Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About hylam
hylam
Contributor
Member since:
08-08-2012
06-05-2020
Community Statistics
| Posts | 123 |
| Solutions | 2 |
| Karma Given | 59 |
| Karma Received | 25 |
| Member Since | 08-08-2012 |
Activity Feed
- Got Karma for Re: How to assign colors to slices of a pie chart on a dashboard when the number of slices vary?. 04-05-2022 04:01 AM
- Got Karma for List common substrings of at least 5 stations in a subway travel history of users. 09-25-2020 04:34 AM
- Got Karma for Re: List common substrings of at least 5 stations in a subway travel history of users. 09-25-2020 04:34 AM
- Karma Re: How do I improve the performance my dashboard load times for a large amount of data? for aljohnson_splun. 06-05-2020 12:47 AM
- Karma Re: (makecontinuous 2D x=0-9 y=0-9) Are there any built-in commands to support this? for Richfez. 06-05-2020 12:47 AM
- Karma Re: Splunk App for Web Analytics: Can I generate lookups while historical data is being loaded? for jbjerke_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunk App for Web Analytics: Dollar signs and dates found in the list of mobile devices for jbjerke_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunk App for Web Analytics: sizing guide plz? for jbjerke_splunk. 06-05-2020 12:47 AM
- Karma Re: How do I convert "3 days 5 hrs 40 min 11 sec" to seconds? for kurdbahr. 06-05-2020 12:47 AM
- Karma Re: List common substrings of at least 5 stations in a subway travel history of users for Richfez. 06-05-2020 12:47 AM
- Karma Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective? for krish3. 06-05-2020 12:47 AM
- Karma Re: Can map visualizations' latitude, longitude, and zoom respond and adapt to the resultset returned, or on click of a button for a certain region?? for mporath_splunk. 06-05-2020 12:47 AM
- Karma Re: Can I change the IP address of a single node splunk deployment? for teunlaan. 06-05-2020 12:47 AM
- Karma Is there a programmatic method to list and analyze which objects/resources (indexes, macros, lookups) are used by scheduled searches? for Olli1919. 06-05-2020 12:47 AM
- Karma Re: Is there a programmatic method to list and analyze which objects/resources (indexes, macros, lookups) are used by scheduled searches? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How can I place a search bar above a sankey chart? for MuS. 06-05-2020 12:47 AM
- Karma Join command for big data for amit97ee354. 06-05-2020 12:47 AM
- Karma Re: How many custom shapes does choropleth map support? for mporath_splunk. 06-05-2020 12:47 AM
- Karma Re: Why cant I find the Timewrap app in the "Find more apps" screen? for MuS. 06-05-2020 12:47 AM
- Karma Re: Generate lookups took too long to run for jbjerke_splunk. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
11-13-2015
06:20 AM
One way is to loop thru 0-99 and mod. Are there any built-in command to support this?
EDIT1
use case: I want to fill the missing cells
| makeresults count=100 | streamstats current=f count | eval row=floor(count/10) | eval col=count%10 | chart sum(count) by row col
... View more
- Tags:
- makecontinuous
11-13-2015
05:01 AM
1 Karma
Can I make this happen automatically? I know I can do it with the rex search command.
eval newField=sed(oldField, "s/aa/bb/g")
... View more
11-12-2015
08:23 PM
I know how to install from timewrap_24.tgz. Why can't I get it from "Find more apps"?
... View more
11-12-2015
07:54 PM
I clicked "Top left black Apps" > "Find more apps", then typed "timewrap", but I have got zero results.
... View more
11-12-2015
04:50 AM
Create these accelerated reports, then rollup by "| stats dc(cookie)" over the time range in the time picker
[cookieMinute]
search = sourcetype=iis | bucket span=1m _time | stats count by _time cookie
[cookieHour]
search = sourcetype=iis | bucket span=1h _time | stats count by _time cookie
[cookieDay]
search = sourcetype=iis | bucket span=1d _time | stats count by _time cookie
[cookieWeek]
search = sourcetype=iis | bucket span=1w _time | stats count by _time cookie
... View more
11-11-2015
03:34 AM
What wrong with the "and col=9"?
heatmap overlay failed
| gentimes start="1/1/2000" end="1/2/2000" increment=1s | head 400 | streamstats current=f count | eval row=floor(count/20) | eval col=count%20 | eval value=0 | eval value=value+if(row=9 and col=9, random()%200, 0) | table col row value | eval row="row"+substr("0"+row, -2, 2) | eval col="col"+substr("0"+col, -2, 2) | chart limit=20 sum(value) by row col | fields - row
heatmap overlay succeeded
| gentimes start="1/1/2000" end="1/2/2000" increment=1s | head 400 | streamstats current=f count | eval row=floor(count/20) | eval col=count%20 | eval value=0 | eval value=value+if(row=9, random()%200, 0) | table col row value | eval row="row"+substr("0"+row, -2, 2) | eval col="col"+substr("0"+col, -2, 2) | chart limit=20 sum(value) by row col | fields - row
... View more
11-01-2015
09:22 AM
The slowly changing dimension should not work under a lot of cases.
