Since avg excludes nulls, you can use eval to turn 0 into null, like: ... | stats avg(eval(if(MyValue==0, null(), MyValue))) as Avg Here it's working in a toy example: | stats count | append [stats count | stats count] | stats avg(eval(if(count==0, null(), count))) as avg ... View more

This is potentially a very long discussion of the differences between Splunk, which seeks to index time-series, machine generated data, and Lucene, which was originally designed to index human-generated text documents. We can begin with your questions. Splunk has no notion of stop words. By default, Splunk indexes all keywords found in events, as defined by the segmentation rules. Splunk provides wildcard searches and phrase searches, but the index doesn't provide native proximity searches or regex searches. For those, we rely on subsequent commands in the search processing pipeline. Splunk aggressively compresses the rawdata we store, and we spend a lot of effort to make the indexes as small as possible, by means of explicit compression and other low footprint data structures. Typically, you can expect that the rawdata will be 10% the size of the original data and the indexes are 20-40% of the size of the original data, depending on entropy. Together Splunk typically requires 30-50% the size of the original raw data as storage. The index itself doesn't provide synonym support, since that's fundamentally a problem for human text. We provide an analogous concept however, in eventtypes, which can be used to represent meaningful classes of queries, including synonyms. ... View more

Your approach of using a lookup is good, but I'd suggest a scripted lookup rather than a static CSV lookup (alternately you could use a custom search command; a discussion of the differences are at http://splunk-base.splunk.com/answers/3890/pros-and-cons-external-lookup-script-vs-custom-search-command). If you were to use a lookup, the contract the script would advertise is simple, it is presented three columns corresponding to IP address, one for the number of bits and one for the CIDR address, typically with the CIDR address left blank. Its task would be to fill out that column. For simplicity, you might want to make one lookup function and 32 lookup tables in transforms.conf, each which sends the number of bits to the script, so that you only have to provide two columns. A search command could do the same thing. ... View more

This sounds like a bug. The typer is typically invoked automatically in the first search command. Do eventtypes show up properly in the search/flashtimeline view? If so, then there is probably a bug with required field propagation, which determines which fields must be extracted up front. You can fix this by adding "| fields *" or "| fields eventtype" after the first pipe to convince splunk to extract the eventtype. ... View more

Yes, you can do this using the "sort" command, supposing the processor time is in a field called % Processor Time : ... | sort - "% Processor Time" | head 1 | table host instance "% Processor Time" Now, you can make this more interesting by looking at the top per host: ... | dedup host sortby - "% Processor Time" | table host instance "% Processor Time" ... View more

You can find the single highest day by sorting by Percent, descending, and taking the first row: index=monitoring | timechart span=1d sum(done) as Success sum(try) as Attempt | eval Percent=round(Success*100/Attempt,2) | convert ctime(_time) as Date timeformat="%d %B" | fields - _time | fields Date Percent | sort - Percent | head 1 Alternately you can tag the highest row using eventstats and eval: index=monitoring | timechart span=1d sum(done) as Success sum(try) as Attempt | eval Percent=round(Success*100/Attempt,2) | convert ctime(_time) as Date timeformat="%d %B" | fields - _time | fields Date Percent | eventstats max(Percent) as max_Percent | eval is_highest = if(Percent == max_Percent, "yes", "no") ... View more

No. The "top" command is used to find the most frequent value of the field specified, here you specify 4 fields, so we return the most common combination of these four fields. You are looking for the "head" command: ... | head 1 | ... ... View more

There are two choices here. The first is to use the usenull option to timechart: index=myindex sourcetype=mylog | eval productname=case(productid==12,"Product1",productid==13,"Product2",productid==14,"Product3") | timechart count by productname usenull=f The other is to explicitly filter before timechart: index=myindex sourcetype=mylog | eval productname=case(productid==12,"Product1",productid==13,"Product2",productid==14,"Product3") | search productname=* | timechart count by productname ... View more

Since Splunk always delivers the most recent results first, and since you've set up timestamping for the events to be based on your creation timestamp, you can use streamstats and head to terminate the search as soon as it has seen more than one timestamp: ... | streamstats dc(_time) as distinct_times | head (distinct_times == 1) ... View more

This is somewhat tricky. Once the data has left timechart, the values are assigned to fields named by the values of "Accountname". We have to preprocess the data and make sure that timechart doesn't get the undesired values to begin with. ... | bin span=30m _time | stats count(TaskCategory) as TaskCategoryCount by _time, Accountname | where TaskCategoryCount < 50 | timechart span=30m sum(TaskCategoryCount) as TaskCategoryCount by Accountname ... View more