I have a search that returns a large number of series of data to be displayed/analyzed easily. These series show three distinct patterns: Flat at beginning, rugged after some time. Irregular throughout. Zero (flat) at beginning, rugged after some time. I want to then search according to each pattern. This falls into pattern recognition, but for my purposes, a simple method to identify the flat beginning is good enough. In other words, I only need to "search those with flat beginning greater than 11", "search those with flat beginning of 0", and "search those that are neither." Is there a simple method to do this? ... View more

When I try to use a macro in place of a group of filters in a saved search, Splunk gives me "Encountered the following error while trying to update: In handler 'savedsearch': `macro-name`," where macro-name is a string with a literal dash ( - ). I am nearly certain that I've seen saved searches containing macros. I first tried to save from "Edit -> Open in search -> Save". There, the "full" version and the version with macro are tested to have the correct syntax as well as desired result. After getting the error, I went directly in "Settings -> ..." to edit. But upon "Save", it gives the same error. In addition to having a literal dash in macro name, another possible singularity is the use of an argument (as required by the macro). ... View more

Say, I have a series of jobs involving a certain number of members, _time MemberCount JobRunTime (min) JobName 01:00:00 100 15 Job1 01:05:00 200 30 Job2 01:15:00 300 50 Job3 01:30:00 80 10 Job4 I want to show that during the first 5 minutes, total number of members is 100, between 5 and 15 minutes, total is 300 (100+200), between 15 and 30 minutes, total is 500 (300 + 300 - 100), between 30 and 35 minutes, total is 580 (500 + 80), between 35 and 40 minutes, total is 380 (580 - 200), between 40 and 75 minutes, total is 300 (380 - 80), and so on. So this is like the task of calculating concurrency, but instead of mere concurrency of events, I want concurrent total of a field value. The closest I have got is [ original search] | appendpipe [ eval _time=_time + JobRunTime*60 ] | timechart max(MemberCount) by JobName This will give me an "ending" event for each job start time, so I can connect the two dots as a straight line, and see that it overlaps with some other lines on time axis. What I want is a column chart (or area chart as resolution increases) that stacks Job1's MemberCount on top of Job2's when it starts, and so on. How do I do that? ... View more

I have a large set of logs and two sets of mutually exclusive criteria, one signifies beginning and progression of an "event", the other signifies the end of the event, linked by a unique identifier. I can use any of three approaches to extract the duration of the event: (Criteria1 OR Criteria2) | stats latest(_time) as end earliest(_time) as begin by EventId | eval duration=end-begin (Criteria1 OR Criteria2) | transaction EventId Criteria1 | stats earliest(_time) as begin by EventId | join EventId [search Criteria2 | stats latest(_time) as end by EventId] | eval duration=end-begin Which method is more speedy/less taxing? Is there a speedier method? I have learned to avoid transaction, so I used method 1 with Criteria1 alone, before discovering Criteria2, i.e., Criteria1 | stats latest(_time) as end earliest(_time) as begin by EventId | eval duration=end-begin . When I added Criteria2, the search slowed to a screech. That was when I started to contend with method 3. Because the observation that adding an "OR" criteria drastically slows down search is anecdotal and because apparent speed in Splunk is affected greatly by cache hit, I want to have a realistic assessment about efficiency. (Obviously I had done searches with only Criteria1 on the same data set before noticing slowdown when Criteria2 was added.) Also note that the actual output is more than just duration - I want to preserve event start time, for example. ... View more

field=value earliest=-7d@d latest=@d When there are many events in these 7 days, I can use earliest(_time) and latest(_time) (or if I'm lucky with data, even last(_time), first(_time)) to determine the time range, thereby determine frequency. But when events are sparse, these functions differ too much from the specified earliest and latest time boundaries. I initially thought _span was available in stats, but it is not. How can I access the time range in stats? ... View more