Activity Feed
- Karma Re: How to get 2 unique rows for the values in the list. for richgalloway. 10-24-2022 06:54 AM
- Posted How to get 2 unique rows for the values in the list. on Splunk Search. 10-24-2022 06:37 AM
- Karma Re: Get % values out of a query for skoelpin. 06-05-2020 12:51 AM
- Karma Re: Combining 2 queries based on a common value for somesoni2. 06-05-2020 12:51 AM
- Karma Re: How to chart with 2 different data over a time period? for to4kawa. 06-05-2020 12:51 AM
- Got Karma for Get % values out of a query. 06-05-2020 12:51 AM
- Karma Re: How can I split my data to show the average based on column values? for whrg. 06-05-2020 12:50 AM
- Karma Re: Combine 2 separate searches and display on a single Time Chart for kmaron. 06-05-2020 12:49 AM
- Karma Re: Reduce number of searches for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: How do I pass in a default value for a single value chart? for FrankVl. 06-05-2020 12:49 AM
- Karma Re: How to get the overall average and average per 5 minutes on a Time Chart? for renjith_nair. 06-05-2020 12:49 AM
- Got Karma for How to get the overall average and average per 5 minutes on a Time Chart?. 06-05-2020 12:49 AM
- Posted How to get evaluated result for every item in list on Splunk Search. 05-26-2020 05:56 AM
- Tagged How to get evaluated result for every item in list on Splunk Search. 05-26-2020 05:56 AM
- Tagged How to get evaluated result for every item in list on Splunk Search. 05-26-2020 05:56 AM
- Posted Re: How to split data based on a field on Getting Data In. 04-15-2020 03:36 AM
- Posted Re: How to split data based on a field on Getting Data In. 04-15-2020 03:35 AM
- Posted Re: How to split data based on a field on Getting Data In. 04-15-2020 01:23 AM
- Posted How to split data based on a field on Getting Data In. 04-15-2020 12:41 AM
- Posted Get % values out of a query on Splunk Search. 04-14-2020 06:37 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 | |||
0 | |||
0 | |||
1 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 |
10-24-2022
06:37 AM
I have the following query: application_id=12345 STATUS_CODE IN (300, 400, 500)| head 10 How can I modify this such that I can get 2 unique rows where STATUS_CODE is 300, 2 unique rows where STATUS_CODE is 400, 2 unique rows where STATUS_CODE is 500 and so on? Above query ends up fetching 10 rows of the first ones it can find thus end up with all 10 rows as STATUS_CODE as 300 in correctly. Pls advice. Thanks.
... View more
Labels
- Labels:
-
subsearch
05-26-2020
05:56 AM
I have the following working Query for a single product AHSDFKSD1
ns=a* DECISION IN (ELIGIBLE, INELIGIBLE)
PRODUCT IN (AHSDFKSD1)
| timechart span=24h limit=0 count by DECISION
| eval total= ELIGIBLE+INELIGIBLE
| eval ELIGIBLE=round(ELIGIBLE/total,4)*100
| eval INELIGIBLE=round(INELIGIBLE/total,4)*100
| fields - total
Output
_time ELIGIBLE INELIGIBLE
2020-05-25 17:00 87.93 12.07
How can I modifying this query to output data per product? (Or even a totally different query if output is as follows)
Example I could have over 20 products AHSDFKSD1, GFAGDAYD2, GSDAUFCBE3, IGAGSDASHD4, GASDAHJDSGDA5 ........
I am looking for following output:
PRODUCT _time ELIGIBLE INELIGIBLE
AHSDFKSD1 2020-05-25 17:00 87.93 12.07
GFAGDAYD2 2020-05-25 17:00 80.03 19.97
GSDAUFCBE3 2020-05-25 17:00 87.90 12.10
IGAGSDASHD4 2020-05-25 17:00 92.93 7.07
How can I achieve this? Please assist. Thanks.
... View more
04-15-2020
03:36 AM
Think issue with syntax, can't do TEST_DECISION PRODUCT (2 variables) here it seems.
... View more
04-15-2020
03:35 AM
Thank you. This does split it up but I lose all my evals I was calculating % for VALID INVALID above which worked before.
I end up with only 3 columns now.
