Splunk Cloud

Having trouble with scheduling a PDF report to be delivered via email?

Explorer

I have worked on a query in order to generate a report that gives us the monthly visits and bandwidth used etc. I have listed the query below. It gives the results in the splunk environment. But when we generate a PDF document we see the error listed below the query, after the results table. I would appreciate suggestions to resolve this issue.

|rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)"
|rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)"
|rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)"
|timechart span=1mon@mon dc(reqip) as "Unique Visitors", dc(uri) as Pages, sum(bytes) as Bandwidth(KB), count(uri) as Hits
|eval Bandwidth(KB) = round('Bandwidth(KB)'/1024,2)
|append [search index="med" sourcetype="med:httpaccess:log" *med.cms.gov*
|rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)"
|rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)"
|rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)"
|bin span=1mon@mon _time
|stats count(uri) as viewed by _time, reqip
|stats sum(viewed) as "Number of Visits" by _time] |stats values(*) as * by _time
|fillnull
|addcoltotals label="Total" labelfield="_time"
|table _time "Unique Visitors" "Number of Visits" Pages Hits Bandwidth(KB)

The expected result is 

chinmay25_1-1596127976642.png

 

 

 

chinmay25_0-1596127760244.png

Labels (1)
Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Hi

should these  span=1mon@mon be  span=-1mon@mon?
r. Ismo

0 Karma

Explorer

Hi r. Ismo,

Yes. 

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!