About metersk

metersk · ‎05-08-2015

Here is my scenario: I have 20 different saved searches that run on a cron schedule every morning at 6am. I want to retrieve the data from those searches, but the SID is not descriptive enough to tell which search search contains what data. If I were able to retrieve the SID and the name that I used when I created the Saved search, I would be able to parse and manipulate the data appropriately, because I would know what I was dealing with ahead of time. Unfortunately, all I can retrieve is the SID which does not tell me what the search is, as the name of the saved search would.

metersk · ‎05-08-2015

Hi Ken, thanks for the reply. Essentially I am looking for a way to access the data of my saved searches every morning. Unfortunately, SID is not descriptive enough to tell me what the search actually contains. Do you have any thoughts on the best way to access saved searches?

metersk · ‎04-30-2015

For group 3 I would like to retain only 0 and 1. Another example, group 9 should only retain plats 1 Thanks!

metersk · ‎04-22-2015

import splunklib.client as client service = client.connect(host='xyz', username='xyz', port="8089", password='xyz', owner='xyz', app='search') savedsearches = service.saved_searches jobs = service.jobs print jobs for x in jobs: print x.name + " | " + x.sid Running the above code gives me an output of 1429721446.123816 | 1429721446.123816 I know that this is the correct SID, but I also know that this saved search has a name of KPI - Messaging (UK WARPU 1) . According to the docs, they should not be returning the same thing. Am I missing something fundamental to fetch the name of a saved search? Update: So I did a hacky var dump on the job object and it does not have a name property. So two questions from this: if there is no name property, why is SID replacing it? and - Why is there no name property?

metersk · ‎04-20-2015

[search earliest=2/1/2015:00:00:00 latest=2/1/2015:23:59:59 ns=interaction (msg=yes direction=sent) OR (msg=match) | fields uid o_uid] earliest=2/2/2015:00:00:00 latest=2/5/2015:23:59:59 ns=interaction msg=single_message OR msg=eis | chart count by msg direction In the query above I search for uid s who sent engagement to o_uid s on 2/1 and then in the second portion of the query I search for all engagment that was sent for that same uid / o_uid pair. My issue is that when someone who is on the receiving end of engagement, an o_uid , sends something back, the uid / o_uid pair reverses (in terms of the field name) and I want to be able to capture that data. Since I have all the IDs, I need a a way to say "also search for the reverse, for each pair where the uid becomes the o_uid and vice versa. Is it possible to switch the field names like this?

metersk · ‎04-20-2015

I am trying to fetch all saved searches created by me with the Python SDK using the below code. import splunklib.client as client service = client.connect(host='xyz', username='xyz', password='xyz', owner='xyz', app='search') savedsearches = service.saved_searches for savedsearch in savedsearches: print savedsearch.name The code returned a list of saved searches were not created by me, nor are they able to be found with in the GUI. Any thoughts as to why this would return the names of saved searches that don't seem to exist? In the docs there is a class called splunklib.client.Collection(service, path, item=) Should I be using this instead?

metersk · ‎04-17-2015

In the query below I am trying to find all users who logged in and then did not login again with in the time range. Unfortunately, is is not returning any results, which I know to be wrong by verifying for a specific UID. earliest=-2d@d latest=-0d@d msg=login_daily `money_countries` | transaction uid startswith=(msg="login_daily") endswith=(msg="login_daily") keepevicted=true | search closed_txn=0 | table uid Once I can get this working, I would like to find only unclosed transactions where there the absence of a second login comes 30 days after the first login. Is this possible?

metersk · ‎04-08-2015

The precise question to answer is, "for every user who made a purchase in the last 7 days, what count of each interaction (so, broken out by nsMsg) did they receive 24 hrs prior to purchasing?" The ideal output would be an aggregation count and dc(uid) of all interaction received 24hrs prior to purchasing- count and dc(uid) so that I can get average interaction per user by interaction type.

metersk · ‎04-08-2015

Thanks for the above, this is very helpful. The end data I am trying to get is every interaction event that a user received 24hrs before they made a purchase. I tried stats list(nsMsg) by uid but the only events I am getting returned are revenue_sale . Any thoughts?