TEST_DECISION PRODUCT. count
... View more
04-15-2020
01:23 AM
I could but that will not split it up. That would just give same results where all data for all products is merged. I want them to show individually for each product similar to the last table I posted above.
... View more
04-15-2020
12:41 AM
I have the following query:
ns=name* TEST_DECISION
PRODUCT IN (PRODUCT1)
| timechart span=1d limit=0 count by TEST_DECISION
| eval total= VALID+INVALID
| eval VALID=round(VALID/total,4)*100
| eval INVALID=round(INVALID/total,4)*100
| fields - total
The output is as follows:
_time FAILED VALID INVALID OTHERS
2020-04-14 21 90.97 9.03 727
I have multiple products and that data is getting merged here thus I end up doing it 1 product at a time as seen in the query above (2nd line -> PRODUCT IN (PRODUCT1) ).
I have about 15 products. Is there a way I could modify the above query to achieve the following?
Doubt it but if relevant, products will be named like (CH1276578, FH7623138, DD81236812) .
_time FAILED VALID INVALID OTHERS. Product
2020-04-14 21 90.97 9.03 727. Product 1
2020-04-14 11 80.85 19.15 700. Product 2
2020-04-14 09 78.97 21.03 712. Product 3
...
Please advice. Thank you.
... View more
04-14-2020
06:37 AM
1 Karma
I have the following query. The key TEST_DECISION has 4x possible outcomes. CALL_FAILED, VALID, INVALID, NOT_CALLED.
ns=test* TEST_DECISION
PRODUCT IN (SAMPLE_123)
| timechart span=5m limit=0 count by TEST_DECISION
The output is as follows:
_time CALL_FAILED VALID INVALID NOT_CALLED
2020-04-14T05:50:00.000-0700 11 83 7 46
2020-04-14T05:55:00.000-0700 6 60 6 42
2020-04-14T06:00:00.000-0700 8 78 19 55
2020-04-14T06:05:00.000-0700 11 86 19 59
2020-04-14T06:10:00.000-0700 10 94 17 71
2020-04-14T06:15:00.000-0700 8 67 17 63
2020-04-14T06:20:00.000-0700 2 19 4 17
Is there a way I could show % instead? I only care about VALID and INVALID.
Thus I want to get the following instead.
For first row 100% will be 83(valid) + 7(invalid)
Thus I want to achieve following
VALID INVALID
92.22% 7.77%
Please advice if there is a way I could achieve this. Thank you.
... View more
- Tags:
- queries
01-27-2020
09:41 AM
index=my-index ns=my-namespace app_name=my-api DECISION IN (YES, NO) | chart list(DECISION) BY PRODUCT_ID
For above query, how could I possibly chart it for a query of 90 days. I want the data to be shown weekly. There are 11 possible ids for the value PRODUCT_ID.
Thus total 3 things to consider. PRODUCT_ID (11 types), DECISION (2 types) and the timeline to be shown weekly for a 90 day period.
How can I chart this in Splunk? Bit confused as to what chart would fit this scenario and how to write the query to chart this. Appreciate any advice. Thanks.
... View more
- Tags:
- splunk-enterprise
01-22-2020
09:35 AM
Thank you. Do you mind explaining this?
if(APIs=2,count,0)
Is it equal to ---> if APIs = 2 set value as count else set to 0 ?
If yes does that mean it is actual making one call every time to see if NAME exists in both APIs and the value of count is actually always 2?
Cos the NAME value could occur multiple times in either APIs but I only want to see if the NAME came in both APIs and count that as a single match and not care if there are multiple same NAME values across both APIs.
... View more
01-22-2020
08:05 AM
1st query
ns=mynamespace* app_name=A-api API=GET_INITIAL_DATA NAME=*
2nd query
ns=mynamespace* app_name=B-api API=GET_FINAL_DATA NAME=*
I have the following 2 queries. Each is querying a micro service's logs. But I do not want to call them individually and looking to have a single query.
