Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About TylerJVitale
TylerJVitale
Explorer
Member since:
07-16-2018
10-23-2023
Community Statistics
| Posts | 34 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 07-16-2018 |
Activity Feed
- Posted Re: How can I make a more efficient lookup search? on Splunk Cloud Platform. 10-23-2023 08:40 AM
- Posted How can I make a more efficient lookup search? on Splunk Cloud Platform. 10-23-2023 08:01 AM
- Tagged How can I make a more efficient lookup search? on Splunk Cloud Platform. 10-23-2023 08:01 AM
- Posted How to find all alerts with a specific alert action? on Splunk Search. 10-27-2020 07:46 AM
- Got Karma for Why Can't I Edit my KPI Search Schedule?. 06-05-2020 12:50 AM
- Posted Re: How to Bulk Delete Duplicate Entities on Splunk ITSI. 10-22-2019 04:25 AM
- Posted Re: Why Can't I Edit my KPI Search Schedule? on Splunk ITSI. 10-22-2019 04:13 AM
- Posted How to Bulk Delete Duplicate Entities on Splunk ITSI. 10-21-2019 11:47 AM
- Posted Why Can't I Edit my KPI Search Schedule? on Splunk ITSI. 09-11-2019 08:31 AM
- Posted Splunk ITSI: Not Seeing Results in Deep Dive on Splunk ITSI. 09-09-2019 07:11 AM
- Posted Re: Splunk Machine Learning Toolkit: How to iterate through a result set and then run an outlier detection? on All Apps and Add-ons. 08-01-2019 05:10 AM
- Posted Re: Splunk Machine Learning Toolkit: How to iterate through a result set and then run an outlier detection? on All Apps and Add-ons. 08-01-2019 04:32 AM
- Posted Re: Splunk Machine Learning Toolkit: How to iterate through a result set and then run an outlier detection? on All Apps and Add-ons. 07-31-2019 05:14 AM
- Posted Re: Splunk Machine Learning Toolkit: How to iterate through a result set and then run an outlier detection? on All Apps and Add-ons. 07-31-2019 04:49 AM
- Posted Splunk Machine Learning Toolkit: How to iterate through a result set and then run an outlier detection? on All Apps and Add-ons. 07-29-2019 06:29 AM
- Tagged Splunk Machine Learning Toolkit: How to iterate through a result set and then run an outlier detection? on All Apps and Add-ons. 07-29-2019 06:29 AM
- Posted How to Find Standard Deviation of a Daily Volume? on Splunk Search. 07-19-2019 05:29 AM
- Tagged How to Find Standard Deviation of a Daily Volume? on Splunk Search. 07-19-2019 05:29 AM
- Posted Combining Fields into a Table on Splunk Search. 07-17-2019 10:14 AM
- Tagged Combining Fields into a Table on Splunk Search. 07-17-2019 10:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-23-2023
08:40 AM
Yes, the lookup definition contains all necessary fields, including the new ones. I am wanting to update the same Server and Time rows as well as add new ones. I'm using Splunk cloud, so I'm not sure there's a way to use accelerated fields?
... View more
10-23-2023
08:01 AM
I have a large KV store lookup (approximately 1.5-2 million rows and 4 columns), and I need to create a search that adds 2 new columns into it from corresponding data.
Essentially the lookup is like this:
Server
Time
Variable1
Variable2
and I need it to look like this:
Server
Time
Variable1
Variable2
Variable3
Variable4
My current search is like this:
index=index sourcetype=sourcetype
| stats count by Server Time Variable3 Variable4
| fields- count
| lookup mylookup Server Time OUTPUT Variable1 Variable2
| outputlookup mylookup
The problem I'm running into is that the search gets caught on that lookup command for 2+ hours, and I'm not sure why it's taking so long to match that data.
Does anyone have any insight on why that is occurring or how I can restructure my search to accomplish my need in a more efficient way? Or would it be better to try updating the kv store via restAPI from the same script that is generating variable3 and variable4?
