I am guessing you want to find the time difference between login and security breach. Do you really need a join for this? What if I do this instead? | sort - User, - _time , - EventType that should give me for User1 _time User EventType 10:48 AM User1 SecBrch 10:49 AM User 1 Login 10:50 AM User1 SecBrch 10:54 AM User1 Login 10:55 AM User1 SecBrch 10:57 AM User1 Login Now use streamstats to get the previous _time value , eval to check if current eventtype is secbrch if yes then subtract current _time-prev _time..This is better than using a join if that is what you want... ... View more

I am guessing you want to find the time difference between login and security breach. Do you really need a join for this? What if I do this instead? | sort - User, - _time , - EventType that should give me for User1 _time User EventType 10:48 AM User1 SecBrch 10:49 AM User 1 Login 10:50 AM User1 SecBrch 10:54 AM ... View more

your _time is only monthly? ... View more

hmmm. well, it is not that kalman filter applied over your linear regression is the only thing that is working. What is means is that your linear regression dependent variables are not really dependent in the sense that you are trying to predict something like avg utilization (A+B+C) = k + n*max (A+B+C) + m * min(A+B+C)...not exactly but hope you get the drift. Hence it does not matter what the linear regression model predicts , the klaman filter LLP is enough and one is as good as the other. I do believe you need some other dependent variables from the web layer as you say, because atm your model , though mathematically correct is merely a linear slope line over the dependent variables that actually go into directly (summation) of the independent variable. That is the reason why you are getting R^2 as 1. You can still use your model , it is not wrong but think about it, do we really need a model to tell us that avg cpu utilization will dip by a factor of X , if one of the constituents CPUs have a dip? Won't it be better if we can say something like 'if X log ins in 3 of the 20-30 web servers are more THEN the total avg cpu utilization increases by a factor Y?' One more test that you can run is instead of having min. max and sum just take the avg cpu utilization of the 20-30 web servers as dependent variables and predict the overall avg cpu utilization? It might give you very similar results OR reveal a trend like if avg cpu utilization of servers, say for servers 13 , 11 and 5, an increase the total avg utilization in fact increases the overall cpu utilization more than you would expect just by applying unitary or logarithmic dependency. The coefficients of the servers will reveal the extent to which they affect the overall cpu utilization. This is a fascinating case and I am looking forward to your response. Happy ML!! ... View more

maybe this will help - https://answers.splunk.com/answers/218623/how-to-hide-panels-with-no-results-from-a-dashboar.html ... View more

in addition you can use workflow actions and alerts to GET / POST http actions as well. Remember, the REST api will poll the GET url continuously at the polling interval. Suggest read up workflow and alert actions as well, but what @sjalexander is asking is most important - if your rest api integration is not working and not fetching a SID then it could be that you have missed some configuration, are you sure you have passed the tokens / keys needed to fetch data from your GET url? Mostly all api urls will have some authentication mechanism.... ... View more

Hi, Try this, assuming X is your single value field : | eval x=if(floor(x)=x,floor(x),x) | where x!=0 | eval x=x." %" | fields _time,x Based and checked my solution on this excellent entry - https://answers.splunk.com/answers/443308/how-to-round-values-to-2-decimal-places-but-only-f.html Checked for 0 and with decimal, the solution works. Set your number format to 0.00 in the single value visualization ... View more

hi, can you share the xml piece of code where you are doing this? As it is of course , this looks perfect but it would be better to see your xml code where you are setting the range colours ... View more

why not just round off the single value field to 0 decimal places? ... View more

Try this - |eval t=strftime(_time,"%Y-%m-%d %H:%M:%S") | eval t1=strptime(t,"%Y-%m-%d %H:%M:%S") | streamstats current=false last(t1) as prevt1 | eval diff=round((prevt1-t1)*60/3600,2)| where diff >10 | table Message,Soucename,_time ... View more

