About chrisboy68

chrisboy68 · ‎07-03-2025

Thanks. That was my first try, but still didn't work.

chrisboy68 · ‎07-03-2025

Hi, I have simple chart visulization, with base SPL .... | chart sum(cost) AS total_cost BY bill_date I'm trying to add a "$" format to total_cost to show on the columns. Tried every Google and ChatGPT trick and I can't get it working. Any ideas? Thanks!

chrisboy68 · ‎06-25-2025

Thanks. Believe I got it. What tripped me up, is I didn't realize latest could be used for non-time based fields.

chrisboy68 · ‎06-18-2025

Ok, let me try to get some better sample data. Believe I have it here. While this is only one ID, the data has multiple IDs, and its spans multiple months. | makeresults count=1 | eval ID="10001", _time=strptime("2025-06-01 08:00:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=100.50, code="product1" | append [| makeresults | eval ID="10001", _time=strptime("2025-06-01 10:15:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=120.75, code="product2"] | append [| makeresults | eval ID="10001", _time=strptime("2025-06-01 13:30:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=140.00, code="product3"] | append [| makeresults | eval ID="10001", _time=strptime("2025-06-02 10:15:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=130.75, code="product2"] | append [| makeresults | eval ID="10001", _time=strptime("2025-06-02 13:30:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=150.00, code="product3"] | append [| makeresults | eval ID="10001", _time=strptime("2025-06-01 08:10:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=102.50, code="product1"] | append [| makeresults | eval ID="10001", _time=strptime("2025-06-01 10:15:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=125.75, code="product2"] | append [| makeresults | eval ID="10001", _time=strptime("2025-06-01 13:30:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=145.00, code="product3"] | append [| makeresults | eval ID="10001", _time=strptime("2025-06-02 10:15:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=135.75, code="product2"] | append [| makeresults | eval ID="10001", _time=strptime("2025-06-02 13:30:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-06-01", cost=155.00, code="product3"] | append [| makeresults | eval ID="10001", _time=strptime("2025-05-01 10:15:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-05-01", cost=125.75, code="product2"] | append [| makeresults | eval ID="10001", _time=strptime("2025-05-01 13:30:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-05-01", cost=145.00, code="product3"] | append [| makeresults | eval ID="10001", _time=strptime("2025-05-02 10:15:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-05-01", cost=135.75, code="product2"] | append [| makeresults | eval ID="10001", _time=strptime("2025-05-02 13:30:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-05-01", cost=155.00, code="product3"] | append [| makeresults | eval ID="10001", _time=strptime("2025-05-01 10:15:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-05-01", cost=120.75, code="product2"] | append [| makeresults | eval ID="10001", _time=strptime("2025-05-02 13:30:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-05-01", cost=140.00, code="product3"] | append [| makeresults | eval ID="10001", _time=strptime("2025-05-02 10:15:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-05-01", cost=130.75, code="product2"] | append [| makeresults | eval ID="10001", _time=strptime("2025-05-02 13:30:00", "%Y-%m-%d %H:%M:%S"), billing_date="2025-05-01", cost=150.00, code="product3"]

chrisboy68 · ‎06-17-2025

Thanks, but that is still not working. Its only grabbing the very first ID. The data will have many IDs to one bill_date to multiple event times/_time.

chrisboy68 · ‎06-16-2025

Looking for SPL that will give me the ID Cost by month, only grabbing the last event (_time) for that month. Sample data below. I have a system that updates cost daily for the same ID. Looking for guidence before I venture down a wrong path. Sample data below. Thank you! bill_date ID Cost _time 6/1/25 1 1.24 2025-06-16T12:42:41.282-04:00 6/1/25 1 1.4 2025-06-16T12:00:41.282-04:00 5/1/25 1 2.5 2025-06-15T12:42:41.282-04:00 5/1/25 1 2.2 2025-06-14T12:00:41.282-04:00 5/1/25 2 3.2 2025-06-14T12:42:41.282-04:00 5/1/25 2 3.3 2025-06-14T12:00:41.282-04:00 3/1/25 1 4.4 2025-06-13T12:42:41.282-04:00 3/1/25 1 5 2025-06-13T12:00:41.282-04:00 3/1/25 2 6 2025-06-13T12:42:41.282-04:00 3/1/25 2 6.3 2025-06-13T12:00:41.282-04:00

chrisboy68 · ‎01-28-2025

This is probably why I'm getting confused. Jan 100 Feb 105 March 90 Given this table, I want to have a single value trellis view that depicts the month total , with a trend compared to the previous month. Jan 100 (no trend) , Feb 105 (shows trend up 5), March 90 (shows trend down 15). I'm going to play with timewrap, maybe I'm going down the wrong path.