... View more
10-31-2015
03:54 AM
2 Karma
http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/
http://dev.splunk.com/view/SP-CAAAEY7
Is KV store better than state CSV when I need high availability? The scheduled search that updates the state CSV may run anywhere within the Search Head Cluster depending on the scheduler and captain's assignment. Are state CSV files replicated in an SHC?
... View more
10-31-2015
03:32 AM
How about keeping a slowly changing dimension csv?
firstSeenTime,lastSeenTime,cookie
http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/
... View more
10-30-2015
09:16 AM
will a summary index holding these work? i will then rollup
minute sum, hour sum, day sum, week sum, month sum, year sum
... View more
10-30-2015
08:16 AM
dc(cookie) from indexed data also took 7 min.
... View more
10-30-2015
07:27 AM
"visitor-hours" and "visitors" are different. 24 visitor-hours ! = 24 visitors
... View more
10-29-2015
07:52 PM
Will it be any faster if I use minimal number of fields in a data model?
... View more
10-29-2015
08:01 AM
using accelerated data model directly
dc(cookie) on 1 sec of data - instant
dc(cookie) on 1 hr of data - 3 min
dc(cookie) on 1.5 hr of data - i ran out of patience
dc(cookie) all time - didnt even attempt
computing hour,cookie,count then dedup
dc(cookie) on all time - i ran out of patience
computing minute,cookie,count then dedup consecutive=true
dc(cookie) on all time - 7 minutes
all time = 14 days
What kind of data structures are these?
accelerated data model
tsidx
How can I do a quick estimate?
https://www.google.com/search?q=distinct+value+estimation
... View more
10-29-2015
07:00 AM
Indexed data do not have primary key. If you have some kind of hash like sha256 that is randomly distributed at index time, you can randomize the string prefix in a search.
If you do not have such hash at index time, you can create a data model an add such a calculated field, and then apply sampling to the data model.
A general strategy is to write some evenly/randomly distributed key with high cardinality, then do a prefix search on a random string. The _time field already creates 86400 partitions everyday.
... View more
10-27-2015
05:31 PM
The cookies have a 1 year life time. If I set the query time range to 1 year it should saturate parallel sort merge uniq on any cluster that I can afford. Even C++ may not be fast enough.
I have seen some splunk apps that appends new distinct keys to a csv file every 5 to 10 min. How can I write that?
... View more
10-27-2015
05:11 PM
It is running single core cpu bound on splunk 6.3. I am using the auto (750 MB) bucket size. I think inter-bucket parallelization is possible. Not the 10 GB auto_high_volume bucket size. Simply adding the dc(cookie) hourly would count a 24 hour long session 24 times in the worst case. How can I run a parallel sort merge uniq in splunk?
... View more
10-27-2015
04:58 PM
Does this scale out as you said 3 days ago?
https://answers.splunk.com/answers/320179/data-model-split-row-1m-limit.html#comment-320182
... View more
10-27-2015
04:51 PM
In shell script I can probably do parallel sort merge in O(n log n) time w/ linear speedup by adding CPU cores. Can I parallelize this query in Splunk? The hash of cookies should work as the key for the parallel mapreduce operation.
... View more
10-27-2015
08:00 AM
Where are these options on the Predict Numeric Fields GUI? They are arguments to the fit command. Thx.
LinearRegression, LogisticRegression, SVM, PCA, KMeans, DBSCAN
... View more
10-26-2015
11:51 PM
17 GB IIS log files, 2.5 GB 100% accelerated data model. 16 cores 8 GB RAM with 2 GB RAM free. The pivot was single-core cpu-bound. Disk activity is minimal. Any idea? Thx.
... View more
10-26-2015
09:15 AM
Are there any line numbers in splunk? Can a splunk search grep for "field[1-3]" and "field[4-7]" and expand a subsearch to "4"?
... View more
10-26-2015
08:39 AM
your suggestion should work on fixed number of lines. i have edited the question. thx
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
