Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Min1025
Min1025
New Member
Member since:
04-09-2018
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-09-2018 |
Activity Feed
- Posted Re: Question about subsearch on Splunk Search. 07-24-2018 09:46 PM
- Posted Question about subsearch on Splunk Search. 07-24-2018 02:24 AM
- Tagged Question about subsearch on Splunk Search. 07-24-2018 02:24 AM
- Tagged Question about subsearch on Splunk Search. 07-24-2018 02:24 AM
- Tagged Question about subsearch on Splunk Search. 07-24-2018 02:24 AM
- Posted Re: why can't I get 7 days of data in appendcols search? on Splunk Search. 07-12-2018 02:35 AM
- Posted Re: why can't I get 7 days of data in appendcols search? on Splunk Search. 07-02-2018 02:00 AM
- Posted Re: why can't I get 7 days of data in appendcols search? on Splunk Search. 07-02-2018 01:58 AM
- Posted Re: why can't I get 7 days of data in appendcols search? on Splunk Search. 06-29-2018 03:44 AM
- Posted why can't I get 7 days of data in appendcols search? on Splunk Search. 06-29-2018 12:43 AM
- Tagged why can't I get 7 days of data in appendcols search? on Splunk Search. 06-29-2018 12:43 AM
- Tagged why can't I get 7 days of data in appendcols search? on Splunk Search. 06-29-2018 12:43 AM
- Posted Re: How to calculate multiple fields total count? on Splunk Search. 06-19-2018 07:02 PM
- Posted How to calculate multiple fields total count? on Splunk Search. 06-19-2018 04:58 AM
- Tagged How to calculate multiple fields total count? on Splunk Search. 06-19-2018 04:58 AM
- Tagged How to calculate multiple fields total count? on Splunk Search. 06-19-2018 04:58 AM
- Posted Re: How can I get the graph that only displays percentage when using timechart? on Splunk Search. 05-08-2018 08:02 PM
- Posted How can I get the graph that only displays percentage when using timechart? on Splunk Search. 05-08-2018 01:36 AM
- Tagged How can I get the graph that only displays percentage when using timechart? on Splunk Search. 05-08-2018 01:36 AM
- Tagged How can I get the graph that only displays percentage when using timechart? on Splunk Search. 05-08-2018 01:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-24-2018
09:46 PM
Hi HiroshiSatoh,
Thank you for your answer. Maybe there is a ambiguity for my question. My question is if it possible the User range for subsearch is only for those user who have error.
In subsearch, it searched all Users' data, the results shows the "Total" for User1, User2...User8, but only User1,User2, User3 have error, I want to only search and show "Total" for User1,User2, User3 in subsearch, is it possible?
Expected results:
User errorByService ErrorCnt totalByService Total ErrorRate
User1 service1 2 service1 20 0.1
User2 service1 3 service1 24 0.125
User3 service2 5 service2 35 0.142857143
... View more
07-24-2018
02:24 AM
Hi all,
I have below query and the results like below table, is there a way that only search and display total count for the Users who have error(User1, User2, User3)?
index=aaa sourcetype=bbb |eval errorByService=case(ErrorCode=400 AND match(uri,"/service1/*"),"service1",ErrorCode=400 AND match(uri,"/service2/*"),"service2",ErrorCode=400 AND match(uri,"/service3/*"),"service3")|stats count as ErrorCnt by User errorByService
|appendcols [search index=aaa sourcetype=bbb |eval totalByService=case(match(uri,"/service1/*"),"service1",match(uri,"/service2/*"),"service2", match(uri,"/service3/*"),"service3")|stats count as Total by User totalByService] |eval ErrorRate=ErrorCnt/Total |fields User, errorByService, ErrorCnt, totalByService, Total, ErrorRate
... View more
- Tags:
- appendcols
- stats
- total
07-12-2018
02:35 AM
I found a solution for this, just need to set the maxtime and timeout | appendcols maxtime=600 timeout=600
... View more
07-02-2018
02:00 AM
Hi, I tried using strftime on _time and still see the same issue.
... View more
07-02-2018
01:58 AM
Hi woodcock,
Do you have an example for this kind of search?
... View more
06-29-2018
03:44 AM
Hi HiroshiSatoh,
I tried the sub search and could get results for 7 days(2018/6/15—2018/6/21).
Thanks,
Min
... View more
06-29-2018
12:43 AM
Hi All,
I have a search for comparing data between 2 weeks, I can get data for 7 days in first search, but only got 2 days data in appendcols search, why can't I get 7 days of data in appendcols search?
index=xxx earliest=-7d@d latest=-0d@d | eval Date1 = (date_year + "-" + date_month + "-" + date_mday)
| stats count AS SearchThisWeek by Date1
| appendcols [ search index=xxx earliest=-14d@d latest=-10d@d | eval Date2 = (date_year + "-" + date_month + "-" + date_mday) | stats count AS SearchLastWeek by Date2]
| eval SearchFluctuatePerc=(SearchThisWeek-SearchLastWeek)/ SearchLastWeek
| fields Date1, SearchThisWeek, Date2, SearchLastWeek, SearchFluctuatePerc
... View more
06-19-2018
04:58 AM
I have following fileds, I want to calculate the total f count: (count(f1)+count(f2)+count(f3)+count(f4))=3+3+2+1=9. How can I get the total result 9?
fl=1, f2=3, f3=5
f1=2, f2=2
f1=2, f2=3, f3=3, f4=1
... View more
05-08-2018
08:02 PM
Hi adonio, many thanks! It works well.
... View more
05-08-2018
01:36 AM
I have a query below that is showing "PriceChangeCount", "Total" and "PriceChangeRate" in graph, How can I get the graph that only displays the PriceChangeRate in graph?
index=xxx sourcetype=xxx|eval priceChangeCnt=case(Id=xxx,"Yes") | timechart span=1h count as Total, count(priceChangeCnt) as PriceChangeCount | eval PriceChangeRate=(PriceChangeCount/Total)*100
... View more
- Tags:
- percentage
- timechart
04-10-2018
06:28 PM
@niketnilay, Thank you, the empty columns are returning when I use eval with isnull() to replace NULL with value " ".
... View more
04-09-2018
01:40 AM
Hi all,
I have a dashboard, some fields don't have values, the empty columns are being dropped by the table in the dashboard, but when I run this query in a standalone search box, these empty columns are displaying. How can I get these empty columns returned in the dashboard as well?
For example:(This panel created with a post process)
Base search: `fieldA=<valueA> fieldB=<valueB> |fields fieldC, fieldD, fieldE, fieldF, fieldG, fieldH`
Search: `|eval field1=fieldC- fieldD |eval field2=fieldE- fieldF |eval field3=fieldG- fieldH |table field1, field2, field3`
The table in standalone search appears like:
field1 field2 field3
< value2>
The table in dashboard appears like:
field1 field2
<value1> <value2>
The empty column field3 is dropped in dashboard, how can I get this column displayed in dashboard?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