... View more
Labels
- Labels:
-
troubleshooting
-
using Splunk Cloud
10-27-2020
07:46 AM
I'm trying to find all the saved alerts that have a certain action. I've found this search: |rest/servicesNS/-/-/saved/searches | search alert.track=1 actions="*action*" | fields title description search disabled triggered_alert_count actions However, this only returns some of the alerts with that action, and I'm not sure why. It looks like any alert that has other actions that are alphabetically before "action" are in the results, but any alert that has other actions alphabetically after "action" are not returned. Any assistance would be much appreciated.
... View more
10-22-2019
04:25 AM
I've looked at that and it only shows how to delete duplicates from SAI, which is not an issue in my instance, or how to disable recurring entity import searches, not how to delete the duplicate entities that have already come in
... View more
10-22-2019
04:13 AM
Splunk Support found a fix after 1.5 months, so I recommend opening a ticket with them. I don't know what the fix was
... View more
10-21-2019
11:47 AM
In the ITSI health check dashboard, it found almost 700 duplicate entities, and I couldn't find any references on how best to handle this.
Is there an efficient way to delete all the extra copies?
... View more
09-11-2019
08:31 AM
1 Karma
In ITSI, when I go to configure my KPIs, the Search Schedule option is always locked. Does anyone know why I can't change this?
Additionally, when I create a generic KPI from scratch, the Calculation Controls tab won't load, but when I save the KPI and then go back in to edit it, the tab loads. Why doesn't it ever work the first time?
... View more
09-09-2019
07:11 AM
I'm trying to investigate a spike in events that occurred this weekend, but in my deep dive, it says there are no results. However, when I edit my KPI and look at the thresholding (and when I run the search), I do get results.
Does anyone know why I'm seeing results everywhere except in my deep dive?
Edit: I cloned one of the KPIs and now see results for it in Deep Dive. I still see no results for the old KPIs though.
... View more
08-01-2019
05:10 AM
Also, the predict command requires a preceding timechart, at least in my version of the MLTK. And then with timechart it gets all messy if you try to predict by host
... View more
08-01-2019
04:32 AM
This might work. I would have loved to use the DensityFunction but we don't have the MLTK 4.2, and IQR or StandardDeviation won't work because they can't filter seasonality and trend.
Few questions:
In the makeresults pipe, if I'm using the contents of a lookup, how would I write that (say for example I'm outputting the results of a scheduled report to "mylookup"?
In the split command, where you have host1, host2, etc., are those just stand-ins for the actual host names? I want the list of hosts to be dynamic based on another search I have (which uses standard deviation to narrow the list of potential outliers), so how can I account for that?
Thanks,
Tyler
... View more
07-31-2019
05:14 AM
This seems like it could work. I'm just having difficulty figuring out how to configure it. At the end of my initial query, I have a table with host avg VOLUME. I want to run the timechart and prediction for each host, but even just tacking on something like |map search="search index=index sourcetype="sourcetype" host="$host$"
| timechart span=1h sum(VOLUME)" gives me no results, so I'm not sure where the issue is or how to fix it. My best guess is it's something with the search ID field.
... View more
07-31-2019
04:49 AM
The forecasting algorithm in MLTK has an outlier panel, so why shouldn't I use it? It does exactly what I want it to, creating a model that accounts for seasonality and trend and then constructing a CI around that. If the number of crashes falls outside that CI, I would like to be alerted. Why is this not okay?
