About Biggy

Biggy · ‎06-27-2018

index=main sourcetype="access_combined_wcookie" file=success.do status=200 | stats sum(Price) as Revenue by ProductName I don't think the quotes and the switching file= and status= around should matter. The above query should return the same results as the one I posted in my original question.

Biggy · ‎06-27-2018

So this is what didn't make sense to me. You said what I thought, search term order before first pipe shouldn't matter. This is the query that ended up working (I had time constraints set to all time for all tries) index=main sourcetype="access_combined_wcookie" file=success.do status=200 | stats sum(Price) as Revenue by ProductName I don't think the quotes and the switching file= and status= around should matter. The above query should return the same results as the one I posted in my original question.

Biggy · ‎06-26-2018

Recently I was working on a lab module 12 - question 22: Search the web application data for all events where a user purchased a product successfully. Use the stats sum function to sum the Price field by ProductName. Name the resulting field Revenue. Originally I typed the following query but did not get any results: index=main sourcetype=access_combined_wcookie status=200 file=success.do | stats sum(Price) as Revenue by ProductName (I tried it both with quotes and without quotes around "access_combined_wcookie) I tried a few things before I scrolled down to see if the answer was any different and I discovered that it was. The only difference that I saw in my opinion do not seem to me like they should affect the results that are returned. Can anyone provide some insight into why the order of the search terms would matter or is this a weird fluke?

Biggy · ‎06-20-2018

cbreshears, The data was uploaded correctly. I honestly can't even imagine how an upload would be ingested incorrectly unless you edit the files that are provided by Splunk. I figured out what was going on today... I noticed that each time a search is executed that the time is reset back to the 24 hour default. Everything appears to be returning results as intended now.

Biggy · ‎06-19-2018

The first time I noticed something might be different was during lab 5. There is a part of the lab that asks you to look at the source type and observe that the results from the query are coming from both the web_server and the web_application. This was not true, all the results came from the web_server. Now in lab 6 it asks me to run a query for index=main sourcetype=access_combined_wcookie action=purchase but no results are returned. I am sure that I will be able to get through the quiz but I am wondering if there is something that needs to be updated such as the data or the lab.

Posts	5
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎06-19-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Order of Search terms - Does it matter?

Has the sample data or the lab changed for Fundame...

Re: Order of Search terms - Does it matter?

Re: Order of Search terms - Does it matter?

Order of Search terms - Does it matter?

Re: Has the sample data or the lab changed for Fun...

Has the sample data or the lab changed for Fundame...