Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About snoobzilla
snoobzilla
Builder
Member since:
04-07-2014
06-05-2020
Community Statistics
| Posts | 162 |
| Solutions | 16 |
| Karma Given | 41 |
| Karma Received | 33 |
| Member Since | 04-07-2014 |
Activity Feed
- Got Karma for Re: How to get results to load with a time picker setting other than "All Time" for saved search results loaded via loadjob?. 04-08-2024 12:49 AM
- Got Karma for Re: Is it better to use loadjob or scheduled saved search to improve dashboard performance?. 05-20-2021 11:00 AM
- Got Karma for Re: Is it better to use loadjob or scheduled saved search to improve dashboard performance?. 05-20-2021 11:00 AM
- Karma Re: Why is setting a token from result not working? for woodcock. 06-05-2020 12:48 AM
- Karma timeline custom visualization - Increase the width of labels in left (resource_field) for sarthakb. 06-05-2020 12:48 AM
- Karma Re: Is the Transaction command suitable for large volumes of data and what is the benefit of using this command? for niketn. 06-05-2020 12:48 AM
- Karma Re: Is the Transaction command suitable for large volumes of data and what is the benefit of using this command? for nabeel652. 06-05-2020 12:48 AM
- Karma Re: Using Lookup Table for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Timeline - Custom Visualization: How to hide the legend? for dmaislin_splunk. 06-05-2020 12:48 AM
- Karma Re: Timeline - Custom Visualization: Additional fields can be added to the query, but where are these values shown in the visualization? for frobinson_splun. 06-05-2020 12:48 AM
- Karma Re: Delete Command Permissions - Specific Index for dturnbull_splun. 06-05-2020 12:48 AM
- Karma Re: Email Alert Subject Stuck - Splunk 6.3 - Splunk Alert: $searchname$ for woodcock. 06-05-2020 12:48 AM
- Karma Re: Why am I unable to extract all fields from a JSON event? for javiergn. 06-05-2020 12:48 AM
- Karma Re: Why does having multiple values for mvlist produce unexpected results for my transaction search? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Why is setting a token from result not working? for niketn. 06-05-2020 12:48 AM
- Karma Re: Why is setting a token from result not working? for niketn. 06-05-2020 12:48 AM
- Karma Re: Timeline - Custom Visualization: Is it possible to have a floating legend when there are a lot of entries I have to scroll through? for frobinson_splun. 06-05-2020 12:48 AM
- Karma Re: Why is setting a token from result not working? for niketn. 06-05-2020 12:48 AM
- Karma Re: Why is setting a token from result not working? for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Custom Eval Command or Custom Search Command as Calculated Field?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
01-05-2017
04:36 AM
I am guessing that the issue here is something to do with multivalue fields.
A couple of options come to mind, do eventstats first...
| eventstats last(colA) as last_colA, last(colB) as last_colB by keyfield
| transaction keyfield
| table colA, colB, last_colA, last_colB, keyfield
That said transaction and eventstats is REALLY REALLY inefficient. I would suggest eliminating transaction command altogether because it can be a monster resource hog and yield incomplete results when used for high volume searches. Eventstats is pretty brutal too.
Alternatives...
| stats list(colA) AS colA last(colA) as last_colA list(colB) AS colB last(colB) as last_colB by keyfield
OR
| stats list(colA) AS colA list(colB) AS colB by keyfield
| eval last_colA=mvindex(colA,-1)
| eval last_colB=mvindex(colB,-1)
Let me know if this works and relative performance.
... View more
12-20-2016
04:32 AM
2 Karma
Nick from Sideview did a great presentation on use of stats...
http://conf.splunk.com/sessions/2016-sessions.html#search=Let%20Stats%20Sort%20Them%20Out&
... View more
12-14-2016
03:27 PM
You had a Time field in the table, was assuming you would append what I posted onto your query.
Are the IDs unique or do they repeat? Whats max response time? How many events would you search over... if only a few thousand transaction could be a good fit.
... View more
12-14-2016
01:50 PM
| eval starttime=if(INFO="Inbound Message", Time, null())
| eval endtime=if(INFO="Outbound Message", Time, null()
| stats values(starttime) AS starttime values(endtime) AS endtime values(ResponseTime) by ID
Above should get you close.
... View more
12-14-2016
06:01 AM
Would this work?
index=log sourcetype=data TYPE="PLATFORM" | timechart span=1d count(QP) sum(QP) AS Total by AREA limit=100
... View more
12-12-2016
08:07 AM
Are the extractions it has no effect on working eventually?
... View more
12-12-2016
07:29 AM
1 Karma
Don't know direct answer to your question. I do know that adding | extract reload=true to your searches will force reload at search time which is helpful if the problem statement is troubleshooting field extractions.
... View more
12-12-2016
04:54 AM
Can you add eval/case statements that allow you to do stats2 and stats3 at the same time as you do stats 1?
There was a great presentation on this at .conf2016 by Nick from Sideview. May be worth a look.
https://conf.splunk.com/sessions/2016-sessions.html#search=Let%20Stats%20Sort%20Them%20Out%3A%20Building%20Complex%20Result%20Sets%20That%20Use%20Multiple%20Source%20Types&
... View more
12-11-2016
06:50 PM
Have you tried creating up a lookup definition in the target app against the global lookup table? Then at least it same underlying file and you won't have maintain 2 copies of the data.
I have had good luck on global lookups by creating them using the outputlookup command. If above doesn't work, try making a copy of table using outputlookup and point a lookup definition from each app at the new file.
... View more
12-02-2016
11:46 AM
Following. I asked same question awhile ago...
https://answers.splunk.com/answers/389370/is-there-a-way-to-add-html-markup-and-hyperlinks-t.html
... View more
12-02-2016
11:43 AM
Sparkline is looking for _time in events stream...
