About dadi

dadi · ‎01-02-2013

after some more investigation - It seems that the problem is not in the lookup command but rather on the next phase when I'm taking one of the lookup output parameter and try to use them ($visits$ in my example). If I inline this parameter then it works

dadi · ‎01-01-2013

Thanks for your answer. I'm sorry, I've updated the macro section of the question with many details but kept the command line in psuedo code. In fact the command line is also doing lookup with userId and I've added this info to the question. The fields in weekly cohort are _time, userId, weeklyVisits, firstTime. Any ideas?

dadi · ‎12-30-2012

added info in question. Thanks!

dadi · ‎12-30-2012

Its the same app. If i search for the lookup inline it works, but if I wrap it in a macro and run it from the same search web page (now only call the macro instead of the explicit lookup call), then it fails with this error.

dadi · ‎12-30-2012

hi guys, I've this following command that works perfectly in search query, but doesn't work in macro: .... | lookup myfile.csv userId The error i get is: "Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table." Does anyone has an idea? some more info- the search query is: cohortCalcVisitsLookup("-4w@w1", "-3w@w1", "@w1", weeklyCohort.csv, "weeklyVisits") and the macro is: (index="analytics" table=userSessions earliest=$start$ latest=$end$) | dedup userId | eval startOfPeriod=relative_time(_time, "$snapTo$") | lookup "$lookupCsv$" userId | eval oldFirstTime=firstTime | eval oldVisits=$visits$ | fillnull value=replaceme oldFirstTime | eval $visits$=if(oldFirstTime=="replaceme", startOfPeriod, mvappend(oldVisits , "", startOfPeriod)) | makemv_withspaces($visits$) | eval firstTime=if(oldFirstTime=="replaceme", startOfPeriod, oldFirstTime) | eval _time=startOfPeriod | table firstTime _time userId $visits$ | inputlookup append=true $lookupCsv$ | dedup userId | outputlookup $lookupCsv$ screenshot: Thanks!

dadi · ‎12-30-2012

I'm not sure if you are aware of this issue(splunk 5), but when I've outputlookup with append=true, I wasn't managed to write more than 1198 new records. This solution make the append=true to be unnecessary and work around this bug. Thanks!

dadi · ‎12-27-2012

What appear to be solve it for me was to transfer one of the searches to a lookup file (in a pre processing saved search, see lookup documentation). so now instead of: search1 OR search2 | stats by joinField | where filterCondition it is now: search1 | lookup mycsv joinField

dadi · ‎12-26-2012

Thanks for the answer. I'm already using summery indexing. My problem is the data that should be joined is big. Theoretically, I could split it according to different values of the join field, but it seems to be not the ideal solution. I'm now trying to work with lookup tables, migrating the results of search 2 to reside in a lookup csv file and then my query looks like: search1 | lookup mycsv joinField Does this kind of search have scale limits? assuming the csv file is huge. Thanks again.

dadi · ‎12-26-2012

I've 2 big searches that I need to join. Currently I use this paradigm for joining: search1 OR search2 | stats by joinField | where filterCondition It is working fine for normal size searches. The problem begins when I try to join really big data (search1 is 300K results while search2 is 1500K results). I'm start seeing that the results are not complete, and some data that was supposed to get joined is not. What am I'm doing wrong? What could be done in splunk to achieve my requirement? (Initially I used the join sub search method, but limited to 50K results it quickly went out of the question) Thanks.

dadi · ‎08-26-2012

Hi , I want to snap to 10 minutes. I know how to snap to an hour for example: ... | eval _time=relative_time(_time,"@h") However, this doesn't work for 10 minutes time. Is there any other way to do it? Thanks

dadi · ‎07-25-2012

hi guys, I want to use eventstats->perc function. This function is form perc*10(x) in order to get the 10 percentile value. I want that the 10 int perc10* will be a variable, meaning that the same function could be used to calculate different percentile values. Is it possible? example: | eval percVal=10 | eventstats perc (count) as topPrecentBar how to make the above statement to work? Thanks.

dadi · ‎07-22-2012

Your second query worked like a charm. I might have learned a thing or two. Thanks a lot!

dadi · ‎07-22-2012

Hi guys, I've the following problem: in my system there are events of users, and I want to get only the top 10% of the active users who appears in the logs. each log entry with the user Id counts and I need only the top 10% of the users who have the most log count. My direction is to do it with top and limit, but I'm not sure how to calculate the value of limit: search event=active | top userId limit=? limit should be the 10% of total unique users ( ... | stats dc(UserId) ), but I'm not sure ho to calculate the total number of unique users in the same search query. Any suggestions? Any idea is welcome.

