About zacksoft

zacksoft · ‎04-10-2018

Just to be clear, _time indicates the time of the latest event that my base query produces, right? My base query produces around 20 events in a month time frame and I would like the time of the latest event only. Thank you.

zacksoft · ‎04-10-2018

My log contain some events that we call 'bonus_events'. And 'bonus_events' happen once or twice a week. I want to subtract the the current time from the time when the latest bonus_event happened. For this I want to fetch the time of the latest event. This is what I have written, host="lak1200.ramana.com" source="/apps/games/prizes-*" bonus | eval sub = now() - x x indicates the time of the latest event of base_query result.

zacksoft · ‎04-10-2018

My log contain some events that we call 'bonus_events'. And 'bonus_events' happen once or twice a week. I am calculating delta(subtracting between two consecutive 'bonus_events') and getting the result in a weird format (i.e -25705.655 etc) I want to get this weird format converted into 'days'. So that it should tell me "How many days back the last bonus_event happened?" This is what I have written, host="lak1200.ramana.com" source="/apps/games/prizes-*" bonus | delta _time AS last_bonus_event p=1 | table last_bonus_event

zacksoft · ‎04-10-2018

This helps. Thank you. The 'Delta' thing is what I was looking for. Thanks again.

zacksoft · ‎04-10-2018

It won't give any value. adding that last line is not giving any value. Nothing comes in the visualization and in the statistics tab also under avg(transfer_speed) it shows nothing. This is what I tried | base query | table transfer_speed | timechart span=1h avg(transfer_speed) It shows me transfer_speed when I give |table command. But nothing comes when I add the timechart command

zacksoft · ‎04-10-2018

I have a base query that returns the field transfer_speed . And the transfer_speed changes (keeps on changing). Sometimes it has a low value like 2 and sometimes as 150 (in kbps). | basequery | table transfer_speed I want to be able to see the transfer_speed in a graph/line chart / or any such way having x asis showing time and y axis as speed. Also is it possible to see the "rate of change" of transfer_speed at any particular point in the graph ?

zacksoft · ‎03-29-2018

PDF export is not available for visualizations using trellis layout.

zacksoft · ‎03-29-2018

I have a report that generates bar chart that shows number of good transactions. However, instead of seeing it in a dashboard , people want an alert email to be sent weekly or daily with this chart, So that they don't have to open Splunk. I have used the alerts feature before but not sure if an entire graph(visualization, like a pie chart or bar chart) can be sent !!!

zacksoft · ‎03-08-2018

I think this won't work .It is checking here if all three conditions are true. What I am looking for is received = "1" condition must be true AND Currency not equal to dollar OR Sterling OR Mac. Hope I didn't confuse

zacksoft · ‎03-08-2018

This works. Thank u. One more thing. I also want to add the condition there, show me only the rows where "received"="1" and "currency" not equal to "dollar" or "sterling" ??

zacksoft · ‎03-08-2018

| base search table amount, currency , received, time The value of 'received' field is either 0 or 1. I want my table to show rows where the value of column 'received' is '1'.

zacksoft · ‎02-08-2018

The Query's output sort of gives result like Host1 - minor Host1- minor Host1 - minor Host1 - critical I am getting multiple alerts for 'minor' type. I cannot reduce the cron frequency becasue I don't wanna miss the 'critical' errros. Can we may be only select the 'distinct values' of error or suppress if the same error is repeating ....

zacksoft · ‎02-08-2018

where can I find savedsearch.conf file ? I usually click on 'edit alert' option and set things in there !!!

zacksoft · ‎02-08-2018

I am setting up an alert for the first time. My query ends with, | table host,error where "host" is host1, host2, host3 etc.. AND "error" is severe, critical, minor ..etc and blank rows as well. Help is needed in the following two things. I want my alert email to trigger only when, 1. Host has some corresponding 'error' value .(Don't trigger when 'error' is NULL) 2. The email header should contain Host name and the corresponding 'error' message. example- "Host2 -Minor"

zacksoft · ‎02-08-2018

@493669 Thanks for your analysis. It was helpful. I'll look into it.

zacksoft · ‎02-08-2018

Thanks for the feedback. I'll look into it.

zacksoft · ‎02-08-2018

@493669 I think, if "x" were some other alphanumeric value except " _time" it might have worked. When it comes to '_time' the anomaly rises. But I could be wrong. I have applied the same logic at other instances and it have worked, But when it comes to comparing _time field it shows weirdness.

