Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About samwatson45
samwatson45
Path Finder
Member since:
01-30-2018
06-05-2020
Community Statistics
| Posts | 56 |
| Solutions | 0 |
| Karma Given | 13 |
| Karma Received | 0 |
| Member Since | 01-30-2018 |
Activity Feed
- Karma Re: How to join two time stamps with different counts? for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How to add a flat, single value line to a graph? for niketn. 06-05-2020 12:49 AM
- Karma Re: Using two seperate inputlookups for 493669. 06-05-2020 12:49 AM
- Karma Re: Using two seperate inputlookups for elliotproebstel. 06-05-2020 12:49 AM
- Karma Re: How to find the first alphabetical value? for maciep. 06-05-2020 12:49 AM
- Karma Re: How can I get the time difference between two events? for mayurr98. 06-05-2020 12:49 AM
- Karma Re: How can I get the time difference between two events? for jlanders. 06-05-2020 12:49 AM
- Karma Re: Is there a way to use a different value as _time field? for jcoates. 06-05-2020 12:49 AM
- Karma Re: Timing multiple event actions in IIS logs for somesoni2. 06-05-2020 12:49 AM
- Karma Re: In my dashboard, can four tables be joined into one? for harishalipaka. 06-05-2020 12:49 AM
- Karma Re: How to convert values in a table column to column headers? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: How to display percentage rather than count of a field with multiple values on a timechart? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How do I concatenate two fields into a string? for ftk. 06-05-2020 12:45 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-10-2018 02:43 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-10-2018 02:38 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-06-2018 04:34 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-06-2018 03:09 AM
- Posted Re: Why are scheduled searches not working in our newly created index? on Reporting. 12-06-2018 03:09 AM
- Posted Why are scheduled searches not working in our newly created index? on Reporting. 12-06-2018 02:24 AM
- Posted Why is my scheduled Alert not throttling correctly? on Alerting. 10-08-2018 05:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-11-2018
08:48 AM
This format
2018-03-27 09:20:42.0
... View more
04-11-2018
08:48 AM
So the 31 Open is correct however there should be 26 solved tickets ( As in there is one month in which a ticket was solved, but there was no ticket opened for this month, so nothing for it to join to).
... View more
04-11-2018
07:07 AM
I have a single dataset which contains a couple of variables which are time (date) based. The format for all of them is the same.
I am interested in having a count of two different date types.
So, a bit of context, each event is a ticket which has been created in a support ticketing system. Each ticket has an associated date of creation, titled CreatedAt . For tickets that have been solved, there is a SolvedAt field, otherwise it is blank. I am interested in looking over a period of months and viewing how many were created and how many were completed in a given month, where the created and solved months are usually different.
Is there a simple way to do this? The closest I have is
source="Tickets"
| eval CreatedAt=substr(CreatedAt,1,7 )
| rename CreatedAt as time
|stats count as Open by time
| join type=outer time
[search source="Tickets" | eval SolvedAt=substr(SolvedAt,1, 7) | rename SolvedAt as time | stats count as Solved by time ]
| table time Open Solved
Where join type=outer will allow me to join on blank solved by dates to months where tickets have been created, but not the other way around.
Is there any way to do a full join where both sides can contain null values? Am I going about this the wrong way? Is there an easier solution?
... View more
04-11-2018
06:37 AM
For this I got
index=iis ((action_type=launch AND cs_method=GET ) OR (a=StartedShell)) cs_username=* customer_code=*
| eval full_user=customer_code+": "+cs_username
| eval starttime=case(action_type=launch AND cs_method=GET, _time)
| eval keyfield=full_user
| streamstats window=2 last(starttime) as starttime by key_field
| eval duration=case(a=StartedShell,_time) - startime
| where isnotnull(duration)
Where the search did not return any results
... View more
04-10-2018
01:52 AM
Hi,
I am currently trying to write a search which will accurately measure how long it takes for a customer to log in to an application. I have determined which events (within the IIS logs) signal the beginning and the end of this process. I currently have the following query, which works somewhat for what I am trying to do:
index=iis action_type=launch cs_method=GET cs_username=* customer_code=*
| eval full_user=customer_code+": "+cs_username
| stats latest(_time) as time_login by full_user
| join full_user
[ search index=iis a=StartedShell cs_username=* customer_code=*
| eval full_user=customer_code+": "+cs_username
| stats latest(_time) as time_finish by full_user ]
| eval difference=time_finish-time_login
The problem with this is that it is a certain customer, that has the same cs_username and customer_code, has multiple logins within one day then this query will only find the time difference for the latest one.
I am aware this is because I am using the latest(_time) calculation, however, I am not sure of another way to do it. I tried |eval time_login=_time and |eval time_finish=_time however then it gave me the time difference between the first login and then every completion of the login.
The issue is that IIS logs don't contain a sessionID, so there is nothing unique to each login event to distinguish them.
Is there any way to measure the amount of time for each individual login and make sure that each a=StartedShell event is linked to the correct action_type=launch event?
Many thanks.
... View more
03-23-2018
03:58 AM
Ah brilliant, I shall look into that!
Many thanks.
... View more
03-23-2018
03:01 AM
Thanks! I couldn't get that first one to work (I think it didn't join the separate events together).
