I want calculate the row values of every column by error message... I did | Stats count(host) values(host) values(functionality) count(functionality) values (loan_num) by error_message I'm just getting host count as 90 If i run the query sperately , like.. | stats count(hostcount) by hostvalues It is showing all the values in their respective columns. Let's if the host are like hosta-20 host-30 hostc-40 so i want to fetch individual details in the same above columns by error_message ... View more

Hi everyone, Trying to find out the top 10 values from different host long_message index functionality.. So tried like index=* "error" OR "FAIL" OR "fatal"| stats values (functionality) values(correlatioid) values(loan_num) values(host) count by log_message | sort -count So it is showing top errors with functionality host loan_num details for each and every error. My requirement is i want achieve top errors count from particular host or fuctionality.. It is showing like Functionality: Abc Xyz 123 Let's say If the Abc functionality has more errors.. in the table it should give the count of Abc along with percentage among all the obtained errors.. Like this.. Functionality: Abc- 109 98% amoung Xyz - 1 1% 123 1 1% Any suggestions? Similarly i want see the top errors causing from different sources.. ... View more

Hello Everyone, I want to find duration between the events in a transaction. Let's say I have 100 events In a transaction, there is a failure at 49 th event and it is continued to 69th event so I want to calculate the difference between these two and find out how much time taken between these 20 events. Can anyone of you help me on this? ... View more

Hi Everyone, All the single value panels in the table showing as "values not found" but one panel shows "zero" in numerical with bar like if there is any value found it will show that number ex:123 . I want to make sure, this particular panel also show as "values not found" to make all the panels are behaving similar. ... View more

Hi I have error_codes like 4%, 5%, 6% So I want to calculate them by performing | stats count(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount | stats avg(eval(in(healthvalue, "'4%'","'5%'","'1%'","'8%'" ,"'12%'"))) as errorcount Any suggestions? ... View more

Hi everyone! I want to perform calculations on two-panel results. like Panel-1 value is 100, panel-2 value is 90. Now I want to perform (100-90)/100=? Formula Business SLA= (Total_transactions-successfull transaction)/100 Panel-1 Query index="main" source="access_30day.log"|transaction JSESSIONID | stats count | table count Panel-2 Query: index="main" source="access_30day.log" err enter code here or=success | transaction JSESSIONID | stats count I tried to append but values are not accurate. I'm using the base search concept here. Any suggestions? ABC <query>index="main" source="access_30day.log"|transaction JSESSIONID</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <query>index="main" source="access_30day.log"|transaction JSESSIONID | eventstats sum(event_duration) as total_duration, sum(eventcount) as total_events by JSESSIONID |eval avg_duration_pertransaction= round (total_duration/total_events)</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <panel> <single> <title>Total transactions count</title> <search base="base_query"> <query>|stats count | table count</query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0.0</option> <option name="rangeColors">["0x006d9c","0x006d9c"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> <panel> <single> <title>AVG RT</title> <search base="base_query2"> <query>|eventstats count(JSESSIONID) as total_transactions, sum(avg_duration_pertransaction) as avg_rt | eval overall_avg_rt= round(avg_rt/total_transactions)|table overall_avg_rt</query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051","0xf1813f","0xf1813f"]</option> <option name="rangeValues">[0,100]</option> <option name="refresh.display">progressbar</option> <option name="unit">ms</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> <panel> <single> <title>90Perc</title> <search base="base_query"> <query>|sort time | stats count(JSESSIONID) as b| eval a= 0.90 | eval 90perc= round(a*b)| table 90perc</query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0.0</option> <option name="rangeColors">["0x53a051","0xFF00FF"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="unit">Perc</option> <option name="useColors">1</option> </single> </panel> <panel> <single> <title>Total error count</title> <search base="base_query"> <query>|search error| stats count | table count</query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0xf1813f","0xdc4e41"]</option> <option name="rangeValues">[0,5]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> <panel> <single> <title>Total methods</title> <search base="base_query"> <query>search GET| stats count | table count</query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0xf8be34"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> <panel> <single> <title>Total methods+POST</title> <search base="base_query"> <query>search POST| stats count | table count</query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x53a051"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> <panel> <table> <title>AVG RUNTIME PER TRANSACTION - Table visualization</title> <search base="base_query2"> <query>|table JSESSIONID total_events avg_duration_pertransaction</query> </search> <option name="count">10</option> <option name="drilldown">none</option> </table> </panel> ... View more

Hii all, I have created a copy of splunk instance, in the same server for testing purpose.. in this new splunk we will upgrade the version n check if the apps are working fine or not... I copied some of the apps from old one to new splunk.. but here the issue is when i run ./splunk stop.. it only stopping SPLUNKWEB and SPLUNKD is running... But when i check it splunkweb is also running... I don't whats happening... Can as anybody tell me how to stop splunkd n splunkweb at a time?? Can you guys Guess my situation?? ... View more

Hii Everyone, I want to move all the knowledge objects and everything from one splunk instance to another instance... Simply mirroring of splunk to another machine. The new instance should act as old instance in a different machine.. I have already installed one Splunk in new machine now I want to copy everything from another machine to this new machine... How can I copy everything in a single shot? ... View more

Hello everyone!! We are currently running at 6.0.1 of Splunk version and using SearchHead Pooling mechanism.. We want to upgrade to 7.2.1v. So first we planned to upgrade to 6.6.1 then 7.2.1v... So can I get any inputs on this upgradation? (Like is that okay or anything) Which component should be upgraded first?? And what is the sequence? We are currently using 16Gb ram and ordered 32Gb RAM for SH, Indexer, so is that sufficient?? Is there any separate process for SH, INDEXER POOLING?? ... View more

Hello everyone, I have created some fields A, B, C but now I want to combine the fields, Ex: I have created fields like A B C now I want to create a new field which combine two fields.. EX D= A+B or D=A+B+C When I click on new field D which show combination of two fields.. ( D = "A" + "B" ) Can anyone help me on this? ... View more