chrisboy68 · ‎01-27-2025

Hi, this https://docs.splunk.com/Documentation/Splunk/9.4.0/DashStudio/trellisLayout. Specifly like this sample. With each month, cost and the trend line comparing to previous month.

chrisboy68 · ‎01-27-2025

Keep getting "Select a valid trellis split by field", used "_time" and tried "monthly_cost" .

chrisboy68 · ‎01-27-2025

Hi, struggling to get single values to show with trendline comparing to previous month. | bin span=1mon _time | chart sum(cost) as monthly_costs over bill_date Tried differnt varations. The above will show a single value for each month, but I want to add a trendline to the single value to compare to the previous month. Any ideas? Thanks!

chrisboy68 · ‎01-24-2025

chrisboy68 · ‎01-24-2025

Ah ok. I changed the definitiion to below. Its still not working, time picker is ignoring the time. Anything else I should do?

chrisboy68 · ‎01-24-2025

Hi, Struggling trying to figure out what I'm doing wrong. I have the following SPL | inputlookup append=t kvstore | eval _time = strptime(start_date, "%Y-%m-%d") | eval readable_time = strftime(_time, "%Y-%m-%d %H:%M:%S") start_date is YYYY-MM-DD, when I modify the _time, I can see it is changed via readable_time, but the timepicker still ignores the change. I can say search last 30 days and I get the events with _time before the range in the timepicker. Any ideas? Thanks!

chrisboy68 · ‎12-03-2024

Reading through the Ideas, there are a few written different ways that will yield the same result. This is the simplest explanation, https://ideas.splunk.com/ideas/PLECID-I-606. If we can use * as a literal, then it will help your problem too. What would be best is to be able to implement a regex statement. At my shop, it would be ok to do index=ABCDE*, but not index=A*.

chrisboy68 · ‎04-11-2023

Hi, We already have a case open but wondering if someone else ran into this problem. Randomingly Scheduled Searches are losing the original owner and defaulting to Other This causes the cron scheduled to be running at the wrong times, since the timezone defaults to the system timezone. Does anyone have any experience in figuring out why the owner is being changed to Other? We use SAML. Thanks Chris

chrisboy68 · ‎07-21-2022

No. We ended up going with another solution (product outside of Splunk). The TA was very buggy and does not scale or cluster aware (just one HF doing work). It caused us many headaches. For smaller shops, I'm sure it works fine. Chris

chrisboy68 · ‎06-01-2022

Hi, trying to get stats of user search stats. I'm struggling trying to workaround the 10K limit with distinct , stats dc(sids) in the below query. ("data.search_props.type"!=other "data.search_props.user"!=splunk-system-user AND "data.search_props.user"!=admin data.search_props.sid::* host=* index=_introspection sourcetype=splunk_resource_usage) | eval mem_used='data.mem_used', app='data.search_props.app', elapsed='data.elapsed', label='data.search_props.label', intro_type='data.search_props.type', mode='data.search_props.mode', user='data.search_props.user', cpuperc='data.pct_cpu', search_head='data.search_props.search_head', read_mb='data.read_mb', provenance='data.search_props.provenance', label=coalesce(label,provenance), sid='data.search_props.sid' | rex field=sid "^remote_[^_]+_(?P<sid>.*)" | eval sid=(("'" . sid) . "'"), search_id_local=replace('data.search_props.sid',"^remote_[^_]+",""), from=null(), username=null(), searchname2=null(), searchname=null() | rex field=search_id_local "(_rt)?(_?subsearch)*_?(?P<from>[^_]+)((_(?P<base64username>[^_]+))|(__(?P<username>[^_]+)))((__(?P<app>[^_]+)__(?P<searchname2>[^_]+))|(_(?P<base64appname>[^_]+)__(?P<searchname>[^_]+)))" | rex field=search_id_local "^_?(?P<from>SummaryDirector)" | fillnull from value="adhoc" | eval searchname=coalesce(searchname,searchname2), type=case((from == "scheduler"),"scheduled",(from == "SummaryDirector"),"acceleration",isnotnull(searchname),"dashboard",true(),"ad-hoc"), type=case((intro_type == "ad-hoc"),if((type == "dashboard"),"dashboard",intro_type),true(),intro_type) | fillnull label value="unknown" | stats max(elapsed) as runtime max(mem_used) as mem_used, sum(cpuperc) AS totalCPU, avg(cpuperc) AS avgCPU, max(read_mb) AS read_mb, values(sid) AS sids by type, mode, app, user, label, host, search_head, data.pid | eval type=replace(type," ","-"), search_head_cluster="default" | stats dc(sids) AS search_count, sum(totalCPU) AS total_cpu, sum(mem_used) AS total_mem_used, max(runtime) AS max_runtime, avg(runtime) AS avg_runtime, avg(avgCPU) AS avgcpu_per_indexer, sum(read_mb) AS read_mb, values(app) AS app by type, user | eval prefix="user_stats.introspection." | addinfo | rename info_max_time as _time | fields - "info_*" Can someone suggest a tweak in the SPL to get around distinct 10K limit? Thank you, Chris

