Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
07-09-2026
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-26-2015
07:27 AM
Thanks for your input, I didn't know this function.
This would be a workaround as well.
...
| eval xi=round(x*i, 2)
I am just wondering about this implicit floor/ceil behaviour
... View more
10-26-2015
06:03 AM
index=shop (sourcetype=source1 OR sourcetype=source2)
| fields+ action, productId
| chart count by action, productId
... View more
10-26-2015
04:12 AM
I think I will use the normal loadjob command on a base search. The Post-process has a timeout limit that I want to avoid as possible source of errors in the dashboards.
Thanks a lot for your input
... View more
10-26-2015
04:06 AM
Hi, I'm wondering why Splunk starts rounding to the next integer in the second row.
The command behind this is just:
....
| eval xi=x*i
Best regards
Heinz
Edit:
... View more
10-23-2015
01:52 AM
Hi,
the data does not have to be up to date, latest would be @d. And they will run over night.
Currently I'm using scheduled searches for the panels. But I thought about how to increase system performance by using one of the options.
I haven't used the loadjob command before. I thought it could be a good solution, to populate the base search and then adjust the results to the different formats I need. Timecharting a result table should not be a problem regarding the maxtime of a subsearch?! And Splunk has to analyse the raw data only 1 time, instead of 6 times for every panel.
The mantenance effot of summay indexing is the reason why I always try to avoid it 🙂
... View more
10-23-2015
01:42 AM
Hey,
the timerange would be "all-time", because I want to cover the whole lifecycle. Earliest start would be in 2013.
After the timechart there would be one row per day/month/week and one column for the KPI.
I try to avoid summary indexing, because what I've read so far that it needs care & attention, to keep the results correctly (gaps, overlaps etc)
... View more
10-22-2015
12:27 AM
You could try out
source="/tmp/sendmail.txt" [search source="/tmp/sendmail.txt" from="" | fields qid | format ]| reverse
as workaround to escape the limit
... View more
10-21-2015
01:51 AM
Hi,
Let's say we have a dashboard with the following panels:
daily active users
daily active users by server
weekly active users
weekly active users by server
monthly active users
monthly active users by server
And the panels are all saved searches like this:
...
| timechart span=1*d/w/mon* dc(user_id) AS users
or
...
| timechart span=1d/w/m dc(user_id) AS users BY server_id
I'm thinking about how to optimize the performance of this dashboard.
1. Report Acceleration
Accelerate this base search (the output will be at least >3.000.000 rows)
...
| bucket span=1d _time
| stats count by _time, user_id, server_id
Create saved searches using this acceleration summary for the dashboard panels, e.g.
...
| bucket span=1d _time
| stats count by _time, user_id, server_id
| timechart span=1d dc(user_id) AS active_users
2. Loadjob
Schedule this saved search (the output will be at least >3.000.000 rows again):
...
| bucket span=1d _time
| stats count by _time, user_id, server_id
and use the results afterwards, e.g.
...
| loadjob savedsearch="user:app:mysearch"
| timechart span=1d dc(user_id) AS users
I haven't used loadjob before and am not sure whether this is intended usage. First test runs show that loadjob would be 3x faster than acceleration.
Do I have to keep in mind possible problems using acceleration or loadjob here? What would be your preferred approach?
Thanks in advance
Heinz
... View more
10-20-2015
06:45 AM
PS: limit=0 is fine in the timechart
... View more
10-20-2015
06:43 AM
There is no difference, when I remove the sort line. And I don't get how this could destroy the function.
In the end the streamstats command has to analyse a window of 14 days per user_id. After the sort line, the table is so well prepared, that I could even delete the global=false command.
... View more
10-20-2015
03:15 AM
Hi woodcock,
thanks a lot for coming back to my problem.
I think we have to do some small adjustments, then this approach shows complete & correct results:
...
| timechart span=1d count BY user_id limit=10000000
| untable _time user_id count
| sort 0 + account_id, _time
| streamstats window=14 global=false count(eval(count>0)) AS active_days BY user_id
| timechart span=1d dc(eval(if(count>0, account_id, null()))) BY active_days
The sort command should have the same effect on the results like global=false, but I hope it helps to improve the peformance of streamstats.
Is there an option that tells a timechart to set the limit=infinite ?
