It didnt work because you didnt pass the epoch time to the search in earliest and latest . ... View more

can you try the solution i suggested below ? ... View more

You can very well do this by appending the both the lists and expand the appended list and then do a eventstats by appended list and finally see where the count < 2. Here is a sample search i wrote. Let me know if it works for you. | makeresults | eval Data="Apple,Banana,Cat,Dog:Apple,Banana,Charlie,Daniel" | eval List1=mvindex(split(Data,":"),0) | eval List2=mvindex(split(Data,":"),1) | fields List1 List2 | makemv List1 Delim="," | makemv List2 Delim="," | eval List=mvappend(List1,List2) | mvexpand List | eventstats count by List | where count<2 ... View more

Now i get you, if you want to change the time for the trendline dynamically then lookup will not be a good idea. ... View more

From what i can infer from your query , you should see results in this fashion : FUNCTION DAY1 DAY2 DAY3 DAY4 DAY5 DAY6 DAY7 Fun1 3 4 5 6 7 8 9 If you are running the search over 7 days, then how is it calculating the average . From what i see it will calculate the sum for all the values of PERCENT90 field and show you in the chart fashion. Also does source has the values DAY1 DAY2 and so on ? Can you show some sample data set ? ... View more

can he extract just the date,month,hour,minute,second from the available file name and use now() to get the current year? ... View more

Not sure if i could understand what your exact requirement is . Can you explain what you need exactly, the first search is pretty straight forward and you have already built it, show me the desired out after the second search . I tried to mimick using the dummy data, you could use the output to another search by using join or append | makeresults | eval DATA="Country;India cities;Hyderabad,Bangalore,Kerala command;common:Country;Srilanka cities;Kandy,Colombo,Galle:Country;Australia cities;Melbourne,sydney,Adelaide command;common:Country;USA cities;California,Cupertino,NewJersey:Country;UK cities;Manchester,Headingley,Edgbaston command;common:Country;china cities;Beijing,Shanghai,Tianhe" | makemv DATA delim=":" | mvexpand DATA | makemv DATA delim=" " | eval Country=mvindex(DATA,0) | eval Cities=mvindex(DATA,1) | eval Command=mvindex(DATA,2) | fields Cities Command Country _time | rex field=Cities "cities\;(?P<Cities>.*)" | makemv Cities delim="," | mvexpand Cities | rex field=Command "command\;(?P<Command>.*)" | rex field=Country "Country\;(?P<Country>.*)" | stats values(Cities) as Cities by Country | mvexpand Cities ... View more

what kind of scenarios you can think of which can stop you from using lookup. I understand using multiple looks for doing the similar things is not a good idea. ... View more

So the Computer lookup is the one which has more than 10,000 rows and inputlookup shows only 1175 ? Generally if inputlookup is not showing any data then it could be a permission issue. ... View more

We had similar problem but not in solarwinds app. for this sourcetype you can specifically define TIME_PREFIX and TIME_FORMAT in props.conf since you dont have TZ in the event itself . You can set TZ in props.conf and explicitly let Splunk know which TZ event is in . See the below link, this should help you. https://docs.splunk.com/Documentation/Splunk/7.2.1/Data/Applytimezoneoffsetstotimestamps ... View more

Can you show the sample dataset ? This type of result is possible with the use of commands like chart along with append or join but again depends on how your data is coming into Splunk. totals can be calculated using addtotals addcoltotals etc. ... View more

Does splunk create a field name gauges.service.mesosphere.marathon.leaderDuration.count similar to what it has created where it showed you the contents in the table. ... View more

Best i can tell you is to create an alert like this : your search | stats count by uri_path | append [ | inputlookup uri_path_lookup.csv | ] | eventstats count as eventcount by uri_path | fillnull count=0| where NOT ( eventcount=2 AND count=0) | where count=0 Basically you create a lookup which has all the possible uri_path and the above search will show you the uri_path where there was no events for last 20 minutes. Run this Alert search every 20 minutes cron schedule ( */20 * * * *) and look for last 20 minutes data. ... View more