zacksoft · ‎02-08-2018

I tried this | eval mytime = round(_time) | eval mytime2= round(_time)-40 | eval x = round(_time), x2 = round(_time)-40 | eval y1=if(x=mytime,y,null()), y2=if(x2=mytime2,y,null()) | table mytime,mytime2,y1,y2 This gives me y2 value , but not the correct value. It shows me the same y2 value that of y1. I think when the condition x2=mytime2 becomes true , it is giving us the "current value of y" instead of giving the "40 sec older value of y". But I want both the current y value and 40 sec older y value .

zacksoft · ‎02-08-2018

| eval mytime = round(_time) | eval mytime2= round(_time)-40 | eval x = round(_time) | eval y1=if(x=mytime,y,null()), y2=if(x=mytime2,y,null()) | table mytime,mytime2,y1,y2 somehow x value (i.e. the current time) matches with mytime and gives y data, BUT x value doesn't match with mytime2(i.e. 40 sec previous data) and gives null. I tried changing 'mytime2' to -40, -60, -30 etc... But same result.

zacksoft · ‎02-08-2018

This worked. But only for y1. I don't see any values for y2. y2 column comes empty. And yes, y has value in it.

zacksoft · ‎02-08-2018

y's value changes based on x. and x indicates _time in real -time. I am looking to find the value of y based on two different instance of time(x) and save it in y1 and y2 respectively. y1 and y2 don't exist. I tried this | eval mytime = round(_time) | eval mytime2= round(_time)-40 | eval x = round(_time) | eval result= case(x=mytime,y1, x=mytime2,y2) | table mytime,mytime2,y1,y2 this didn't give any result

zacksoft · ‎02-08-2018

Error in 'eval' command: The arguments to the 'if' function are invalid.

zacksoft · ‎02-08-2018

I tried this and I get empty value(nothing) for y1 and y2. y1 is where I want to save y's value when it matches with mytime y2 is where I want to save y's value when it matches mytime2. This is what I tried | eval mytime = round(_time) | eval mytime2= round(_time)-40 | eval x = round(_time) | eval result= case(x=mytime,y1, x=mytime2,y2) | table mytime,mytime2,y1,y2

zacksoft · ‎02-07-2018

X | Y 1518074558| 464758 1518074559| 5757657 1518074560| 464533 1518074561| 667231 1518074562| 77654 1518074563| 00987 1518074564 | 567843 X indicates UNIX time.

zacksoft · ‎02-07-2018

I have two values x and y. Both values are dynamic (keeps on changing). x indicates _time and y indicates a value that continuosly changes with time. I want the value of y at two particular instances of x. I do this, |eval mytime = round(_time) |eval mytime2 = round(_time) - 40 I wish to have value of y when x's value is mytime and the value of y when x's value is mytime2 (i.e. 40 sec before current time) If condition only helps to get the value of y when x is mytime, but it won't help when x = mytime2. When x=mytime2 , it still gives the same value as mytime. But it shouldn't be the case.

Posts	336
Solutions	0
Karma Given	47
Karma Received	5
Member Since	‎09-13-2017

Online Status	Offline
Date Last Visited	‎06-11-2021 07:35 AM

Where is the Location of knoweldge objects in the ...

Subsearch append question !!

How to I save my search query output as a lookup ?

How do I get search start time and end time value ...

How to transpose a table? (without using Transpose...

What is the permissible field value length ?

How to match for a condition for main menu ?

How to refer to a column value ?

How to create an overview/menu dashboard?

How to open an extracted URI field through drilldo...

Re: How to fetch the time of the latest event?

How to fetch the time of the latest event?

Subtracting between two _time (And get result in ...

Re: How to make a visualization with time?

Re: How to make a visualization with time?

How to make a visualization with time?

Re: In Alert emails, can I send a Bar Chart?

In Alert emails, can I send a Bar Chart?

Re: don't show rows with specific column values

Re: don't show rows with specific column values

don't show rows with specific column values

Re: Email Alert

Re: Email Alert

Email Alert

Re: evaluation with condition

Re: evaluation with condition

Re: evaluation with condition

Re: evaluation with condition

Re: evaluation with condition

Re: evaluation with condition

Re: evaluation with condition

Re: evaluation with condition

Re: evaluation with condition

Re: evaluation with condition

evaluation with condition

Join the Conversation