Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
07-09-2026
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
07-15-2015
07:47 AM
You can use a timechart to calculate the averages and the streamstats command to calculate a daily ratio:
...| timechart span=1d avg(msecs) AS avg
| streamstats current=f global=f window=1 latest(avg) as previous_day_avg
| eval ratio=round(avg/previous_day_avg,2)
To do it per month use:
| timechart span=1mon avg(msecs) AS avg
... View more
07-13-2015
06:37 AM
1 Karma
To use same query for different sources:
source=budapest.csv OR source=singapore.csv OR source=germany.csv | *your search...*
... View more
07-13-2015
01:24 AM
I think in practice I would need an append of 15min, I was just interested in the possibilities of these options.
Generally I try to avoid eventstats for large searches, because the search performance was very low, when I used it in the past. But I will give it a try again
... View more
07-13-2015
12:28 AM
This works fine, thanks!
Are there limits for these options or can it set them to 6 hours as well?
I used the same base search twice because I wanted to combine a new metric out of both results. This is the only way I was able to do this.
... View more
07-08-2015
08:48 AM
Hi,
My search looks like this:
base search...
| timechart span=1d dc(user_id) AS daily_customers
| timechart span=1mon avg(daily_customers) AS avg_daily_customers
| eval avg_daily_customers=round(avg_daily_customers,0)
| append [base search...
| timechart span=1mon dc(user_id) AS daily_customers]
The base search is about 14.000.000 events in both cases. The append command shows up incorrect results and I think this is caused by the maxtime and/or timeout . I tried to increase these parameters, but afterwards, nothing is appended.
| append [base search... maxtime=1800 timeout=1800
| timechart span=1mon dc(user_id) AS daily_customers]
What am I doing wrong with the append command?
BR
Heinz
... View more
07-06-2015
05:36 AM
Havbe you tried out the streamstats command?
index=xxx stats count by method, _time, status
| streamstats avg(count) As moving_average BY method, _time, status
... View more
06-26-2015
02:19 AM
2 Karma
What about the streamstats command to use it like this:
| bucket _time span=1d
| stats count as TotalMessages by _time, site
| sort 1-_time
| eval weekday=strftime(_time,"%a")
| eval today=strftime(now(), "%a")
| eval sameDay=if(today=weekday,1,0)
| search sameDay=1
| streamstats avg(TotalMessages) AS avg BY site
| streamstats current=f global=f window=1 latest(avg) as last_avg by site
| stats latest(TotalMessages) as TotalMessages, latest(last_avg) AS last_avg BY site
| eval trend=TotalMessages-last_avg
... View more
06-05-2015
02:12 AM
Yes, now all labels are available
... View more
06-05-2015
02:05 AM
Great, thanks!
... View more
06-05-2015
01:50 AM
Sure, here it is:
<panel>
<chart>
<search ref="test"></search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.placement">left</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">heatmap</option>
<option name="count">10</option>
</chart>
</panel>
... View more
06-05-2015
01:44 AM
Hi,
I've a created a bar chart, which looks fine in the saved report. After adding the report to a dashboard, the description on the y-axis is not available.
It should look like this example:
http://docs.splunk.com/File:Charts_-_bar.png
But the sendout, indexer, regexreplacement is missing in the dashboard panel
Thanks in advance
Heinz
... View more
- Tags:
- barchart
06-03-2015
07:22 AM
Same result. I tried out this as well
sourcetype=abc productname=*™*
... View more
06-03-2015
07:16 AM
I tried it out, but without success...
sourcetype=abc productname=Value™
Surprisingly I can use it in a formdashboard with dynamic checkbox options, where I do not have paste/type these values
... View more
06-03-2015
05:57 AM
Hi,
some of my field values look like this Value™. How can I achieve that these values can be used in the search syntax?
BR
Heinz
... View more
- Tags:
- syntax
05-29-2015
12:59 AM
Thanks, using these time formats is a good point!
... View more
05-28-2015
02:27 AM
Hi,
is it possible to define eventtypes or tag directly to search results, so that the selected timerange is used as well as a condition?
I think it can be done by using the this kind of search string in the eventtype manager:
sourcetype=ABC eventname=error AND _time>1432684800 AND _time<1432771200
But the described scenario above would be much easier to handle.
BR
Heinz
... View more
05-27-2015
01:32 AM
1 Karma
Is there a big difference regarding the performance between eventypes and tags?
... View more
05-18-2015
06:51 AM
Thanks for your comment, but I can't see any effect using these options. Endless scrolling to the left & right is still possible
... View more
05-11-2015
12:44 AM
To create a combined field you could use
| eval combined_field=remotehost+"_"+FS_Name
... View more
05-08-2015
07:58 AM
The search is very simple...
sourcetype=A action=B tag=C AND (field1>0 OR field2>0) AND NOT field3=xyz | stats median(field4)
... View more
05-08-2015
05:37 AM
1 Karma
Hi,
I'm calculating a median. The result is not the same when I change from fast to verbose mode... Is this expected behaviour?
BR
Heinz
... View more
05-07-2015
01:14 AM
Hi,
is it possible to cut off the worldmap in the geostats visualization, so that scrolling left or right is not possible? The goal is to have "one" worldmap.
BR
Heinz
... View more
05-07-2015
12:22 AM
thanks a lot!
... View more
05-06-2015
06:00 AM
1 Karma
How many events are searched for? I think the sort command you are using only uses 10k events.
Try this
| sort 0 _time
... View more
05-06-2015
04:34 AM
Hi,
I would like to configure the size of dashboard panels in the same row
Using <option name="height">300px</option> in the XML view works fine, but <option name="width">300px</option> has not effect.
What can I do to achieve my goal?
Thanks in advance
Heinz
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2026
07:14 AM
|
Karma given to