You can probably create a saved search which runs every day and fetches last 30 days data and does the stats or timechart and updates a lookup which then you can use in the search which is run for last 24 hours data. The data in the lookup can server your purpose for a trendline . The benefit of doing this way is you dont have to run the search for last 30 days which will slowdown your overall search. Saved search for the lookup : index=yourindex earliest=-30d@d | timechart span=4w dc(hdr.userId) as username by user_component limit=0 | outlookup append=false lookupname.csv Your search for the dashboard : `index=yourindex earliest=-24h@h | timechart span=15m dc(hdr.userId) as username by user_component limit=0 | inputlookup append=true lookupname.csv` ... View more

Is splunk not automatically identifying the field names for you ? ... View more

Its always better to use perfmon add on to get the system level data for monitoring. ... View more

If you are not installing forwarder on that server, how are you going to bring the data to Splunk. via the remote WMI calls ? By the way we have Splunk Addon installed for wmi and below are the WQL , see if it helps : [WMI:LocalPhysicalDisk] #interval = 10 interval = 120 wql = SELECT Name, CurrentDiskQueueLength, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime FROM Win32_PerfFormattedData_PerfDisk_PhysicalDisk index = main disabled = 0 ## Memory ## Usually disabled in favor of Perfmon counters [WMI:Memory] #interval = 5 interval = 120 wql = SELECT PagesPerSec, AvailableMBytes, CommittedBytes, PercentCommittedBytesInUse FROM Win32_PerfFormattedData_PerfOS_Memory index = main disabled = 0 ... View more

I just produced a dummy search which could help you. | makeresults | eval DATA="1100,AWS101" | eval _time=now() | makemv DATA delim="," | eval InstanceID=mvindex(DATA,0) | eval InstanceName=mvindex(DATA,1) | table InstanceName InstanceID _time | append [| makeresults | eval _time=now() | eval DATA1="50,1100" | makemv DATA1 delim="," | eval cwInstanceId=mvindex(DATA1,1) | eval CPU_Util=mvindex(DATA1,0) | table cwInstanceId CPU_Util _time | rename cwInstanceId as InstanceID] | table InstanceName InstanceID CPU_Util _time | eventstats values(InstanceName) as InstanceName by InstanceID | where NOT isnull(CPU_Util) ... View more

Can you show some some sample data for both the searches, also show the append search. if possible, avoid join as best as you can 🙂 ... View more

why not using the spath to traverse to the specific field in the nested json in your case it should be some_name."my.very.nested.json.output.some.more.strings.tomakeitcomplicated"."count" ... View more

You will have to define the span in timechart for 20 minutes. And also fillnull with value=0 and then do where count=0 ... View more

I have intentionally added a gap of 2 minutes between the events to test this. ... View more

Try something like this , I am not sure what is update in your final results . I am assuming your fields correspond to : Avg=Average of count of same namespace events. Update= ? Span= duration between same namespace events. | makeresults | eval DATA="d=12/14/18 02:15:01 PM UTC namespace=Sample count=5400315,d=12/14/18 02:18:01 PM UTC namespace=HeartBeat count=5400610,d=12/14/18 02:21:01 PM UTC namespace=Sample count=5400927,d=12/14/18 02:24:01 PM UTC namespace=HeartBeat count=5400815" | makemv DATA delim="," | mvexpand DATA | rex field=DATA "namespace\=(?<namespace>\w+)\scount\=(?<count>\d+)" | table _time count namespace | streamstats count as nb | eval _time = _time + 120*nb | sort 0 namespace | table _time namespace count | streamstats count as RecordNumber by namespace reset_on_change=true | streamstats current=f last(_time) as LastTime last(RecordNumber) As previousRecord | eval change = if(RecordNumber-previousRecord!=1,"Yes","No") | eval span=case(change="No",(_time-LastTime)) | fillnull span Value=0 | eventstats avg(count) as Avg_Count by namespace ... View more

So you want something like this? namespace avg(Count) last(Update _time) duration(between the same namespace events) ... View more

If my suggestion helped you, can you mark my answer as the solution and upvote ? ... View more