metersk · ‎04-08-2015

I am trying to get counts of all certain events that happened before a user purchased on our site and so far, I am working with this: earliest=-1d@d (ns=interaction msg=match direction=received gen=m is_p="" rematch=0) OR (ns=interaction msg=yes direction=received gender=m is_p="") OR (ns=interaction msg=eis_reply direction=received gen=m is_p="") OR (ns=interaction msg=single_message direction=received gen=m is_p="" reply=1) OR (ns=interaction msg=single_message direction=received gen=m is_p="" reply="") OR (ns=interaction msg=eis direction=received gen=m is_p="") OR (ns=revenue msg=sale recurring=0 item_number=*m) `money_countries` | transaction uid maxspan=1d startswith=(ns="interaction") endswith=(msg="sale") | table uid eventcount msg The ending event is (ns=revenue msg=sale recurring=0 item_number=*m) and I want to get counts for each of these events that happened 24hrs before a user purchased: (ns=interaction msg=match direction=received gen=m is_p="" rematch=0) OR (ns=interaction msg=yes direction=received gen=m is_p="") OR (ns=interaction msg=eis_reply direction=received gen=m is_p="") OR (ns=interaction msg=single_message direction=received gen=m is_p="" reply=1) OR (ns=interaction msg=single_message direction=received gen=m is_p="" reply="") OR (ns=interaction msg=eis direction=received gen=m is_p="") Should I be using a subsearch or a transaction query, maybe with an event count? Im also thinking this - Could I use where statements to say that all of the interaction events happened w/in 24hrs of the purchase event? I'm just not sure how to do it on a per user basis with so many events.

metersk · ‎04-06-2015

Is it possible to return the results from a subsearch alongside the results of the outer/primary search? [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] earliest=-14d@d latest=-0d@d ns=email msg=email_unsub_click | stats count by msg Of course, I can run the subsearch portion as a separate query, but it would be nice to return the results along side the outer search. Is this possible?

metersk · ‎04-02-2015

earliest=-14d@d latest=-0d@d ns=email msg=send country="United Kingdom" | eval time=strftime(_time,"%H:%M") | chart count by time, msg In the query above, I'd like to floor the %M by 5 minutes so that sums of every 5 minutes are displayed instead of every minute. Is this possible? Or maybe even some sort of groupby function that I can apply?

metersk · ‎03-17-2015

earliest=-60d@d latest=-0d@d msg=login_daily | eval time=strftime(_time, "%m/%d/%y") | where cadt>1421366400 |stats count by uid time platform plats fplat is_p gender The above query gives me data presented like so: +-----+---------+----------+-------+-------+------+-------+ | uid | time | platform | plats | fplat | is_p | count | +-----+---------+----------+-------+-------+------+-------+ | 1 | 1/16/15 | 2 | 0,2 | 0 | | 1 | | 1 | 1/17/15 | 2 | 0,2 | 0 | | 1 | | 1 | 1/18/15 | 2 | 0,2 | 0 | | 1 | | 1 | 1/19/15 | 2 | 0,2 | 0 | | 1 | | 1 | 1/20/15 | 2 | 0,2 | 0 | | 1 | | 1 | 1/21/15 | 2 | 0,2 | 0 | | 1 | | 2 | 2/8/15 | 4 | 2,0,4 | 2 | | 1 | | 3 | 1/29/15 | 1 | 0,1,2 | 1 | | 1 | | 3 | 1/30/15 | 1 | 0,1,2 | 1 | 1 | 1 | | 3 | 1/31/15 | 1 | 0,1,2 | 1 | 1 | 1 | | 3 | 2/2/15 | 1 | 0,1,2 | 1 | 1 | 1 | | 3 | 2/3/15 | 1 | 0,1,2 | 1 | 1 | 1 | | 4 | 1/28/15 | 2 | 2 | 2 | | 1 | | 4 | 1/29/15 | 2 | 2 | 2 | | 1 | | 5 | 1/18/15 | 4 | 2,4 | 2 | | 1 | | 6 | 1/30/15 | 2 | 2 | 2 | | 1 | | 7 | 2/2/15 | 0 | 2,0 | 2 | | 1 | | 8 | 3/9/15 | 1 | 2,1 | 2 | | 1 | | 9 | 2/28/15 | 1 | 1,2 | 2 | | 1 | | 9 | 3/2/15 | 1 | 1,2 | 2 | | 1 | | 9 | 3/5/15 | 1 | 1,2 | 2 | | 1 | | 9 | 3/10/15 | 1 | 1,2 | 2 | | 1 | | 9 | 3/11/15 | 1 | 1,2 | 2 | | 1 | | 9 | 3/15/15 | 1 | 1,2 | 2 | | 1 | | 10 | 3/15/15 | 2 | 2 | 2 | | 1 | | 11 | 3/16/15 | 0 | 2,0 | 2 | | 1 | | 12 | 3/12/15 | 4 | 2,4 | 2 | | 1 | +-----+---------+----------+-------+-------+------+-------+ What I would like to do is this: For each grouping of UID s, if they do not have a platform of 2 in any instance, remove it from their plats column. For example, UID 3 does not have 2 in any of its platform instances. I would like to strip out 2 from their plats data. Is this possible? Please let me know if I can make this more clear.

