Splunk Search

Search command. -

jaibalaraman
Path Finder

Hi 

I am not sure about this value risk score. 

How do i create dashboard tile for this fields

jaibalaraman_0-1712703374369.png

 

Labels (1)
0 Karma

jaibalaraman
Path Finder

Hi 
How do i change the max column, in readable format like 40 mins , 30 mins or 1 hrs 

 

jaibalaraman_0-1712711384079.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Instead of dealing with the messiness of a natural language, it might be better to use standard notation of duration, like

| fieldformat max(event.Properties.duration) = tostring('max(event.Properties.duration)', "duration")

Instead of 40 mins , 30 mins or 1 hrs, you get 00:40:00, 00:30:00, 01:00:00, and so on.

Tags (1)
0 Karma

jaibalaraman
Path Finder

Yes i trying to find out max duration and the endpoint which is associated with 

event.Properties.endpoint

event.Properties.duration.

0 Karma

yuanliu
SplunkTrust
SplunkTrust
| chart max('event.Properties.duration') by event.Properties.endpoint

Something like this?

0 Karma

jaibalaraman
Path Finder

I tried the search, but not getting the max number 

jaibalaraman_0-1712711067486.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

max(), avg() and stdev() are all aggregation functions which you can include on a stats command in your search

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Aggregatefunctions

 

0 Karma

jaibalaraman
Path Finder

Hi Thanks for the responce 

yes, i have gone through aggregate function, could you please help how to implement in the code 

Exp 1 -  chart eval(avg(size)/max(delay)) AS ratio BY host user 

 OR      timechart eval(round(avg(cpu_seconds),2)) BY processor

 

 

jaibalaraman_0-1712704159039.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

That'll depends on what you want to show for your risk score.  Do you want to show max?  Do you want to show avg?  Is there a groupby field you want to use?

Note the excerpted examples from the document are very specific to the problem the examples are trying to illustrate.  It is not a substitute for you to describe your desired output.  If you don't tell people, volunteers would have no way to read your mind.

In the simplest form, you can experiment with something like

 

| chart avg('event.Properties.riskScore')
  max('event.Properties.riskScore')
  min('event.Properties.riskScore')
  stdev('event.Properties.riskScore')

 

But you already did this.  So, what is your desired output?  Alternatively, what is the use case you are trying to apply?  What is the business problem you are trying to solve/illustrate using this dashboard?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...