Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About crisjnelson
crisjnelson
Explorer
Member since:
03-06-2014
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 03-06-2014 |
Activity Feed
- Got Karma for Re: Local Documentation: Is it possible to have a local copy of what is at docsCheckerBaseURL?. 07-08-2020 07:05 PM
- Posted How can a row of average hourly event volume be appended to a chart with Fridays' hourly totals and added totals? on Splunk Search. 06-24-2019 09:55 AM
- Tagged How can a row of average hourly event volume be appended to a chart with Fridays' hourly totals and added totals? on Splunk Search. 06-24-2019 09:55 AM
- Tagged How can a row of average hourly event volume be appended to a chart with Fridays' hourly totals and added totals? on Splunk Search. 06-24-2019 09:55 AM
- Posted Re: How to report composite transaction breakdown in terms of total, transaction and application duration averages on Splunk Search. 12-24-2018 08:21 AM
- Posted How to report composite transaction breakdown in terms of total, transaction and application duration averages on Splunk Search. 12-23-2018 01:14 PM
- Tagged How to report composite transaction breakdown in terms of total, transaction and application duration averages on Splunk Search. 12-23-2018 01:14 PM
- Tagged How to report composite transaction breakdown in terms of total, transaction and application duration averages on Splunk Search. 12-23-2018 01:14 PM
- Tagged How to report composite transaction breakdown in terms of total, transaction and application duration averages on Splunk Search. 12-23-2018 01:14 PM
- Tagged How to report composite transaction breakdown in terms of total, transaction and application duration averages on Splunk Search. 12-23-2018 01:14 PM
- Posted Re: What is the best method of configuring timestamp recognition to support all ISO 8601 formats with Splunk 6.4.1? on Getting Data In. 03-02-2018 10:50 AM
- Posted What is the best method of configuring timestamp recognition to support all ISO 8601 formats with Splunk 6.4.1? on Getting Data In. 03-02-2018 09:23 AM
- Tagged What is the best method of configuring timestamp recognition to support all ISO 8601 formats with Splunk 6.4.1? on Getting Data In. 03-02-2018 09:23 AM
- Tagged What is the best method of configuring timestamp recognition to support all ISO 8601 formats with Splunk 6.4.1? on Getting Data In. 03-02-2018 09:23 AM
- Tagged What is the best method of configuring timestamp recognition to support all ISO 8601 formats with Splunk 6.4.1? on Getting Data In. 03-02-2018 09:23 AM
- Posted Re: How can I count the number of field values not present? on Splunk Search. 02-01-2018 01:37 PM
- Posted How can I count the number of field values not present? on Splunk Search. 02-01-2018 10:53 AM
- Tagged How can I count the number of field values not present? on Splunk Search. 02-01-2018 10:53 AM
- Tagged How can I count the number of field values not present? on Splunk Search. 02-01-2018 10:53 AM
- Tagged How can I count the number of field values not present? on Splunk Search. 02-01-2018 10:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-08-2020
07:08 PM
Having no help while writing searches is very difficult. The Splunk installs I use have no connectivity to the Internet and because the product comes with no help, it is super tedious to use.
... View more
06-24-2019
09:55 AM
Here is my attempt at creating a chart of hourly counts for previous Fridays. I have added row and column totals, but can't quite figure out how to add hourly averages per day.
index=everything earliest=-2week@week date_wday="friday"
| eval date = strftime(_time, "%Y-%m-%d")
| eval date_hour = strftime(_time, "%H")
| chart count by date_hour date useother=f usenull=f
| addtotals col=t labelfield=date_hour label="Total"
| appendpipe [ | stats avg(count) as date by date_hour
| eval date_hour = "Average" ]
Thanks.
... View more
12-24-2018
11:00 AM
maybe like this?