metersk · ‎03-09-2015

Hello! Thanks for the response. I updated my question. For some reason the second transpose is giving me a weird return. Any thoughts?

metersk · ‎03-06-2015

The search below gives me the following data: (ns=stats msg=email_unsub_clicks) OR (ns=email msg=fbl OR msg=send OR msg=click) | eval t=tid%100 | eval v=version%100 | eval a=coalesce(t,v) | chart count by msg, a msg | 1 | 12 | 19 | 2 | 3 | 49 | 56 | 74 | 8 | 9 |OTHER | +------------------+----+----+----+----+----+----+----+----+-----+-----+------+ click | 54 | 34 | 87 |208 | 77 | 67 |504 |372 | 962 | 197 | 208 | email_unsub_clicks | 5 | 4 | 6 | 1 | 0 | 5 | 7 | 1 | 28 | 77 | 15 | fbl | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 3 | send |1807|1007|1939|1264|712 |1244|9632|1748|14578|33175| 992 | Is it possible to sort the bottom row, sends, from greatest to least? Update: So, the below is giving me the data vertically, but when I add the second transpose it does some weird stuff and removes most of the data (ns=stats msg=email_unsub_clicks) OR (ns=email msg=fbl OR msg=send OR msg=click) | eval t=tid%100 | eval v=version%100 | eval a=coalesce(t,v) | chart count by msg, a limit=7 | transpose | sort -"row 4" +------------+-------+--------------------+-------+-------+ | column | row 1 | row 2 | row 3 | row 4 | +------------+-------+--------------------+-------+-------+ | msg | click | email_unsub_clicks | fbl | send | | 8 | 1029 | 26 | 1 | 12104 | | 1 | 96 | 11 | 1 | 1789 | | 74 | 417 | 2 | 0 | 1746 | | 2 | 232 | 1 | 0 | 1192 | | 12 | 27 | 1 | 0 | 928 | | 19 | 79 | 2 | 0 | 756 | | 3 | 86 | 0 | 0 | 623 | +------------+-------+--------------------+-------+-------+ (ns=stats msg=email_unsub_clicks) OR (ns=email msg=fbl OR msg=send OR msg=click) | eval t=tid%100 | eval v=version%100 | eval a=coalesce(t,v) | chart count by msg, a limit=7 | transpose | sort -"row 4" | transpose +------------+--------------------+-------+-------+-------+-------+ | column | row 1 | row 2 | row 3 | row 4 | row 5 | +------------+--------------------+-------+-------+-------+-------+ | column | msg | 8 | 1 | 74 | 2 | | row 1 | click | 1060 | 96 | 414 | 229 | | row 2 | email_unsub_clicks | 32 | 10 | 2 | 0 | | row 3 | fbl | 1 | 1 | 0 | 0 | | row 4 | send | 12198 | 1773 | 1724 | 1226 | +------------+--------------------+-------+-------+-------+-------+

metersk · ‎01-27-2015

Is it possible to count number of characters in a splunk field? I can only seem to find a way to count specific instances of a character.

metersk · ‎12-05-2014

We use Splunk as our A/B platform. Our test buckets are called "studies", and within each study we have "groups", which are the different A/B tests. Anytime we want to query a study to compare results across all the groups within the study we have to create a query like the following: msg=single_message reply=1 plat=2 OR plat=0 | extract kvdelim="=" limit=200 pairdelim="," | makemv delim="," studies | chart count by studies,is_p | rex field=studies "(? .)---(? . )" | where study="lab" The bolded text above is what is required to break out a study by its groups. Is there any way to turn this into a macro, with the caveat that within where study="lab" where "lab" and "chart count by studies,is_p" can be changed to anything (because we have multiple studies)?

Posts	17
Solutions	0
Karma Given	11
Karma Received	5
Member Since	‎12-05-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Using the Python SDK, why is job.name returning an...

How to change field names, while still maintaining...

Using the Python SDK, why does my code return a li...

How to find incomplete transactions outside of a 3...

Get a count all events by event type that happened...

Subsearch: Returning the results from the subsearc...

Flooring the minutes of a strftime eval

For each group of UIDs, how do I edit my search to...

How to sort a chart horizontally by a field from g...

Counting number of characters in a Splunk field

Re: Using the Python SDK, why is job.name returnin...