dadi · ‎07-19-2012

Ok. so basically the answer is NO. I can't have a form and edit capabilities in the same view

dadi · ‎07-18-2012

Are you suggesting that in advanced xml it can be done? Any pointers on how? Thanks.

dadi · ‎07-18-2012

Thanks MHibbin. I've tried to play with my XML but wasn't able to put a form inside a dashboard. Are you suggesting there is no way I can workaround it by editting my xml?

dadi · ‎07-18-2012

In my view I use the in order to get input from the user. In my recently 4.3 installation I've noticed that if I replace the with my view gets editing capabilities but lacks the user input component. Can I enjoy both worlds, having both input component and edit dashboard? I've noticed that if I use advanced xml than the editing capabilities disappear , so in that case I would not want to use advanced xml. Thanks.

dadi · ‎07-17-2012

exactly what I was looking for. thanks.

dadi · ‎07-17-2012

Hi, I've a search where I need to know the time boundaries of the search and use it to further filter results of the same search. In details, lets say I've a search from July 1st to July 3rd. I want to take all the events that are in this particular time boundary(after the initial time filtering splunk search applies) and based on the fact that the search is starting in the 1st of July to further filter the event by some business logic. Is there a way I can retrieve the earliest and latest parameters in the search? I also thought to do it with stats and min(_time) but then I'm losing the context of my original search. any suggestions? Thanks.

dadi · ‎07-07-2012

The solution eventually was to run an index summary query every day in order to get the monthly active users for this day, and in the dashboard to visualize the indexed data in a time chart.

dadi · ‎07-06-2012

Thanks Kristian. I do have log with userId as you noted which is enough to get my user to be "active". The thing is that I need to supply for each day a number that represent the monthly active users calculated especially for that day (going 30 days back for each day and doing distinct count for that 30 day period). Currently I have no leads on how to do it

dadi · ‎07-05-2012

Hi guys, I've a need to have a monthly active unique users chart. The catch is that I need to present each day the total of the active users from the previous 30 days(each day will have different value). I do have log with userId as which is enough to indicate that the user is active. The thing is that I need to supply for each day a number that represent the monthly active users calculated especially for that day (going 30 days back for each day and doing distinct count for that 30 day period). Can you suggest a way of doing that? Example maybe? [for example if I have 3 users that have been active: user 1 on the 1st, and 4th user 2 on the 2nd user 3 on the 3rd The graph of the next month if breakdown by day will show: 1st - 3 users 2nd - 3 users 3rd - 2 users 4th - 1 user 5th - 0 users ]

dadi · ‎03-21-2012

thanks. i did that, but than i need to restart the service (right?), and this can't be done without administrator privilages.

dadi · ‎03-21-2012

Hi, I install Splunk Universal Forwarder on a Windows server 2008. The Splunk-Server IP is known only after startup. So i want to set the destination only after windows start, and i want to do it from non-administrator account. I was able to do it from administrator account (run splunk, set forward-server, restart). But i cant do it from non-administrator account. Any idea how to do it? thanks, Doron

dadi · ‎06-30-2011

I found the answer in here

Posts	26
Solutions	3
Karma Given	7
Karma Received	10
Member Since	‎06-27-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

lookup doesn't work in macro

problem joining big data

snap to 10 minutes

using perc with variable percentile value

limit top to return percentage of total distinct c...

Can a form be also a dahsboard?

retrieve earliest and latest boundaries of a searc...

Monthly active users query

Set universal forwarder destination after startup

How can I omit the timestamp and host that splunk ...

Re: lookup doesn't work in macro

Re: lookup doesn't work in macro

Re: lookup doesn't work in macro

Re: lookup doesn't work in macro

lookup doesn't work in macro

Re: Does outputlookup append or overwrite?

Re: problem joining big data

Re: problem joining big data

problem joining big data

snap to 10 minutes

using perc with variable percentile value

Re: limit top to return percentage of total distin...

limit top to return percentage of total distinct c...

Re: Can a form be also a dahsboard?

Re: Can a form be also a dahsboard?

Re: Can a form be also a dahsboard?

Can a form be also a dahsboard?

Re: retrieve earliest and latest boundaries of a s...

retrieve earliest and latest boundaries of a searc...

Re: Monthly active users query

Re: Monthly active users query

Monthly active users query

Re: Set universal forwarder destination after star...

Set universal forwarder destination after startup

Re: How can I omit the timestamp and host that spl...