Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About Min1025
Min1025
Explorer
Member since:
04-09-2018
09-26-2024
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 04-09-2018 |
Activity Feed
- Posted Re: Comparing data from 2 days by data type? on Splunk Search. 03-30-2023 03:31 AM
- Karma Re: Comparing data from 2 days by data type for gcusello. 03-30-2023 03:24 AM
- Posted Re: Comparing data from 2 days by data type on Splunk Search. 03-28-2023 01:17 AM
- Karma Re: Comparing data from 2 days by data type for gcusello. 03-28-2023 12:48 AM
- Posted Comparing data from 2 days by data type? on Splunk Search. 03-26-2023 09:37 PM
- Posted Re: Question about subsearch on Splunk Search. 07-24-2018 09:46 PM
- Posted Question about subsearch on Splunk Search. 07-24-2018 02:24 AM
- Tagged Question about subsearch on Splunk Search. 07-24-2018 02:24 AM
- Tagged Question about subsearch on Splunk Search. 07-24-2018 02:24 AM
- Tagged Question about subsearch on Splunk Search. 07-24-2018 02:24 AM
- Posted Re: why can't I get 7 days of data in appendcols search? on Splunk Search. 07-12-2018 02:35 AM
- Posted Re: why can't I get 7 days of data in appendcols search? on Splunk Search. 07-02-2018 02:00 AM
- Posted Re: why can't I get 7 days of data in appendcols search? on Splunk Search. 07-02-2018 01:58 AM
- Posted Re: why can't I get 7 days of data in appendcols search? on Splunk Search. 06-29-2018 03:44 AM
- Posted why can't I get 7 days of data in appendcols search? on Splunk Search. 06-29-2018 12:43 AM
- Tagged why can't I get 7 days of data in appendcols search? on Splunk Search. 06-29-2018 12:43 AM
- Tagged why can't I get 7 days of data in appendcols search? on Splunk Search. 06-29-2018 12:43 AM
- Posted Re: How to calculate multiple fields total count? on Splunk Search. 06-19-2018 07:02 PM
- Posted How to calculate multiple fields total count? on Splunk Search. 06-19-2018 04:58 AM
- Tagged How to calculate multiple fields total count? on Splunk Search. 06-19-2018 04:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-30-2023
03:31 AM
Hi @gcusello, Thank you for the query. I tried this query and encountered 2 issues. 1. The previous date returned both previous day and yesterday. 2. The previous count is same as yesterday count. Do you have any idea for above issues? Thanks, Min
... View more
03-28-2023
01:17 AM
Hi @gcusello, Thank you for the query. You are right, it's better to count two days ago with yesterday and compare the results for two full days. Could you please guide the query for this? I tried the query you provided but I got the same count for "today" and "yesterday", not sure why. Thanks, Min
... View more
03-26-2023
09:37 PM
Hi
I want to compare the data from 2 days by data type, my expected result is as below, is it possible?
Data Type
Yesterday
Yesterday Count
Today
Today Count
Count Change Rate
A
2023/3/26
15
2023/3/27
18
0.20
B
2023/3/26
20
2023/3/27
19
-0.05
C
2023/3/26
16
2023/3/27
35
1.19
D
2023/3/26
21
2023/3/27
40
0.90
E
2023/3/26
30
2023/3/27
25
-0.17
F
2023/3/26
40
2023/3/27
50
0.25
... View more
Labels
- Labels:
-
eval
07-24-2018
09:46 PM
Hi HiroshiSatoh,
Thank you for your answer. Maybe there is a ambiguity for my question. My question is if it possible the User range for subsearch is only for those user who have error.
In subsearch, it searched all Users' data, the results shows the "Total" for User1, User2...User8, but only User1,User2, User3 have error, I want to only search and show "Total" for User1,User2, User3 in subsearch, is it possible?