If data is already preformatted to week you will need to convert week to time I think.
| eval _time=somethingthatconvertsweekstotime
https://answers.splunk.com/answers/179794/how-to-convert-week-of-year-number-to-a-standard-d.html
After you convert weeks to _time above, below should work.
| stats sparkline(sum(num_of_alert)) AS trend sum(num_of_alert) AS total_alert by index
... View more
12-02-2016
11:33 AM
You might want to look into the Machine Learning Tool Kit and TF IDF. I am not familiar with this tool yet... but it sounds like where you are headed based on docs and machine learning course I am taking.
https://docs.splunk.com/Documentation/MLApp/2.0.0/User/Algorithms
... View more
12-02-2016
05:11 AM
Bummer. You may be right, may be a limitation.
Assume you saw this... https://answers.splunk.com/answers/133561/multiple-key-value-pair-extraction.html
Good luck.
... View more
12-02-2016
04:55 AM
Or maybe
(\w+?)\(.+\)=([^\(].*?)[\n|\r]
... View more
12-02-2016
04:54 AM
Did you try method above with your rex without named capturing groups at all?... e.g.
(\w+)\(.+\)=([^\(].*)[\n|\r]
Note the Format field in transform: $1::$2
... View more
12-02-2016
03:25 AM
1 Karma
Yes, I have done this, not with a variable delimiter, but I think a field transform will work.
I used this for logs with ]:[ key-value delimiter and ] [ as pair delimiter, e.g. [KEY1]:[VALUE1] [KEY2]:[VALUE2] [KEY3.....
From webui for example above...
Create Transform...
Fields-->Field Transformations--New
Regular Expression: \[([a-zA-Z0-9_]*?)\]\:\[([^\]]*?)\]
Source Key: _raw
Format: $1::$2
Create Extract
Then create new field extract, choose Type of transform, and point to the transform you created.
Tip: use regex101.com or equivalent to test your regex... it will work there and in transform but I get errors using this inline.
... View more
12-01-2016
01:13 PM
It looks like you are tyring to join multiple tickets on same row without common field. Assuming you meant to be joining same ticket... e.g.
Datamodel -> RowNumber,TicketNo,Ticket_Status,Owner,Date
Event#1 -> 1,INC10001,Assigned,GroupA,12-01-2016
Event#2 -> 2,INC10001,Resolved,GroupB,12-02-2016
This stats command
| stats last(Ticket_Status) AS Current_Status list(Ticket_Status) AS Ticket_Statuses list(Owner) AS Owners list(Date) AS Dates by TicketNo
Should yield... sorry for alignment here, but plurals will be multi value fields with single cell in table.
TicketNo Current_Status Ticket_Statuses Owners Dates
INC10001 Resolved Assigned GroupA 12-01-2016
Resolved GroupB 12-02-2016
... View more
12-01-2016
12:56 PM
You need to do this using a field transform and reference that transform in a field extraction. I can get these working on regex101.com but have not had luck using them inline.
See https://answers.splunk.com/answers/126754/transforms-field-value-extract-not-fully-working.html
... View more
12-01-2016
12:41 PM
Splunk is tricky with both _time and timechart command. Something like the following may be closer to mark.
index=wineventlog sourcetype="WinEventLog:Security" "username"
| stats min(_time) AS Logon max(_time) AS Logoff min(_time) AS _time by username date_mday date_year
| eval HOURS_WORKED=(Logoff-Logon)/(60*60)
| timechart span=1d HOURS_WORKED by username
Note assuming username field is extracted. date_mday date_year are being used to isolate days without touching _time field. Keeping min(_time) AS _time allows timechart command to plot on correct day without a lot of work.
Not tested but should be close. Good luck.
... View more
12-01-2016
12:29 PM
Not clear what you are trying to join on.
If you are trying to do an SPL join where the subsearch is part of search restrictions...
index=w x y [ search find_z's | stats count by z | table z ] | massage data
Above primary search would be restricted to values of z found by search in brackets.
I question whether above is possible with search with leading |
Alternatively...
index=w x y z
| stats count by x y z
| join type=left z [ another search returning z and a b c | stats count AS count2 by a b c z ]
Would yield x y z count a b c count2
... View more
11-30-2016
03:21 PM
I noticed that they have added options to pivot table filters. One that may fit here is "is in the list" which matches to a comma separated list. You can also use contains.
The option I ended up going with in many cases is learning | tstats syntax then you can do OR. Inspect a filtered pivot search and look for tstats... then probably change prestats to false, rename node.* as *, and you are off.
... View more
11-18-2016
05:21 AM
I was asking specifically about the Timeline - Custom Visualization. Are you testing from that visualization?
https://splunkbase.splunk.com/app/3120/
... View more
11-17-2016
10:15 AM
Thanks, I had checked that but not mentions above...
click.name and click.name2 both give literal "_time"
click.value and click.value2 both give epoch time
... View more
11-17-2016
09:12 AM
1 Karma
Getting some great use out of this visualization. Trying to figure out options/tokens and to control drilldown...
How can get row label as token value when I click on row label?
How can get legend as token value when I click on legend?
How do turn on/off drilldown for cell/row/legend?
Do you have any additional documentation?
What I have figured out so far...
click.name and click.name2 appear to be _time
row.field works from data points only on first field in results only so far
e.g. where end of search is this
| table _time inc_number TYPE
This works
<drilldown target="_blank">
<link>https://mylink&sysparm_mi=$row.inc_number$</link>
</drilldown>
This doesn't pick up TYPE
<drilldown target="_blank">
<link>https://mylink&sysparm_mi=$row.TYPE$</link>
</drilldown>
Thanks in advance for assistance.
Ian
... View more
