Hi folks, host=* AlertType="Warning" |bucket _time span=day| stats count min(count) max(count) avg(count) stdev(count) by _time This is what the results look like: _time count min(count...
Hi ,
So, I have a dashboard containing search query like :
search query | stats max(field1) by field2
but when I want to see the events for a particular point it leads me to all results for ...
Hello, I am building a splunk app , where I want to have my own custom aggregatefunction for stats command. Below is my use case let say.
| makeresults count=10
| eval event_count=r...
My data looks like this:
_time:11/5/1912:41:00
ID: 123
Value:10
For each minute I want to know the last value that was known in that minute. How can I achieve this?
The ID is not update...
This is an extension to my other question in https://answers.splunk.com/answers/812982/summary-of-stats-from-multiple-events-for-each-ide.html?minQuestionBodyLength=80
The input and output that I n...
Hello all,
I am new to splunk,
By following string i get a graph of risk:
index="iniatva_linux" Risk=Critical OR Risk=High OR Risk=Medium OR Risk=Low | where like(Name, "%Unsupported%") |...
I have this search:
...
| rename value as "Response Time"
| timechart span=1m max("Response Time") by app_name limit=5 useother=false usenull=false
and I'd like to allow 'max("Response Time...
Hi, I'm trying to pass the aggregatefunction from the dropdown menu in the Splunk dashboard to the time-series chart. for example from dropdown, I want to pass actual, Avg(), m...
There is metric which accumulative counter of some event. Timechart of this metrics look like monotonic function. I cant change metrics therefor i need to calculate derivative function - increase/d...
Hi peeps,
I need help to fine tune this query;
index=network sourcetype=ping | eval pingsuccess=case(match(ping_status, "succeeded"), Number)
Basically, I want to create a new field for ...