About alchang

alchang · ‎03-05-2015

Thanks! A related feature I'd like to add is let's suppose that I have daily for the past 30 days, but I want to just add up the weekly for the past two weeks. I tried | loadjob savedsearch="Daily Query" | timechart span=1w sum(count) as count | where _time>"2015-02-17" and that didn't do anything.

alchang · ‎03-04-2015

I want two charts in a dashboard - the count of an event by week and by day. Currently I have two scheduled searches: Daily: | timechart span=1d count Weekly: | timechart span=1w count Is there a way that I can use the output of the daily search to do the aggregation? Something like |loadjob savedsearch="Daily Query"

alchang · ‎01-14-2015

Thanks! That worked. I hadn't worked much with streamstats before, but it looks very powerful. I will check it out. Offhand, do you know if streamstats works with report acceleration?

alchang · ‎01-13-2015

Can the limit command be used with multiple conditions? My search query is as follows | stats count as num by searchTerm, domain. I want to return the top 3 searchterms per domain. Is there a way to do that from the search bar in splunk UI? Desired Output: Domain searchTerm Number Google ABC 100 Google DEF 50 Google GHI 25 Yahoo DEF 75 Yahoo ABC 60 Yahoo JKL 20 Bing DEF 80 Bing JKL 40 Bing GHI 20

Posts	4
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎12-17-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to timechart by multiple time spans in a dashb...

How to limit results with multiple group by condit...

Re: How to timechart by multiple time spans in a d...

How to timechart by multiple time spans in a dashb...

Re: How to limit results with multiple group by co...

How to limit results with multiple group by condit...