chrisboy68 · ‎05-02-2022

Awesome, thank you!

chrisboy68 · ‎05-02-2022

chrisboy68 · ‎03-29-2022

Yes. that was exactly what I was looking for.!

chrisboy68 · ‎03-25-2022

Hi, I have a simple stats | stats values(Field1) sum(TB) by Field2 date_month This gives me one row for each month. Field1 10 Field2 Jan Field1 15 Field2 Feb I want to see it like below so each month is on the same row grouped by the fields. Field1 Field2 Jan 10 Feb 15 Tried transpose and some other suggestions. I just keep missing. Thanks, Chris

chrisboy68 · ‎02-23-2022

I figured out a solution. I was over thinking it. index=main ```place all your normal SPL here``` | eval alert_name = "myalert" ```create a variable with this alert name or key``` | lookup AlertSample.csv AlertName AS alert_name output IsOn ```lookup table has 2 columns, AlertName and IsOn``` | search IsOn=true ```evalute to true``` If there is a better way, would be glad to hear it. Chris

chrisboy68 · ‎02-23-2022

Hi, struggling why I can't seem to get this working. I want to have an alert evaluate to true (trigger) based on if its deemed active or inactive in a lookup table. The idea would be SPL would alway check the lookup and if the alert SPL evaluates to true, it would do it normal action. This way, we can have numerous alerts that are disabled (evaluate to false) but just updating one value in a lookup table and not clicking Disable for all alerts. I was thinking i could do something like index=main | append [| inputlookup AlertSample.csv where AlertName=MySampleName | fields IsOn] this and just append the value IsOn to all the events but its not working and I have tried many variants of spl. Suggestions or a better way of doing this? Thank you! Chris

chrisboy68 · ‎02-16-2022

I'm almost there. Now I need to count by each event, as this is totaling for every single event. Looks like I just need to add a group by in the stats. Thank you!

chrisboy68 · ‎02-16-2022

Neat. Trying to follow. I need to have the total of all, not each count. So, in my example, the total is 5.

Posts	144
Solutions	4
Karma Given	1
Karma Received	19
Member Since	‎06-14-2013

Online Status	Offline
Date Last Visited	‎07-03-2025 06:21 AM

Dashboard Studio Format Values on Chart

SPL To only Pull Last Event Per Month

Dashboard Studio Single Value with Trendlines

Lookup Table Modifying _time and timepicker ignori...

Why are scheduled searches defaulting to other and...

How to Work Around Distinct 10K Limit

How to dynamically subtract two last column values...

How to get Stats values by Month as a Column?

How to set an alert to fire based on lookup table ...

Having trouble reading complexed nested Json

Re: Dashboard Studio Format Values on Chart

Dashboard Studio Format Values on Chart

Re: SPL To only Pull Last Event Per Month

Re: SPL To only Pull Last Event Per Month

Re: SPL To only Pull Last Event Per Month

SPL To only Pull Last Event Per Month

Re: Dashboard Studio Single Value with Trendlines

Re: Dashboard Studio Single Value with Trendlines

Re: Dashboard Studio Single Value with Trendlines

Dashboard Studio Single Value with Trendlines

Re: Lookup Table Modifying _time and timepicker ig...

Re: Lookup Table Modifying _time and timepicker ig...

Lookup Table Modifying _time and timepicker ignori...

Re: block any search for index=* with workload

Why are scheduled searches defaulting to other and...

Re: Splunk Add-on for AWS Issues with Kinesis Pull

How to Work Around Distinct 10K Limit

Re: Dynamically Subtract Two Last Column Values

How to dynamically subtract two last column values...

Re: How to get Stats values by Month as a Column?

How to get Stats values by Month as a Column?

Re: How to set an alert to fire based on lookup ta...

How to set an alert to fire based on lookup table ...

Re: Reading complexed nested Json

Re: Reading complexed nested Json

Join the Conversation