| makeresults count=1
| eval data = "DT=2018-11-06T11:31:08.844-0800|LogId=TxLog||ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Request Received;;;
DT=2018-11-06T11:31:08.846-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904;;;
DT=2018-11-06T11:31:08.846-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Request Sent|DestId=PI_DB2|MsgNm=PIIISPJ;;;
DT=2018-11-06T11:31:08.961-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Response Received|DestId=PI_DB2|MsgNm=PIIISPJ|Elapsed=115;;;
DT=2018-11-06T11:31:08.962-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904;;;
DT=2018-11-06T11:31:08.962-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904;;;
DT=2018-11-06T11:31:08.965-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Request Sent|DestId=PI_DB2|MsgNm=PIIMSPA;;;
DT=2018-11-06T11:31:08.966-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Request Sent|DestId=PI_DB2|MsgNm=PIIBSP;;;
DT=2018-11-06T11:31:09.078-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Response Received|DestId=PI_DB2|MsgNm=PIIBSP|Elapsed=110;;;
DT=2018-11-06T11:31:09.079-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Response Received|DestId=PI_DB2|MsgNm=PIIMSPA|Elapsed=113;;;
DT=2018-11-06T11:31:09.080-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Request Sent|DestId=PI_DB2|MsgNm=PIIYSPB;;;
DT=2018-11-06T11:31:09.192-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Response Received|DestId=PI_DB2|MsgNm=PIIYSPB|Elapsed=112;;;
DT=2018-11-06T11:31:09.193-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Request Sent|DestId=CWS_DIRECT_TLS|MsgNm=/CWSDIRECT/Restraints/DebitCardDetail;;;
DT=2018-11-06T11:31:09.257-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904;;;
DT=2018-11-06T11:31:09.258-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Response Received|DestId=CWS_DIRECT_TLS|MsgNm=/CWSDIRECT/Restraints/DebitCardDetail|Elapsed=64;;;
DT=2018-11-06T11:31:09.259-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904;;;
DT=2018-11-06T11:31:09.262-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904;;;
DT=2018-11-06T11:31:09.263-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28904|TxAct=Response Sent|Elapsed=421;;;
DT=2018-11-06T11:32:08.844-0800|LogId=TxLog||ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Request Received;;;
DT=2018-11-06T11:32:08.846-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905;;;
DT=2018-11-06T11:32:08.846-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef289045TxAct=Request Sent|DestId=PI_DB2|MsgNm=PIIISPJ;;;
DT=2018-11-06T11:32:08.961-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Response Received|DestId=PI_DB2|MsgNm=PIIISPJ|Elapsed=115;;;
DT=2018-11-06T11:32:08.962-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905;;;
DT=2018-11-06T11:32:08.962-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905;;;
DT=2018-11-06T11:32:08.965-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Request Sent|DestId=PI_DB2|MsgNm=PIIMSPA;;;
DT=2018-11-06T11:32:08.966-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Request Sent|DestId=PI_DB2|MsgNm=PIIBSP;;;
DT=2018-11-06T11:32:09.078-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Response Received|DestId=PI_DB2|MsgNm=PIIBSP|Elapsed=110;;;
DT=2018-11-06T11:32:09.079-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Response Received|DestId=PI_DB2|MsgNm=PIIMSPA|Elapsed=113;;;
DT=2018-11-06T11:32:09.080-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Request Sent|DestId=PI_DB2|MsgNm=PIIYSPB;;;
DT=2018-11-06T11:32:09.192-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Response Received|DestId=PI_DB2|MsgNm=PIIYSPB|Elapsed=112;;;
DT=2018-11-06T11:32:09.193-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Request Sent|DestId=CWS_DIRECT_TLS|MsgNm=/CWSDIRECT/Restraints/DebitCardDetail;;;
DT=2018-11-06T11:32:09.257-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905;;;
DT=2018-11-06T11:32:09.258-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Response Received|DestId=CWS_DIRECT_TLS|MsgNm=/CWSDIRECT/Restraints/DebitCardDetail|Elapsed=64;;;
DT=2018-11-06T11:32:09.259-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905;;;
DT=2018-11-06T11:32:09.262-0800|LogId=AppLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905;;;
DT=2018-11-06T11:33:09.263-0800|LogId=TxLog|ProcId=4e66cc75-fe14-4d23-9406-065c7ef28905|TxAct=Response Sent|Elapsed=421"
| makemv delim=";;;" data
| mvexpand data
| rename data as _raw
| extract
| eval _time = DT
| rename COMMENT as "the above generates data below is the solution"
| eval start_time = if(TxAct=="Request",_time,null())
| eval sent_time = if(TxAct=="Request Sent",_time,null())
| eval rec_time = if(TxAct=="Response Received",_time,null())
| eval end_time = if(TxAct=="Response Sent",_time,null())
| eventstats values(start_time) as s_t values(end_time) as e_t by ProcId
| eval s_t_epoch = strptime(s_t, "%Y-%m-%dT%H:%M:%S.%3N%z")
| eval e_t_epoch = strptime(e_t, "%Y-%m-%dT%H:%M:%S.%3N%z")
| eval rec_time_epoch = strptime(rec_time, "%Y-%m-%dT%H:%M:%S.%3N%z")
| eval sent_time_epoch = strptime(sent_time, "%Y-%m-%dT%H:%M:%S.%3N%z")
| eval tot_trans_dur_in_sec = e_t_epoch - s_t_epoch
| stats values(*_time_epoch) as *_time_epoch by tot_trans_dur_in_sec ProcId DestId MsgNm
| eval nested_trans_dur_in_sec = rec_time_epoch - sent_time_epoch
| eventstats sum(nested_trans_dur_in_sec) as tot_nested_trans_dur_in_sec by ProcId
added another ProcId and played a little with timestamp
... View more
03-03-2018
10:42 PM
What time zone are you in, and what time zone is set in your GUI for Splunk. Additionally you can set the timezone in the props on your host and help alleviate this kind of issue.
... View more
02-01-2018
01:37 PM
Wow, that's pretty interesting. Thanks!
... View more
01-24-2018
10:17 AM
Excellent! Much appreciated.... I had tried the flags prior, but another portion of the expression must not have been correct. Thanks!
... View more
08-07-2017
11:14 AM
Hi @crisjnelson, other users have reported this issue this morning, so it has been escalated and we hope to resolve it soon.
... View more
07-13-2017
10:18 AM
I appreciate the information. I have opened a case with Splunk Support to obtain more details. I will share when I hear back.
... View more
06-21-2017
08:20 AM
Also - are you looking for if the new_gc_count field is greater than the std_dev*2, or where new_gc_count is greater than the mean + 2 standard deviations.
There's a significant difference!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
