that daily data need to be added in summary index?? I am completely new to this part, not sure how to make the connection between my query and summaryindex.

Vani_26 · ‎02-27-2023

I have a dashboard which contains 5 panels in table format. Query for panel1: index=xxxx sourcetype=xxxxx stroage_name=CompleteTransactions |table Description application _time count streamstats current=f window=1 values( Description) as desp values(application) as app values(_time) as totaltime values (count) as totalcount |eval siml=if(application == app AND Description == desp, count - totalcount,0) |where siml > 0 |stats sum(siml) as totalrequest by application output: Description application _time count ampt.gc.com ampt-portal 2023-01-16 14:00:56.456 100 ampt.gc.com ampt-login 2023-01-16 12:00:56.400 20 ampt.gc.com ampt-clientid 2023-01-16 11:00:36.406 50 Similar to panel 1 query we have other 4 panels with different field names. The task is i need to get the output of 5 panels into a summary index. Retention period to 60 days query need to run for every 24 hours So need to create a report for everyday for last 24 hours and need to create report to collect everydata into summary index. so that if they search for last 60 days data should display. how can i do this

Vani_26 · ‎02-27-2023

@bowesmana , Excellent!!!! It worked, thank you

Vani_26 · ‎02-26-2023

Need a dropdown and when i select one option only that related panels should display rest all panels should not display. i have 7 panels(panel1, panel2.......panel7), i need to have one dropdown with 3 options(appID, appname, appdetails) options in it. if i select appID from the dropdown, 3 panels should display(panel1, panel2 and panel3) if i select appname from the dropdown, 2 panels should display(panel4, panel5) if i select appdetails from the dropdown, 2 panels should display(panel6, panel7) Please help me on this.

Vani_26 · ‎02-22-2023

i have jira issue collector app in splunk and inputs also added we can see logs as well. here it was with only one project with index=jirarequest Now i modified the JQL query in the inputs to get data from 2 projects, the JQL query i used is: project%20in(MMAAS%2CBBAT)%20AND%20updated%3E-2h But now after updating the JQL query with 2 projects i am not able to see the data from second project i.e CBBAT. Do i need to modify or update anywhere else, i am not sure.

Vani_26 · ‎02-08-2023

Hi, I have 10 hosts, from this only 3 hosts are reporting to DS and 7 are not reporting. when i searched with _internal i could see only 3 hosts logs are coming in. How to troubleshoot further on this issue??

Vani_26 · ‎02-01-2023

Thank you @richgalloway it worked

Vani_26 · ‎01-31-2023

hi @richgalloway 1. What does the current query give you? Is the offer field indexed? No offrer field is not an index field. 2. When i tried to use the below query i am getting the output as: |tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) by host_ip host_ip count 11.56.67.12 45 11.56.67.14 56 But i am not expecting this output.

Vani_26 · ‎01-31-2023

Query: |tstats count where index=afg-juhb-appl host_ip=* source=* TERM(offer) i want to get the count of each source by host_ip as shown below. output: source 11.56.67.12 11.56.67.15 11.56.67.18 11.56.67.19 /app/clts/shift.logs 987 67 67 89 /apps/lts/server.logs 45 45 67 43 /app/mts/catlog.logs 89 89 65 56 /var/http/show.logs 12 87 43 65

Vani_26 · ‎01-28-2023

@yuanliu What you said is correct, but when i use tstats i am getting avg of plantime but not matching the count with original query. As per my knowledge, when i run a tstats query if the field is not an index time field it will throw error and not show any results. But here i am getting the results but avg of plantime is not matching. if i am getting results means the plantime is indextime field right?

