Hello, Yesterday we upgraded to v2.0 to take advantage of new features. Prior to this, there were no problems, but now we're only seeing lookups from 4 of our many apps (about 31 lookups instead of ~150). I'm hoping this is just a simple fix that's obvious and I'm overlooking. Any ideas? Thanks ... View more

Hello, I have a pie chart in a dashboard that, when loaded in its own search, looks like this (correct): http://puu.sh/jYFMd/0d02be5455.png. Prior to this morning, every time it's loaded on the dashboard, it's been fine. However, now it looks like this (broken): http://puu.sh/jYFQJ/94ffcab70c.png. Has anyone experienced this issue / know what's going on? Thanks for your help! ... View more

Hello, I have a query that does 5 searches. A recent search, and four sub searches on the same exact data from 1-4 weeks ago, then compares the 4 week avg to the recent data. The subsearches join on weekday and hour so need to be exactly 7 days prior to the original earliest/latest. Here's a hard-coded example: index="foo" sourcetype="bar" earliest="11/05/2014:12:00:00" latest="11/11/2014:12:00:00" | bucket _time span=1h | stats count as current_joins by _time | eval joiner = strftime(_time,"%w:%H") | join joiner [ search index="foo" sourcetype="bar" earliest="10/29/2014:12:00:00" latest="11/04/2014:12:00:00" |lookup siteid_lookup siteid as site OUTPUT name | fields _time site | bucket _time span=1h | stats count as week_ago_joins by _time | eval joiner = strftime(_time,"%w:%H") | fields joiner, week_ago_joins ] | join joiner [ search index="foo" sourcetype="bar" earliest="10/22/2014:12:00:00" latest="10/28/2014:12:00:00" |lookup siteid_lookup siteid as site OUTPUT name | fields _time site | bucket _time span=1h | stats count as two_week_ago_joins by _time | eval joiner = strftime(_time,"%w:%H") | fields joiner, two_week_ago_joins ] | join joiner [ search index="foo" sourcetype="bar" earliest="10/15/2014:12:00:00" latest="10/21/2014:12:00:00" |lookup siteid_lookup siteid as site OUTPUT name | fields _time site | bucket _time span=1h | stats count as three_week_ago_joins by _time | eval joiner = strftime(_time,"%w:%H") | fields joiner, three_week_ago_joins ] | join joiner [ search index="foo" sourcetype="bar" earliest="10/08/2014:12:00:00" latest="10/14/2014:12:00:00" |lookup siteid_lookup siteid as site OUTPUT name | fields _time site | bucket _time span=1h | stats count as four_week_ago_joins by _time | eval joiner = strftime(_time,"%w:%H") | fields joiner, four_week_ago_joins ] | eval four_week_combined_avg = round((four_week_ago_joins+three_week_ago_joins+two_week_ago_joins+week_ago_joins)/4,2) | eval change_pct = round(((current_joins-four_week_combined_avg)/four_week_combined_avg)*100,2) I've found this analysis to be very useful in analyzing business metrics, especially around release management. I'm trying to figure out a way to create a dashboard where you only need to select an earliest and/or latest time, then the subsearches will adjust accordingly. Any advice would be greatly appreciated, thanks! ... View more

I'm trying to create some monitoring alerts for when errors increase greater than a certain amount compared to their usual amount. I've got it working to compare yesterday to today, but I'd like to compare the daily average of a certain period to today for more accurate results. This is proving to be a little too tricky for me and any help would be greatly appreciated! Here is my current search: index="reseller" sourcetype="oneclick_error_log" Sitename="*" | bucket _time span="d" | stats count AS oneclick_errors by Sitename, _time | delta oneclick_errors as change | eval change_percent=change/(oneclick_errors-change)*100 | sort Sitename | where _time>=relative_time(now(),"-d") AND change_percent > 25 Note: I have the alert set to run at midnight so there is a complete dataset for comparison. ... View more

Hello, I have the following situation that I was hoping to use nested if's to solve. We have a series of errors that are only actionable if they appear over a period of time. Many of the errors share similar messages, so I was hoping to use wildcards to capture them all. Unfortunately, wildcards don't appear to work in if statements, so I was wondering if anyone with more experience (I'm a huge noob) could point me towards a better method that accomplishes the same goal. Here is my current query: index=echelon sourcetype=echelon_error | eval error_type=if( message="Redis search failure*", "Search Failure", (if(message="PHP Fatal error:*", "PHP Fatal Errors", (if(message="sendsoaprequest failed*", "Soap Request Failed", (if(message="*Maximum execution time of 600 seconds exceeded*", "Max Execution Exceeded", (if(message="*Error creating performer_profile entry*", "Performer Profile Entry Error", (if(message="*exception='foo*", "MainController Failure", (if(program="/sync-staging.pl", "Staging Sync Error", ""))))))))))))) | Where error_type !="" | bucket _time span=1h | stats count AS program_count by program, error_type, _time | stats count AS program_occurred_in_x_different_hours, sum(program_count) AS error_occurrences_total by program, error_type | where program_occurred_in_x_different_hours > 1 ... View more