As for the new MLTK, we're not up to date on it and I'm not sure if/when we will upgrade, so this will have to do for now
... View more
07-29-2019
06:29 AM
I want to run a daily alert to check for outliers in host crashes via the MLTK time series forecast algorithm; however, the syntax is not optimal for forecasting multiple hosts, so I have an initial filter which shows the list of hosts if the amount of crashes is higher than average. I want to take this output and then, for each host in the list, run the outlier detection as follows:
| timechart span=1d sum(VOLUME)
| predict "sum(VOLUME)" as prediction algorithm="LLP5" future_timespan="30" holdback="14" period=7 lower"95"=lower"95" upper"95"=upper"95"
| eval isOutlier = if(prediction!="" AND 'sum(VOLUME)' !="" AND ('sum(VOLUME)' < 'lower95(prediction)' OR 'sum(VOLUME)' > 'upper95(prediction)'), 1, 0)
| where isOutlier=1
| fields - isOutlier
But I'm not sure the best way to go about this. I know I can output the results from my initial filtering search to a lookup and then have separate queries that say "for the host from row 1, run outlier detection," and then "for host from row 2, run outlier detection," etc. but this would require separate alert queries for however many rows I would want to include. What I would really like is a query that iterates through the results of my initial filter, and then for each row, grab the host and run the outlier detection. Is there a way to run a loop like this?
... View more
07-19-2019
05:29 AM
I'm trying to find the standard deviation of the daily volume of traffic per host. index=index sourcetype=sourcetype earliest=-7d|stats sum(VOLUME) by host gives me the Total Volume per host over the last week, and index=index sourcetype=sourcetype earliest=-7d|stats sum(VOLUME) as VOLUME by host|eval avg=VOLUME/7 gives me the average daily volume per host. But if I try `stdev(avg)', or anything like that, I get no results. How can I get the standard deviation I want?
Note- I'm trying to do this in order to set up an alert to trigger if a daily volume falls outside the 95% confidence interval, so if there's an easier way to do that, please let me know.
... View more
07-17-2019
10:14 AM
I want to combine the data from a prediction algorithm on crashed applications with additional data about the crashed applications, namely the count of affected users. Right now, index=index sourcetype="sourcetype" APPLICATION="app*"| timechart span=1d sum(VOLUME) | predict "sum(VOLUME)" as prediction algorithm="LLP5" future_timespan="30" holdback="0" period=7 lower"95"=lower"95" upper"95"=upper"95" | eval isOutlier = if(prediction!="" AND 'sum(VOLUME)' !="" AND ('sum(VOLUME)' < 'lower95(prediction)' OR 'sum(VOLUME)' > 'upper95(prediction)'), 1, 0) | where isOutlier=1 | fields - isOutlier|rename sum(VOLUME) as "Actual Crashes", prediction as "Predicted Crashes" gives me what I want for the prediction data,
and index=index sourcetype="sourcetype" APPLICATION="app*"| timechart span=1d dc(USERNAME) as "Users" gives me the count of users,
but index=index sourcetype="sourcetype" APPLICATION="app*"| timechart span=1d sum(VOLUME) | predict "sum(VOLUME)" as prediction algorithm="LLP5" future_timespan="30" holdback="0" period=7 lower"95"=lower"95" upper"95"=upper"95" | eval isOutlier = if(prediction!="" AND 'sum(VOLUME)' !="" AND ('sum(VOLUME)' < 'lower95(prediction)' OR 'sum(VOLUME)' > 'upper95(prediction)'), 1, 0) | where isOutlier=1 | fields - isOutlier|rename sum(VOLUME) as "Actual Crashes", prediction as "Predicted Crashes"|join[search index=index sourcetype="index" APPLICATION="app*"| timechart span=1d dc(USERNAME) as "Users"] doesn't give me the correct count of users in the table.
Any ideas on how to combine these searches properly?
... View more
07-09-2019
04:56 AM
@skoelpin I would like to do something like |stats max() by application though, and "application" is not a common field.
... View more
07-08-2019
12:11 PM
If I have one index that pairs host with application data, and another index that pairs host with statistical values like cpu %, memory, etc., how do I merge the indices so that a search like host=host1 application=app|stats avg(cpu) would work?
... View more
- Tags:
- splunk-enterprise
07-08-2019
08:04 AM
Sorry the xml formatting isn't right. I'm not sure how to fix that.