Vani_26 · ‎01-25-2023

Hi all when i run my original query i am getting one result and when i execute the same query using tstats i am getting different output. AVG IS NOT MATCHING. how to modify the query to match the count. my original query: index=apl-cly-sap sourcetype=cly:app:sap |search processName="applicationstatus" |stats avg(plantime) output: 1233.43223454 tstats query: |tstats count where index=apl-cly-sap sourcetype=cly:app:sap TERM(processName=applicationstatus) by PREFIX(plantime=) |rename plantime= as Time |stats avg(Time) output: 1345.7658755

Vani_26 · ‎01-17-2023

Hi@yeahnah Actually data was coming correctly using tstats byt the issue was with prefix .the data is displaying by prefix. now i corrected it by using your suggested query. thank you for your help. |tstats count where index=app-clietapp host=ahnbghjk OR host=ncsjnjsnjn sourcetype=app-clientapp source=/opt/splunk/var/clientapp/application.log by PREFIX(status:) |rename status: as App_Status |where isnotnull(App_Status) | eval Success=if(App_Status=0, count, Success), Error=if(App_Status!=0, count, Error) |filldown |stats count by Success, Error |eval Total_Count= Success+Error |fields Success Error Total_Count |eval SuccessPer=( Success/Total_Count) * 100 |eval SuccessPercentage=round(SuccessPer,2) |table SuccessPercentage

Vani_26 · ‎01-16-2023

Hi @yeahnah let me tell you the original one: my orginal query: index=app-clietapp host=ahnbghjk OR host=ncsjnjsnjn sourcetype=app-clientapp source=/opt/splunk/var/clientapp/application.log by PREFIX(status:) |rename status: as App_Status |where isnotnull(App_Status) |eval Sucess=if(App_Status="0" OR App_Status="", "Succ", null()) |eval Error=if(App_Status!="0", "Error", null()) |stats count(Sucess) as Sucess_Count count(Error) as Error_Count count(App_Status) as Total_Count |eval SuccessPer=( Sucess_Count/Total_Count) * 100 |eval SuccessPercentage=round(SuccessPer,2) |table SuccessPercentage OUTPUT: SuccessPercentage 100.00 tstats query: |tstats count where index=app-clietapp host=ahnbghjk OR host=ncsjnjsnjn sourcetype=app-clientapp source=/opt/splunk/var/clientapp/application.log by PREFIX(status:) |rename status: as App_Status |where isnotnull(App_Status) |eval Sucess=if(App_Status="0" OR App_Status="", "Succ", null()) |eval Error=if(App_Status!="0", "Error", null()) |stats count(Sucess) as Sucess_Count count(Error) as Error_Count count(App_Status) as Total_Count |eval SuccessPer=( Sucess_Count/Total_Count) * 100 |eval SuccessPercentage=round(SuccessPer,2) |table SuccessPercentage OUTPUT: SuccessPercentage 50.00 When i use orginal query i am gettting output as 100%, but when i use tstats query i am getting 50% as output. can you please help on this.

Posts	74
Solutions	0
Karma Given	13
Karma Received	2
Member Since	‎07-29-2022

Online Status	Offline
Date Last Visited	2 weeks ago

Empty rows in Table

how to suppress alerts during holidays

How to get the 0 data rows using tstats query?

How to pass token in dashbaord

Search to Consolidate similar messages into one?

How to create summary index?

Need a dropdown and when i select one option only ...

Jira Issue Collector app in splunk- Do I need to u...

Why is UF not reporting to DS?

How to get count of each source by IP ?

Re: Empty rows in Table

Re: Empty rows in Table

Re: Empty rows in Table

Re: Empty rows in Table

Empty rows in Table

Re: how to suppress alerts during holidays

how to suppress alerts during holidays

How to get the 0 data rows using tstats query?

Re: How to pass token in dashbaord

How to pass token in dashbaord

Re: Query to Consolidate similar messages into one

Search to Consolidate similar messages into one?

Re: Need to create summary index

How to create summary index?

Re: dashboard drop down

Need a dropdown and when i select one option only ...

Jira Issue Collector app in splunk- Do I need to u...

Why is UF not reporting to DS?

Re: How to get count of each source by IP ?

Re: How to get count of each source by IP ?

How to get count of each source by IP ?

Re: Help with using tstats in search

How to use tstats in search?

Re: Need a table format data

Re: Need a table format data