Hi All, I'm playing around with data models at the moment and I came across this strange issue. This is similar to my query Base search | pivot Data_Model Outbound max(value) AS "value" SPLITROW hostname AS "hostname" SPLITROW _time AS "_time" PERIOD minute SPLITROW group AS "group" SPLITROW metric AS "metric" FILTER metric is *myfilter* SORT 100 hostname Post Process | streamstats current=t global=f window=2 earliest(value) as curr, latest(value) as next, earliest(_time) as currTime, latest(_time) as nextTime by hostname, metric, group | eval timeDiff=nextTime-currTime | eval curr=if(timeDiff>600,NULL,curr) | eval curr=if(next<curr, NULL, curr) | eval delta=next-curr | eval Gigabits=(delta*8/1000/1000/1000) | eval Gigabits=if(Gigabits > 10000, NULL, Gigabits) | eval Gigabits_per_second=Gigabits/timeDiff | stats max(Gigabits_per_second) by group So there seems to be a problem with using the stats command in this way. Everytime I run it, I initially get 5 rows returned, but as the search progresses, the search rows drop. So, I'll start with 10 rows, and then it will drop to 5 rows, and by the end of the search, I will only have 1 row. Replacing the stats command with a table Gigabits_per_second, group I'm thought the problem might be with the streamstats command but as I can get the correct values when using a table command, seems to rule that out. Anyone seen this issue before? Thanks Steve ... View more

Hi All, I'm passing a parameter through the URL and using URLLoader to pick up the data. eg www.mywebsite.com/dashboard1?Units=Gbps Using URLLoader, I can grab the Units value and use it the HTML components of my page. However, when I try to use that same metric in the "secondaryAxisTitle.text " parameter in the Sideview HiddenChartFormatter, I get the literal text. eg $Units$ Is this a limitation of the module, or am I just using it wrong? Cheers, Steve ... View more

Hi all, I'm running a query and the results are taking too long to appear, so I was wondering if you can help me out. I've got a set of events that start and stop based on a transaction. eg. user1 - starts event = 0 user1 - ends There's a bit more to it, but essentially that is it. So i run the transaction command to grab the 3 events and pump out the username into a file. This part works fine. I then use the input lookup file and get the usernames to run a query using the map command. |inputlookup mylookupfile |map search="search index=myindex process=ProcessType |transaction myusername startswith=\"starts\" endswith=\"end\" |where event=1 and username=$usernameFromLookupFile$" My understanding is that map will iteratively go through the values in the inputlookup file and run the query. I know it's very heavy, but are there any alternatives for what I want to do ? The inputlookup file contains approximately 10000 usernames. Thanks in advance, Steve ... View more

Hi, I was playing around with DB connect and it is quite cool. However, when I was trying to make a dashboard out of some tables, I couldn't work out how to pass the values out of the original query. In the simplest example : - | dbquery orcl limit=1000 "select count(*) as myValue from tableA" |table myValue appears to give me a blank value. Although if I leave out everything after the first pipe, it does work. I also plan to use SideView utils to build some dashboards and will I be able to pass values from the query to other modules? Thanks in advance. Cheers, Steve ... View more

Hi All, I'm having some trouble trying to populate a search bar with details from a chart. I've looked at http://splunk-base.splunk.com/answers/63886/i-just-need-to-see-a-simple-example-of-using-clickvalue-where-my-summary-chart-can-be-used-to-drill-down-to-raw-events However, when I use the click.searchTerms parameter it doesnt' seem to work. My page does appear but the search field is not populated. Here's an excerpt of my code <param name="html">Login Details</param> <module name="Search"> <param name="search">host=example *example2* $ABC$ |rex field=_raw "Auth: (?<authentication>[^\(|\:]*)"|rex mode=sed field=authentication "s/\s*$$//g" | timechart count(authentication) by authentication |fields - NULL</param> <module name="JobProgressIndicator"> <module name="HiddenChartFormatter"> <param name="primaryAxisTitle.text">Time</param> <param name="chart">column</param> <param name="charting.layout.splitSeries">True</param> <param name="chartTitle">Login Details</param> <module name="FlashChart"> <param name="height">400px</param> <module name="Redirector"> <param name="url">flashtimeline</param> <param name="popup">True</param> <param name="arg.q">search $click.searchTerms$</param> </module> </module> </module> </module> </module> Can anyone offer any advice? Thanks, Steve ... View more