... View more
07-08-2019
07:47 AM
In my dashboard, I have the user select a server and then a line chart displays of application crashes on the selected server. I also want a drilldown set up so that if the user clicks a server from another table on the dashboard, the line chart adds data from the drilldown server. However when I try to set this up, the line chart will only populate if both the multiselect input and the drilldown are selected. How do I fix this so that data will load if no drilldown is selected?
<label>Host</label>
<choice value="*">All</choice>
<default>*</default>
<delimiter>","</delimiter>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>index=*|stats count by host</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="time" token="time">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<panel>
<chart>
<search>
<query>index=* host IN ($host$) OR host="$hostclick$"|timechart count(EventCode) by host</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel>
<table>
<title>Top 20 Hosts</title>
<search>
<query>index=*|top host limit=20</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<set token="hostclick">$click.value$</set>
</drilldown>
</table>
</panel>
... View more
07-02-2019
07:29 AM
|bin _time span=4h|stats avg(Value) as "Last 4h"|join [search |bin _time span=24h|stats avg(Value) as "Last 24h"]|sort- _time|head 1
@mdsnmss As of now I have this and if I have a report run every hour and append the results to a csv lookup file, I think it should work, giving me an average over the last 4h and last 24h, right?
However, I'm doing this for someone else and I think they might need historical data, like doing this same thing, but from every hour over the past 24 hours, and I'm not sure if that is possible. If it is, great. If not, if you could just look over my query and tell me if that's what I can do going forward, I'd appreciate it.
... View more
07-02-2019
06:22 AM
I want to be able to create a report of available memory from the last 24 hours, checking the available memory the last 4 hours each our. So for example,
9am: Available Memory from 5-9am
10am: Available Memory from 6-10am
and so on. How would I set this up?
... View more
- Tags:
- splunk-enterprise
07-01-2019
05:37 AM
I want to set up an alert to trigger if three conditions are met:
Volume of a particular app is above 100 over the last 4 hours
Total volume is above 1000 over the last 4 hours
Total Volume over the last hour is at least 100
Right now my search is:
| stats sum(VOLUME) as VOLUME, count(USERNAME) as AFFECTED_USERS by APPLICATION | eventstats sum(VOLUME) as TOTAL|
join [ search | stats sum(VOLUME) as TOTAL_VOLUME earliest=-1h ]|where TOTAL > 1000 and VOLUME>100 and TOTAL_VOLUME>100
How can I tweak my search to get what I'm looking for?
... View more
06-26-2019
07:56 AM
I want to forecast a time series and see how accurate the prediction model is. The forecast SPL is:
| timechart span=1d sum(VOLUME) | predict "sum(VOLUME)" as prediction algorithm="LLP5" future_timespan="365" holdback="0" period=365 lower"95"=lower"95" upper"95"=upper"95" | forecastviz(365, 0, "sum(VOLUME)", 95)
Is there a way I can tell the algorithm to use only data from up to 6 months ago, forecast the next 6 months, and then overlay the real timechart from the past 6 months? Also if it could include the r squared and RMSE that would be fantastic.
... View more
06-25-2019
11:07 AM
Additionally, if anyone knows of a better/more accurate way to run this forecast, I'd appreciate any suggestions.
... View more
06-25-2019
10:53 AM
I'm running a Kalman LLP5 algorithm within the MLTK to predict application crashes and account for trend and seasonality.
My search is:
| timechart span=1d sum(VOLUME) | predict "sum(VOLUME)" as prediction algorithm="LLP5" future_timespan="365" holdback="0" period=365 lower"95"=lower"95" upper"95"=upper"95" | `forecastviz(365, 0, "sum(VOLUME)", 95)`
However, as you can see, the algorithm predicts clear outliers just because they happened at the same time last year.
Is there a way to filter this out? And additionally, once it is filtered out, can I set an alert to tell me if the trend in the future does not follow this predicted trend or if there are outliers that fall well outside this confidence interval?
... View more
