host = Mayhem sourcetype="phutans:servo" host=R00878 | eval headers=split(_raw," ") | eval plant_length=mvindex(headers,10) | sort 0 plant_length (I am trying to calculate mean plant_lenght here but in a different way) Let me put it as example : say we get 10 values of plant_length. 1, 2, 2, 3, 4, 4, 4, 5, 20 Ideally to get mean, we would do (1+2+2+3+4+4+4++5+20)/10 But I don't want it this way. What I am looking is to identify 10% of data in each tail. And then to replace them with the next available data. e.g. 1, 2, 2, 3, 4, 4, 4, 5, 20 The 10 % on each side is, 1 and 20. So the updated data set to become 2, 2, 2, 3, 4, 4, 4, 5, 5. (I just replaced the each extreme 10 % with the nearest value). And the new average should be calculated like (2+2+2+3+4+4+4++5+5)/10 Could you please guide how to achieve this. Thank you. I could use some help in implementing the above scenario. ... View more

host = Mayhem sourcetype="phutans:servo" host=R00878 | eval headers=split(_raw," ") | eval plant_length=mvindex(headers,10) | sort 0 plant_length (I am trying to calculate mean plant_lenght here but in a different way) Let me put it as example : say we get 10 values of plant_length. 1, 2, 2, 3, 4, 4, 4, 5, 20 Ideally to get mean, we would do (1+2+2+3+4+4+4++5+20)/10 But I don't want it this way. What I am looking for is to drop 10% of data in each tail and divide by number of values left. Like this : (2+2+3+4+4+4++5)/8 In the numerator here the bottom 10% data (1) and top 10% of data(20) is dropped , so we have 8 vales left, hence the denominator is 8. (In the above example as we have 10 values so 10% of 10 becomes 1. Therefore 1 value is dropped from top end and 1 value from bottom end.) And after dropping 2 values the denominator has to be 8 , not 10) I could use some help in implementing the above scenario. ... View more

BASE_SEARCH | stats count(web-calls) as web-call-count by server_response | eventstats sum(web-call-count) as total | eval percentage=round((web-call-count*100/total),2) | table server_response percentage As a result of the above query following is the output I get in the statistics tab and a column chart in visualization tab. server_respond percentage_of_web-calls 0.001 7.77 0.002 17.95 0.003 13.90 0.004 7.16 0.005 3.30 0.006 2.53 0.007 2.11 0.008 Can we create three columns in the visualization tab where column 1 showing the percentage of web-calls whose response were less than a second. column 2 showing percentage of web-calls ...whose response time between 1 to 10 sec. column 3 showing ..more than 10 sec.. ... View more

I am calculating number of web-calls that were served in certain seconds. | stats count(web-calls) as web-call-count by server_response. So, in x axis I see the seconds, and Y axis i see the number of web-calls ..in a column chart. What we are looking for is, "Can we get the percentage of web-calls instead of count in Y-axis" ? ... View more

I have two values a) The time when a breach occurs. b) The amount of memory consumed during the memory breach. I want X axis to show a) and Y axis to show b) Is is possible in Splunk to draw such chart? ... View more

I have multiple sourcetypes in my index. Lets call them st1, st2, st3, st4 & st5. I have a query that end with | table user _time << This is from st1 What I am trying to do is, Fetch the "_time" field and "user" filed (from the above query) and using them as a search parameter to look for associated events in all remaining sourcetypes (i.e. st2,st3,st4,st5). which means all the events in other sourcetypes should contain that user name OR should have the same time stamp OR in a five min time duration before and after that event . The goal here is to figure out what was happening in the system (Across all the source types) during a certain time frame. and able to visualize it at one place like a dashboard. I think of may be using subseach or localize.....But I am confused....how to begin. ... View more