I want to be able to match 1st query against the 2nd query based on name. I am trying to get a % and also total count. Trying to achieve something like the following:
GET_INITIAL_DATA Total count: 10000000
GET_FINAL_DATA count that matched NAME in 1st call : 8000000
Matching call Percentage : 80%
Non Matching call Percentage : 20%
and show that in a chart divided weekly over a 3month period. Is there a way to do this? I am expecting millions of records thus it would not make sense for me to make the first query, get all the names (millions of em) and then use that data to make second call. Please assist. Thank you.
... View more
- Tags:
- splunk-enterprise
09-09-2019
01:33 AM
Thanks for replying. All I am trying to do is to get a count on how many requests came in (which I believe is called events in this case) per second and per day based on each app_name (I am checking it over a week's period).
... View more
09-08-2019
01:16 PM
I am running following queries to get event counts average per second and per day over a weeks period but the results makes no sense.
This is the query to get average per day over a week:
index=some_some2_idx ns=something app_name=my-api STATUS_CODE!=5*
| timechart span=1d count as requests_per_second | stats avg(requests_per_second)
The average per day result is 3010.5714285714284
This is the query to get average per second over a week:
index=some_some2_idx ns=something app_name=my-api STATUS_CODE!=5*
| timechart span=1s count as requests_per_second | stats avg(requests_per_second)
The average per second result is 1.4238227146814404
There are 86400 seconds in a day so 86400 * 1.4238227146814404 = 123018 and some change. I am not expecting an exact match but this is not even remotely close to 3010.5714285714284. What am I missing. Is this is expected or is there something wrong with my query?
... View more
09-08-2019
12:56 PM
Tried following and no results:
index=some_some2_idx ns=something app_name=my-api
CLIENT IN (A, B, C) API IN (R_GET, T_GET)
| timechart span=1s count as requests_per_second by CLIENT | stats avg(requests_per_second) by CLIENT
Also tried By Client only at one spot as above for both places and same results.
... View more
09-08-2019
11:53 AM
I have the following query which gives me per second average results for the events.
Is there a way I can modify it to produce the individual average results for each CLIENT? Thanks.
index=some_some2_idx ns=something app_name=my-api
CLIENT IN (Apple, Orange, Banan) API IN (R_GET, T_GET)
| timechart span=1s count as requests_per_second | stats avg(requests_per_second)
This is currently outputting:
avg(requests_per_second)
18.39494
I looking to get results as follows:
Apple Orange Banana
5.1 5.9 7.39
... View more
- Tags:
- splunk-enterprise
12-11-2018
02:59 AM
I'm using the following search and getting the following results. This search is done over 7 days.
Is there a way I can split this up and show 1 day + 7 days?
Current search:
some_search=*| stats count(some_num) as "No: Requests" by some_num, client
Current Result
some_num client No: Requests
9999999 PC 121
111111 MAC 342
Looking to get this result instead.
some_num client No: Requests (1 Day) No: Requests (7 Days)
9999999 PC 70 121
111111 MAC 102 342
Also, I tried with the following search, but I ended up with all days in a single row, which is not what I want.
Another try:
some_search=* | stats count(some_num) as "No: Requests" by some_num, client, date_mday
... View more
- Tags:
- splunk-enterprise
12-10-2018
08:41 AM
I am trying to combine results from two different time lines into a single table.
The search query for 1 day as follows:
some_app=my_app_name card_num=* | stats count(card_num) as "No: Requests" by card_num, plat
The result format as follows:
card_num plat No: Requests
XXX-1000 Windows 100
XXX-1002 mac 300
XXX-1002 linux 500
.....
I want to do the same search but over 7 days.
For example, I get following results for 7 days:
card_num plat No: Requests
XXX-1000 Windows 10056723
XXX-1002 mac 3007845623
XXX-7777 linux 67585647
.....
I want to show it in a single table format as follows:
card_num plat No: Requests (1 day) Requests (7 day)
XXX-1000 Windows 100 10056723
XXX-1002 mac 300 3007845623
XXX-1002 linux 500 --
XXX-7777 linux -- 67585647
Is there a way I could make these searches once and create this table?
I do not have access to add plugins/ apps. Looking to do it without them. Thanks.
... View more
12-10-2018
06:16 AM
Perfect. Thanks.
... View more
12-10-2018
05:19 AM
I am using the following query to split my data to show the average, min, and max based on the fields. But, I seem to be getting a total value instead of a proper split.