With the second one, it was giving me results but I am not sure it is definitely the time difference between those two specific events, not just any two events for a username.
... View more
03-23-2018
02:58 AM
Thanks! This is really useful.
Do you know if there is any way to ensure that the second event (event_status) definitely happens after the first one (login)? And ideally, the first happening of event_status after the login event? (As it is a background process that happens fairly often, but is the way we benchmark the login finishing).
This is kind of an add-on question, so as you did answer the initial question I will accept the answer 🙂
... View more
03-23-2018
02:26 AM
What I would like to do is to return the top value of the whole set, and eventually I will be adding a filter to start by 10.7.3*, 10.7.2*, 10.6.2*, etc, so that I can find the highest value for each particular subcategory too.
The reason from this is that once I find the highest value I need a list of the values in this field less than the highest value, so that I know which ones those are (they also have an associated name field).
I have a couple of attempts at it so far but nothing has worked. For example:
base search
| dedup name sortby - _time (This just ensures that the latest version for each name is shown)
|eval first=substr(version, 1, 10)
|eval last=substr(version, 11)
| eval version2=if(len(version)=13, version, first+"0"+last)
|eventstats max(version2) as latest_release
|eval Latest=if(version2=latest_release, "Yes", "No")
| table name version Latest
This was meant to correct for the fact some of them are different lengths. So here it would turn 10.7.3043.92 into 10.7.3043.092.
Does this clarify my question somewhat?
... View more
03-22-2018
09:39 AM
Hi,
I am looking at logs in an IIS index. These are events performed by someone who is using a product that we make at the company I work at. So far, when someone logs in we have been using the (custom field) value of action=login to view this event.
In order to work out how long it takes someone to log in, we have simply been using the time_taken field for this action.
However, we have come to realize that what actually happens when someone logs in, is that the action=login starts the process, and then another log/event finishes this process, called a_action=event_status
Is it possible to find the time difference between these two events? I know they both have timestamps, which can be converted in epoch. The difference between these values is all we need, what is the easiest way to calculate this?
(However, we do get onto the issue of making sure that we are looking at the same person instance of the product. We can see this from the cs_username field. If anyone knows how to tackle this issue at the same time that would be hugely convenient, but one issue at a time will suffice for now 🙂 )
Thanks in advance!
... View more
03-22-2018
08:16 AM
Hi,
I have a field which returns values in the following format:
10.6.3319.19
10.7.2113.33
10.6.179.135
10.7.2025.200
10.6.361.425
10.7.2025.102
(As just a few examples)
There are listed as strings, not numbers (which is fine). What I would like to do is return the highest value from this field, that is the first in terms of alphabetical/alphanumeric ordering.
If I use max(field) it returns the value 10.7.3043.92, when in alphabetical order this would be 10.7.3043.328.
How do I return the first/highest value in terms of alphabetical ordering?
Many thanks in advance.
... View more
02-26-2018
03:35 AM
I have tried manipulating your query however I keep getting the same error:
Error in 'rex' command: Encountered the following error while compiling the regex '(?\w+\s\w+\s\w+\s.+)': Regex: unrecognized character after (? or (?-
(I am unable to upload an image apparently).
Does this only work in the field extraction or should it be fine just as a search?
... View more
02-23-2018
08:22 AM
Hiya,
Yup, that's what I tried however they are from the same source (as in source field).
... View more
02-22-2018
01:51 AM
Maybe because I am using essentially the same query for both A and B? That is:
eval A_time=strptime(SentToBank, "%b %d %Y %I:%M %p")
eval B_time=strptime(SentToBank,"%Y-%m-%d %H:%M:%S")
[SentToBank being the time variable I am interested in.]
... View more
02-22-2018
01:43 AM
It created one of the new field, B_time, and didn't for A. When I try to count by B_time it tells me there is one value for each time. It basically isn't giving me the results I know it should be giving.
... View more
02-20-2018
08:49 AM
I'm not sure if I have done it correctly but they are essentially not changing anything within the search results.
Also both the fields (A and B in this case) come in as the same field initially, so do I need a statement to filter them out?
... View more
02-20-2018
08:04 AM
Your search string works fine for editing individual dates however when I try to add this to the calculated fields it doesn't change the outcome of any of my other searches.
... View more
02-20-2018
03:46 AM
_time comes out in the normal format
2018-02-08
The issue is the timestamp is the time at which we collected the data from our database, and the time which we want to plot is a variable within the dataset, relating to the recorded time of the events.
... View more
02-20-2018
01:57 AM
Hi,
I am trying to create a timechart with data coming from multiple sources. There are two different formats of dates which are coming into the dataset. The two formats are:
Feb 14 2018 4:59PM
2018-01-16 09:08:50
Is there any way to set up an automation to detect the type of format the stamp is, and then convert to epoch?
Or will I have to write a bunch of if statements which convert them manually, and if so, any hints/ideas?
Many thanks.
... View more
02-07-2018
08:37 AM
Ah, I now see that I had the part of the search string entered wrongly, my mistake.
This method works great, thanks for your help 🙂
... View more
02-07-2018
07:47 AM
Mine came out in the format
file1.csv
people_name column2
A 2
B 3
file2.csv
people_name
A
B
output
people_name people_name column2
A A 2
A B 3
... View more
- « Previous
-
- 1
- 2
- Next »
