About kiamco

sandeepmakkena · ‎10-07-2019

I have a similar use case hope this works for you as well. (index=A) |rename A_field_match as B_field_match | fields B_field_match | join B_field_match [ search index=B ] | table A_interesting_field_1 A_interesting_field_2 A_interesting_field_3 A_interesting_field_4 B_interesting_field_1 B_interesting_field_2 B_interesting_field_3 B_interesting_field_4 As you are using two indexes, use give as many filters as possible like source type or source and run it on a small-time range to check the results. Thanks.

kiamco · ‎10-07-2019

try something like this | your search | rex field=`some_field` "(?<=\/shop)(?<uri>[a-zA-Z-0-9.\/-]+)" | table uri

kiamco · ‎10-09-2019

no problemo, happy to help 😄

kiamco · ‎12-17-2018

Thanks for pointing that out @aholzer , I have been trying to debug this query for hours and totally forgot that it needed a (')

woodcock · ‎02-11-2019

Sure, like this: index=summary source="summary_events_2" orig_source=$source$ ms_region=$region$ ms_level=$level$ | timechart span=5m partial=f sum(count) AS count BY sourcetype | timewrap d series=short | rename *s0 AS *Today | foreach *s* [ eval <<MATCHSEG1>>d<<MATCHSEG2>> = <<MATCHSEG1>>Today - <<FIELD>>]

renjith_nair · ‎08-14-2018

@kiamco, Try this <eval token="event_token">if($click.value2$=="","*",$click.value2$)</eval> Sample dashboard with run anywhere example <dashboard> <row> <panel> <table> <search> <query>|makeresults count=5|eval event="someevenet",noevent=""</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <eval token="event_token">if($click.value2$=="","*",$click.value2$)</eval> </drilldown> </table> </panel> </row> <row> <html> <h1>This is the token value : <font color="red">$event_token$</font></h1> </html> </row> </dashboard>

renjith_nair · ‎08-14-2018

@kiamco, Alright try this, index=summary source="summary_events" orig_source=some_source ms_region=us-west-1 ms_level=E* |timechart span=5m sum(count) as count by event|eval date=strftime(_time,"%d-%m-%Y"),time=strftime(_time,"%H:%M:%S") |table time,event,count,date|eval temp=time."-".event |chart values(count) over temp by date|rex field=temp "(?<time>[^-]+)-(?<event>[^-]+)" |fields - temp

sudosplunk · ‎08-10-2018

Append this to your search | rename *_s0 as *-Today

DalJeanis · ‎08-09-2018

@kiamco - The summary index would contain the pre-summarized data. The predict could then run quickly across any length of time, and would not have to analyze the data at the event level ever again, which is what takes the majority of the CPU time.

kiamco · ‎07-19-2018

@ixixix_spl so I assuming that transaction_id is unique first query | table transcation_id | join type=left transcation_id [|search second query |table orders] something like that but it gets a bit complicated depending on the fields you want to join but try it out see if it works

SpeschLOne · ‎07-05-2018

worked like a charm; thank you!

kiamco · ‎07-03-2018

ye a this would work if applied the time token before the appendcols but unfortunately that is no the case. what I am trying to basically do is when user clicks on graph it will show the events in that specific point in time but I want the sparkline to show the trend of that event starting from 14 days before the "time_token".

kiamco · ‎06-15-2018

it works!! thanks a lot for the very detailed answer

cmerriman · ‎06-07-2018

It should take into account the "seasonality" trend since you are using LLP. Predict is generally followed by timechart, but i'm not sure what you're data looks like or what the exact output is. if you remove everything after predict and just look at the chart, can you see the predictions fluctuating as expected? if you use timechart before predict and span=1d or whatever span you need, does that change the prediction?

somesoni2 · ‎05-29-2018

High level answer would to be find which data is missing and then run your collect command to summary index it. But it would be tricky to find which data is missing considering very heavy amount of data you've. Ideally if you've a specific criteria for which you see data, you need to apply those criteria to both regular search and summary index search and get a diff.

somesoni2 · ‎05-22-2018

It seems all your events, that are fed to stats command, have no_event=null(), so when you include it in stats you get no results (trying to aggregate by something that doesn't exist). Using a string value to denote null (say NULL) in place of null() would be the way to go.

kiamco · ‎05-22-2018

yup basically just doing it for faster search and yea im searching in all sources because I might as well create a summary index that can also helped with current and future dashboards

DalJeanis · ‎04-17-2018

Start by thinking about what kind of graph you want to produce. What information is it going to transfer to the viewer? Your query produces a list of events where a field called total_waiting > 50. What is the important characteristic of those events? Is it the number of them per unit of time?

deepashri_123 · ‎04-09-2018

Hey@kiamco, For source=summary_daily_users You have splitted it by _time.This will give you hourly count of distinct users,since the summary index used earlier is hourly basis. You can try running your query like this: index=summary source="summary_users" | eval today=relative_time(now(),"@d") |eval time=strftime(today,"%d/%m/%Y %H:%M:%S") |stats dc(user_id) as user_id dc(named_user_id) as named_user_id dc(anon_user_id) as anon_user_id by time, ms_region, tenant_id, browser |collect index=summary source=summary_daily_users |sort -num(time) Let me know if this helps!!

kiamco · ‎04-05-2018

I tried this out and you almost had it but I was able to fill in the blanks. Thanks that really helped a lot

kiamco · ‎04-09-2018

| rest /services/authentication/users splunk_server=local |fields title, roles, email | rename title as user | eval roles=if(roles="admin","admin","") | eval action="need to reset password" |join type=left user [|search index=_audit (action="password change" NOT user=index-manager) |join user [| rest /services/authentication/users splunk_server=local |fields title, roles, email | rename title as user | eval roles=if(roles="admin","admin","") ] |eval timestamp= strptime(timestamp,"%m-%d-%Y") |eval check_time=if(roles="admin",relative_time(timestamp,"+30d@d"), relative_time(timestamp,"+90d@d")) |eval action=if(action="password change",if(check_time < now(),"need to reset password","password change successful"), "need to reset password") |convert ctime(*time*) ] |table user,email,roles, timestamp, check_time, action This is my final query it doesn't need a lookup and its not dependent on a lookup that I have to manually update every month or so

Posts	44
Solutions	3
Karma Given	10
Karma Received	5
Member Since	‎03-29-2018

Online Status	Offline
Date Last Visited	‎11-23-2020 01:08 PM

In a search, how would I get the difference betwee...

How do I create new columns with the foreach comma...

Is there a way to setup a condition for drilldown ...

need help with streamstats

How to rename all the fields with "s0" at the end ...

Is there a way to specify a different time range f...

how can I set a time range based on a time token

when using predict fields become null

question about predict

I need to fill missing logs in summary index

Re: How to search two Indexes based on matching fi...

Re: extract uri

Re: How to Calculate Splunk User Password Age

Re: In a search, how would I get the difference be...

Re: How do I create new columns with the foreach c...

Re: Is there a way to setup a condition for drilld...

Re: need help with streamstats

Re: How to rename all the fields with "s0" at the ...

Re: Is there a way to specify a different time ran...

Re: Equivalent of SQL WHERE IN Subquery clause?

Re: How can I identify which dashboards include a ...

Re: how can I set a time range based on a time tok...

Re: when using predict fields become null

Re: question about predict

Re: I need to fill missing logs in summary index

Re: need help with showing eval in stats

Re: Why am I only getting partial results for a su...

Re: how would I put a graph and list of events in ...

Re: number of user Daily named and anonymous users...

Re: How to get the difference between 2 queries?

Re: How to display people who have NOT changed the...

Join the Conversation