Expected results:
User errorByService ErrorCnt totalByService Total ErrorRate
User1 service1 2 service1 20 0.1
User2 service1 3 service1 24 0.125
User3 service2 5 service2 35 0.142857143
... View more
07-24-2018
02:24 AM
Hi all,
I have below query and the results like below table, is there a way that only search and display total count for the Users who have error(User1, User2, User3)?
index=aaa sourcetype=bbb |eval errorByService=case(ErrorCode=400 AND match(uri,"/service1/*"),"service1",ErrorCode=400 AND match(uri,"/service2/*"),"service2",ErrorCode=400 AND match(uri,"/service3/*"),"service3")|stats count as ErrorCnt by User errorByService
|appendcols [search index=aaa sourcetype=bbb |eval totalByService=case(match(uri,"/service1/*"),"service1",match(uri,"/service2/*"),"service2", match(uri,"/service3/*"),"service3")|stats count as Total by User totalByService] |eval ErrorRate=ErrorCnt/Total |fields User, errorByService, ErrorCnt, totalByService, Total, ErrorRate
... View more
- Tags:
- appendcols
- stats
- total
07-12-2018
02:35 AM
I found a solution for this, just need to set the maxtime and timeout | appendcols maxtime=600 timeout=600
... View more
07-02-2018
02:00 AM
Hi, I tried using strftime on _time and still see the same issue.
... View more
07-02-2018
01:58 AM
Hi woodcock,
Do you have an example for this kind of search?
... View more
06-29-2018
03:44 AM
Hi HiroshiSatoh,
I tried the sub search and could get results for 7 days(2018/6/15—2018/6/21).
Thanks,
Min
... View more
06-29-2018
12:43 AM
Hi All,
I have a search for comparing data between 2 weeks, I can get data for 7 days in first search, but only got 2 days data in appendcols search, why can't I get 7 days of data in appendcols search?
index=xxx earliest=-7d@d latest=-0d@d | eval Date1 = (date_year + "-" + date_month + "-" + date_mday)
| stats count AS SearchThisWeek by Date1
| appendcols [ search index=xxx earliest=-14d@d latest=-10d@d | eval Date2 = (date_year + "-" + date_month + "-" + date_mday) | stats count AS SearchLastWeek by Date2]
| eval SearchFluctuatePerc=(SearchThisWeek-SearchLastWeek)/ SearchLastWeek
| fields Date1, SearchThisWeek, Date2, SearchLastWeek, SearchFluctuatePerc
... View more
06-19-2018
04:58 AM
I have following fileds, I want to calculate the total f count: (count(f1)+count(f2)+count(f3)+count(f4))=3+3+2+1=9. How can I get the total result 9?
fl=1, f2=3, f3=5
f1=2, f2=2
f1=2, f2=3, f3=3, f4=1
... View more
05-08-2018
08:02 PM
Hi adonio, many thanks! It works well.
... View more
05-08-2018
01:36 AM
I have a query below that is showing "PriceChangeCount", "Total" and "PriceChangeRate" in graph, How can I get the graph that only displays the PriceChangeRate in graph?
index=xxx sourcetype=xxx|eval priceChangeCnt=case(Id=xxx,"Yes") | timechart span=1h count as Total, count(priceChangeCnt) as PriceChangeCount | eval PriceChangeRate=(PriceChangeCount/Total)*100
... View more
- Tags:
- percentage
- timechart
04-10-2018
06:28 PM
@niketnilay, Thank you, the empty columns are returning when I use eval with isnull() to replace NULL with value " ".
... View more
04-09-2018
01:40 AM
Hi all,
I have a dashboard, some fields don't have values, the empty columns are being dropped by the table in the dashboard, but when I run this query in a standalone search box, these empty columns are displaying. How can I get these empty columns returned in the dashboard as well?
For example:(This panel created with a post process)
Base search: `fieldA=<valueA> fieldB=<valueB> |fields fieldC, fieldD, fieldE, fieldF, fieldG, fieldH`
Search: `|eval field1=fieldC- fieldD |eval field2=fieldE- fieldF |eval field3=fieldG- fieldH |table field1, field2, field3`
The table in standalone search appears like:
field1 field2 field3
< value2>
The table in dashboard appears like:
field1 field2
<value1> <value2>
The empty column field3 is dropped in dashboard, how can I get this column displayed in dashboard?
... View more
