Splunk Cloud Platform

Having trouble with scheduling a PDF report to be delivered via email?

chinmay25
Path Finder

I have worked on a query in order to generate a report that gives us the monthly visits and bandwidth used etc. I have listed the query below. It gives the results in the splunk environment. But when we generate a PDF document we see the error listed below the query, after the results table. I would appreciate suggestions to resolve this issue.

|rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)"
|rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)"
|rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)"
|timechart span=1mon@mon dc(reqip) as "Unique Visitors", dc(uri) as Pages, sum(bytes) as Bandwidth(KB), count(uri) as Hits
|eval Bandwidth(KB) = round('Bandwidth(KB)'/1024,2)
|append [search index="med" sourcetype="med:httpaccess:log" *med.cms.gov*
|rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)"
|rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)"
|rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)"
|bin span=1mon@mon _time
|stats count(uri) as viewed by _time, reqip
|stats sum(viewed) as "Number of Visits" by _time] |stats values(*) as * by _time
|fillnull
|addcoltotals label="Total" labelfield="_time"
|table _time "Unique Visitors" "Number of Visits" Pages Hits Bandwidth(KB)

The expected result is 

chinmay25_1-1596127976642.png

 

 

 

chinmay25_0-1596127760244.png

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

should these  span=1mon@mon be  span=-1mon@mon?
r. Ismo

0 Karma

chinmay25
Path Finder

Hi r. Ismo,

Yes. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...