If there are less than 1000 distinct values, the percentiles use the nearest rank algorithm (see http://en.wikipedia.org/wiki/Percentile#Nearest_rank). Excel uses the NIST interpolated algorithm, which basically means you can get a value for a percentile that does not exist in the actual data, which is not possible for the nearest rank approach. You can ask splunk to use the excel method instead via a limits.conf setting [stats] perc_method=interpolated (vs 'nearest-rank'). See the limits.conf.spec entry for more detailed info. If there are more than 1000 distinct values for the field, the percentiles are approximated using a custom radix-tree digest based algorithm that is much faster and uses much less (a constant amount) memory than an exact computation (which uses memory in linear relation to the number of distinct values). By default this approproach limits the approximation error to < 1% of rank error. That means if you ask for e.g. 95th percentile, the number you get back is between the 94th and 96th percentile. You always get the exact percentiles even for more than 1000 distinct values by using 'exactperc' instead of 'perc' ... View more

anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous. ... View more

how many distinct uri's are you expecting to get in those 3 days? try increasing in limits.conf [stats] maxresultrows = 50000 try upping it to 500,000 and see what happens. ... View more

eventtypes are fully expanded at search parsing time, so you need not be worried that having dependence on the parent's eventtype is inefficient. It is the same as if you fully expanded the search yourself. As for your general approach, I think it's fine. We don't have any particular guidelines on how you should define a taxonomy for tags or eventtypes. Splunk has a flat namespace so it's up to you to decide a naming convention hierarchy that works well for your data. ... View more

The easiest way of doing this involves using addinfo in a subsearch. Basically, subsearches inherit the timerange of the outer search. The addinfo command will create several fields that contain the UTC earliest and latest time bounds of the search. Then you can use the subsearch to expand to different search expressions depending on the range of latest-earliest. Example: index=summary [ stats count | addinfo | eval range=info_max_time - info_min_time | eval search=if(range>((86400*7)-3600),"source=daily_summaries","source=5m_summaries") ] | timechart count by host ... View more

You can combine dedup and sort by using the 'sortby' keyword in the dedup command, e.g. dedup x sortby y Also, another caveat with dedup is that it could use unlimited memory for a high cardinality field (like some sort of unique identifier, e.g. ip address, cookie, etc) EDIT:: adding in paraphrased version of 2 other comments that steveyz made on this topic via IM: About ordering, fields should always be first. It's like pushing selection as early as possible. Things like fields, where, search, etc. Should be as early as possible There are probably scenarios where dedup first might be a little faster, but that should be the edge case ... View more

try source="/var/log/server.log" POST /heartbeat | timechart limit=10000 span=1h count by server_ip | untable _time server_ip count | search count=0 The purpose of the 'untable' is to demux your data such that you have one count per hour per server_ip, which is necessarily if you are trying to isolate host/hour combination that have no data. ... View more

./splunk show jobs <id> Also, when you spawn your search job, you could specify the search id to use via the -id option. However, you will have to make sure there are no name collisions. In addition, if you spawn your job with -detach 1 , the CLI will output the search id of the job (but not emit the results, just like if you start a background process in the shell). ... View more