... View more
10-13-2015
06:18 AM
Hi,
Does the summarization start from scratch when it is updated for report acceleration? Or is it just updating "new data" that has not been summarized yet?
Thanks in advance
... View more
10-07-2015
06:21 AM
Thanks! So a lookup table that can be used by all splunk users, has to be stored in an app that is available to all users. Sharing global is not enough.
... View more
10-07-2015
05:26 AM
This subsearch works like and AND filter for all values of the field "mail" in the lookupfile.
So in this case it is only the value $MessageSender$, because of your "search mail="$MessageSender$"
index="MessageIndex" AND mail=$MessageSender$
... View more
10-07-2015
04:58 AM
Try this:
index="MessageIndex"
[| inputlookup ListOfEmails.csv
| search mail=$MessageSender$
| rename mail as query
| fields query
| head 1]
... View more
10-07-2015
01:53 AM
Hi,
does the app permission always overrule all other permissions for content created in that app?
Let's say there is a user with the role A.
The roles A and B got read permissions for saved searches, dashboards, lookups, eventtypes, field aliases etc for an app.
But in the app manager the app is only shared to the role B. Is it possible that the user can access the content somehow?
Thanks in advance
... View more
10-02-2015
05:07 AM
I think I've found a workaround. But it's veeeery expensive so I'm not really happy with it.
| bucket span=1d _time
| stats dc(account_id) AS dc by user_id_1, _time
| eventstats values(account_id) AS user_id_2
| mvexpand user_id_2
| stats count(eval(if(user_id_1=user_id_2, user_id_1, null()))) AS active BY user_id_2, _time
| sort 0 + user_id_2, _time
| streamstats window=14 global=f dc(eval(if(active=1, _time, null()))) AS active_days BY user_id_2
| search active=1
| timechart span=1d dc(user_id_2) BY active_days limit=14
... View more
09-30-2015
01:58 AM
hi,
thanks for your answer. But I think the streamstats doesn't like the "timechart BY" before. It is not adding the active_days field
... View more
09-29-2015
06:35 AM
Hi,
I would like to group the daily users by their number of active days during the last 2 weeks. My current search looks like this:
...
| bucket span=1d _time
| stats dc(user_id) AS count BY user_id, _time
| sort 0 + _time
| streamstats window=14 dc(_time) AS active_days BY user_id
| timechart span=1d dc(user_id) BY active_days
But this calculation does not include days of inactivity (because of the stats command) and ends up incorrect results.
How can I achieve my goal?
BR
Heinz
... View more
09-23-2015
02:30 AM
1 Karma
My apporach would be like this:
...
| bucket span=1d _time
| eventstats earliest(_time) AS first_login BY user
| eval day_after_first_login=(_time-first_login)/86400
| stats dc(user) AS total_users, dc(eval(if(day_after_first_login=0, user, null()))) AS users_day0, dc(eval(if(day_after_first_login=1, user, null()))) AS users_day1, dc(eval(if(day_after_first_login=2,user, null()))) AS users_day2 BY first_login
| eval first_login=strftime(first_login, "%Y-%m-%d")
| eval ratio_day0=round(users_day0/total_users, 2)
| eval ratio_day1=round(users_day1/total_users, 2)
| eval ratio_day2=round(users_day2/total_users, 2)
| fields+ first_login, ratio_day0, ratio_day1, ratio_day2
... View more
09-21-2015
04:48 AM
sounds good! 🙂
... View more
09-21-2015
04:38 AM
Your stats command above?
This should give you one total value per CPS per weekday
| chart count by CPS, weekday
... View more
09-21-2015
03:22 AM
Does this help?
| chart count by weekday, CPS
or
| chart count by CPS, weekday
... View more
09-21-2015
03:03 AM
Than this commnd should work now:
index="windows" eventtype=winregistry_windows registry_value_name=viewclient_broker_remote_ip_address registry_key_name="volatile environment" registry_value_data="*" | stats count by CPS, weekday
... View more
09-21-2015
02:55 AM
Perhaps a workaround can help:
index="windows" eventtype=winregistry_windows registry_value_name=viewclient_broker_remote_ip_address registry_key_name="volatile environment" registry_value_data="*"
| eval weekday=strftime(_time, "%A")
| table weekday
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2026
07:14 AM
|
Karma given to