Hmmm .. I am getting very curious on this case. You are predicting average cpu utilization based on max, min, sum of the SAME cpu utilization values? That could be a reason why you are receiving a R^2 value of 1. In essence you are linear regressing an independent variable, whose dependent variable(s) are the same as the independent variable..... OR The max,min,avg cpu utilization are for some different system / application which in turn is being used to predict the average cpu utilization of a new system/application. Even in this case the relation is so linear that you do not probably need a regression model.... What happens if you just use the LLP kalman filter to predict the cpu utilization, forgetting the linear regression part altogether? One note on any statistical model you use - the maths is only as right as the qualitative factors (choice of dependent variables) in your case. There are a couple o CPU utilization regression models I am currently using BUT , the factors I have chosen is something like this : cpu util = K + A(no. of log ins) + b(no. of concurrent log ins) + c (no.of stuck threads) + d(no.of calls to a particular link within the application that we knew was a major overhead)... and I found , for my case the random forest regressor to wok best ... View more

sorry not clear , you are getting a stacked chart? can you share a bit more with images what you desire and what you are getting? ... View more

you can. if your search regex is working fine you can do it at index time in props.conf.. check this out https://answers.splunk.com/answers/5960/extract-a-field-from-event-source-filename.html However, one year ago I had done something similar and well, it hit me after 6 months when a different team working on the same source wanted to extract something else AND I had already disturbed that by editing the props.conf .... it is better to do this at search time , due to performance considerations as well as keeping future needs into account. However, the call is yours and the link above already answers this, you will have to use (almost) the same regex that you are using at search time. ... View more

just one more question - the time picker is set as what? earliest , latest , preset, relative or what is the form of the time picker? ... View more

hi , you just need to use | Fields A,B,C in the order your need them to appear | Fields s_no, field1,field2 etc etc.. ... View more

hi , you just need to use | Fields A,B,C in the order your need them to appear ... View more

you are looking for row count probably. try this - | streamstats count as "S_no" ... View more

hmm so your dashboard has many panels which are being selected by a single time picker. Now, your problem is whatever value the time picker chooses , say 1 hr or 2 hr or 3 hr. it should apply to all the panels except the single value panel where we need to apply double the time to have a consistent view. So for example if I choose 1 hr from the time picker it should apply to the rest of the panels but the single value panel should actually be based on 2 hours to be consistent with the rest of the panels? Am I getting this right? ... View more

Something like this ? earliest=-2h | timechart count bins=2 | reverse | head 2 | reverse this gives me a single value hourly trend ... View more

I think like somesoni2 is saying please try to achieve the same through the stats command like he ahs shown. Join has limitations. And also in your join usage , since you did not specify a join type , the default is an innder join meaning only extid common to both searches will be considered as the 'key' fields. If you really want to go for join (I still feel somesoni's stat query will work out for you) please read the join docuementation - http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Join if you want all of the events in the main search and only those values in the subsearch have matching field values, consider using a left join. ... View more

@ankycampy - What @DalJeanis is saying is very important. If you build a linear regression model that has R^2 as high as 1 / 0.98 etc,. it should be able to explain ALL the independent variable variance, so in you case if average cpu utilization is 0.5% or 50% , you should try to have a model that fits both these values. It is better to have a model with (a bit ) low R^2 value rather than eliminate values just in order to get a high R^2 value....But if you are satisfied with your model and it is predicting well (actuals against predicted) then , you can of course disregard our 'expert' advice 🙂 ... View more

Hmm this is really unclear, you need to provide us samples of what the data in splunk looks like and what you expect? ... View more

I second Giuseppe, look closely at your CSV and splunk events, your events will be separated by a , in the splunk events, it is possible that the data input field from your CSV is having some issues. There is no way that once uploaded, the splunk index misses some while accepting some close_notes field values. Have you checked if the fields in CSV BEFORE this field in your CSV is not blank / empty for some rows in the CSV? ... View more