...sesummaryindexing
If that is collect, I have no idea how to aggregate the maximum value in summary index data.
The summary index data are created by the following search.
"index=_internal | sitimechart span=1m c...
When using index=blah | sitimechart dc(field1) by field2 It saves every single element for field1 concatenated into a new field called psrsvd_vm_field1. For me this makes for an insanely i...
...pu_load_percent) by host
It looks like this:
When I try to use summary indexing to save this search as a report using sitimechart, the results are completely different:
index=p...
Short general question. It seems that they are just the summary index version of the normal commands. Are there any additional differences or anything else I should know about? The docs page was a li...
Hi,
i'm using splunk 6.1.1
I made this si- search and scheduled it to run "every hour" at period -1h@m to "now"
..
| where isnotnull(HAS_ERROR_TYPE)
| dedup SID1
| sitimechart span=1h c...
I don't understand why nothing is in the summary index. How can something return rows via sitimechart , but not put those rows in summary?
Here's a log sample:
04-21-2019 11:00:14.786 -0600 I...
I'm creating a summary report based on a timechart that counts the number of eventcounts for a certain transaction.
index=xpto | transaction maxspan=2m maxpause=30s fields=correlation | sitimechart...
...ike to be able to create a timechart showing me counts per sourcetype over time (or index, or host, etc.). Is this doable given how the data is being stored above, especially since I'm not using sitimechart...