Hi, I am working on building some Bayesian model in Splunk which requires non native libraries to be imported like pyMC. Has anyone tried out something like this and help me with ways to achieve this in Splunk? Also, I would like to know in which directory can I find the native libraries in PSC add-on. Splunk version 7.1.2 ML Toolkit version 3.4 PSC version 1.3 Thanks! ... View more

Hi, I want to install Splunk Mobile App. I have android version 8.1.0 and iOS version 11.3 but I am unable to find the Splunk Mobile Access app in my play store and app store. May I know if this app only supports certain versions and why I am not able to find that in my play store/app store? ... View more

Hi, I have multiple APIs in my log whose availability duration needs to be determined on daily basis i.e., from 00 to 24 hours based on active and inactive status, which means, it will have to check the status of the API from the last event of previous day to the first event of current day to check the status of that particular API. But to make any calculation on availability it will have to start the calculation only since 00 hour. Kindly help to build the query, this is how far I've managed to go. `urlendpoint` | search endpoint=* | eval Brand="xyz" | eval status=case(like(elb_status_code,"2%") OR like(elb_status_code,"3%") OR like(elb_status_code, "505") OR like(elb_status_code, "510") OR like(elb_status_code, "511"), "active", like(elb_status_code,"4%") OR like(elb_status_code,"500"), "inactive") | reverse | streamstats current=f last(_time) AS last_time last(status) AS last_status by endpoint | stats values(last_time) AS last_time values(last_status) AS last_status values(status) AS status by endpoint, _time Brand | eval active_time=case(last_status="active", _time-last_time) | eval inactive_time=case(last_status="inactive", _time-last_time) | eval day = strftime(_time, "%d") | eval month=strftime(_time, "%m") | eval Date = strftime(_time, "%d/%m/%y") | stats sum(active_time) AS active by day month Date Brand endpoint | eval active=active/(3600) | sort - month day | fields - month | fillnull value=0 Thanks! ... View more