Splunk Search

I'm having trouble with the "over" syntax. How to use it in this situation?

Path Finder
index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber<26  MachineState="*" | stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval "Login Hours"=ElapsedMachineSecondsInOrderPath/3600 | chart  sum("Login Hours") **over** MachineState by EmployeeLoggedInLastName

updated - marked as code

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Ah. You lost the values for MachineState in your stats command. Any field not present in the stats command is GONE after it.

I'm assuming you have many more employees then you have machine states, so you may want to remember "over rowname by columnname")

 index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber<26  MachineState="*" 
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedSeconds by EmployeeLoggedInLastName MachineState
| eval "Login Hours"=round(ElapsedSeconds/3600,2) 
| chart  sum("Login Hours") over EmployeeLoggedInLastName by MachineState

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Ah. You lost the values for MachineState in your stats command. Any field not present in the stats command is GONE after it.

I'm assuming you have many more employees then you have machine states, so you may want to remember "over rowname by columnname")

 index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber<26  MachineState="*" 
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedSeconds by EmployeeLoggedInLastName MachineState
| eval "Login Hours"=round(ElapsedSeconds/3600,2) 
| chart  sum("Login Hours") over EmployeeLoggedInLastName by MachineState

View solution in original post

0 Karma

Path Finder

Thank you for this solution and lesson. I didn't know it would be lost after stats.

SplunkTrust
SplunkTrust

@hppjet - yes, stats is a transforming command that summarizes all the records into a few new summary records. If you want to do something stats-like, but just want to add the calculated fields to every event, then use eventstats. If you want to do something that will process the events in order, like calculating an ongoing cumulative value across time, then use streamstats or accum. They each have their place.

0 Karma

Path Finder

I was hoping to create a column chart that has totals for "Login Hours" that is separated by machine state(running, stopped) that is broken out by Employee last name.

0 Karma

SplunkTrust
SplunkTrust

@hppjet - can you post a quick mockup of your desired output?

0 Karma

Champion

hmm what is your desired output? can you be a bit more specific?

0 Karma