Expected outcome: (I am open to ideas if there is a better way of displaying this)
average maximum minimum environment app_name
10 100 2 env 1 service 1
12 180 3 env 1 service 2
13 110 22 env 1 service 3
34 100 21 env 1 service 4
66 290 0 env 1 service 5
10 100 2 env 2 service 1
12 180 3 env 2 service 2
13 110 22 env 2 service 3
34 100 21 env 2 service 4
66 290 0 env 2 service 5
Actual outcome
average maximum minimum environment app_name
134 100 12 env 1 service 1
env 2 service 2
service 3
service 4
service 5
Search used:
some_search=* environment=* some_time=* | chart avg(some_time) as average, max(some_time) as maximum, min(some_time) as minimum, values(environment) as environment, values(app_name)
... View more
08-08-2018
09:24 AM
I have a data set with following query and it is saved as "model_requests"
(service=service* OR (service=Aservice* AND app_name=app*)) some_other_fields=*
Under my dash boards I have a single value chart with following query:
| pivot model_requests RootObject count(RootObject) AS "Count of Requests" FILTER service in $service_token$
$service_token$ points to a drop down in the dashboard, which has different service names or * which is a list of a set of services.
Example drop down options under static options:
Name Value
* (Service1, Service2)
Service1 Service1
Service2 Service2
I have added a new drop down for app_name and its token name is $app_token$ as follows:
Name Value
* (app1, app2)
app1 app1
app2 app2
In the pivot query, I am looking to have an OR in it to choose between the tokens service_token and app_token (Either or, both tokens data will not exists at the same time).
For example as follows:
| pivot model_requests RootObject count(RootObject) AS "Count of Requests" (FILTER service in $service_token$ OR FILTER app_name in $app_token$) FILTER something_else=*
This query doesn't work. Is there a way around this? Thanks.
... View more
06-29-2018
01:42 AM
@niketnilay "Ensure summary is collected only once all the events for specific time window are already collected."
I was under the impression I was already doing this.. Clearly I'm doing something wrong then.. I can change the 5 min interval. I am not hard pressed on that interval figure of 5 mins. Can be anything. Is there a way it can be set to auto vary based on my time scales. Example 5mins if the time scale is 60mins and maybe 1 day if the time scale is 1 week.
... View more
06-28-2018
05:12 AM
@Sukisen1981 I am trying to show all the different services at the same time thus didn't use drop downs for this. Plus like you mentioned even that is still slow. I do need to display these information. I don't see a way a around it.
... View more
06-28-2018
05:10 AM
@FrankVI Even when searched individually for example 1 of each of thre chart types (3), they are slow or fails. I am searching over a period of 1 year. I am not entirely what you meant by filtering for specific index and / or sourcetype.
... View more
06-28-2018
03:17 AM
The system I am working with gets logs about 500k per hour. I have a dashboard with multiple queries on these logs. And I am trying to get a report out for the last 1 year. I do expect it to take sometime. But the dashboard not completing after like 5 hours or jus failing seems plain ridiculous.
Believe I am doing some really inefficient work on the dashboard. I am new to this and looking for some advice on how I could make my queries and charts deliver faster results without failing.
I have 5 of the following searches on the dashboard and each search is presented as a single value chart:
service="this changes for the 5 different searches" | chart avg(REQUEST_DURATION) as "Service (ms)"
I have 5 of the following searches on the dashboard and each search is presented as a single value chart:
market="this changes for the 5 different searches" | timechart span=5m avg(REQUEST_DURATION) as average | fillnull | sort average
I have 5 of the following searches on the dashboard and each search is presented as a line chart:
locale="this changes for the 5 different searches"|fields REQUEST_DURATION| eventstats avg(REQUEST_DURATION) as average | timechart span=5m avg(REQUEST_DURATION) as actual ,first(average) as average | eval max = 500 | filldown
... View more
06-27-2018
03:14 AM
Just what I needed! Thank you.
... View more
06-27-2018
02:17 AM
How do I pass in a default value for a single value chart?
As in I am not looking to search anything for now in the search query.
For example, I just want the chart to display the number 1.10.
Is this possible?
Tried following in the search query but it doesn't work returning no result.
| eval myVal=1.10 | table myVal
... View more