Hi all, I have events similar to these: [10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000001 [10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000001 [10-10-16 18:29:20:057]::TrxThread(A2571700)::DTRACE: Lock acquired for 1000000002 [10-10-16 18:29:20:054]::TrxThread(A2571700)::DTRACE: Lock freed for 1000000002 My objective is to extract TrxThread and subsNumber (ex. 1000000001) and combine them into one variable so that I could differentiate each transaction even though they have the same TrxThread My end goal is to measure the duration so I'll be using the search below once I get the combined transaction thread and subs number | stats earliest(_time) as start latest(_time) as end by combined_trx_id | eval dur=end-start Thanks in advance! Kindest regards, Jeff ... View more

Hi All, I have a set of log that contains events something similar to this: Event A [09-23-16 16:03:35:972] TransactionID(0900001) Request SomeText SomeTxt amount=90 Event B [09-23-16 16:03:35:973] TransactionID(0900001) Received packet 'HTTP/1.1 200 OK There are other events for each transaction but I am only interested in these two lines. I need to get the sum of the amount but only for transactions that are successful which is indicated in the next event with status "200 OK" I'm thinking of using transaction command but it would be too expensive. Are there any approach other that grouping it using transaction command? Thanks in advance! -Jeff ... View more

Good day! I am having trouble getting the percentages after grouping the data via case. Any help would greatly be appreciated. Here is the sample data: User ID, Upload, Download User1 1024 4098 User2 512 2231 User3 998 1054 Now, I have this search to group the users by usage index=some_index | eval total=Upload+Download | eval category = case(total>-1 AND total<1048577, "1. Below 1MB", total>1048578 AND total<10485761, "2. 1MB to 10MB", total>10485760 AND total<20971521, "3. 10MB+ to 20MB", total>9663676416, "4. Above 9GB") | stats count, sum(total) AS Payload by category | sort category | rename category as "Total Usage", count as "Subscriber Count" from the search above, I get the following result: Total Usage Subscriber Count Payload 1. Below 1MB 51,275 1.21 GB 2. 1MB to 10MB 5,186 22.94 GB 3. 10MB+ to 20MB 3,032 43.55 GB 4. Above 9GB 4,924 77.16 TB My question is, how do I add the percentage of the count and payload for each Category to have a result like the one below: Total Usage Subscriber Count Percentage Payload Payload Percentage 1. Below 1MB 51,275 20% 1.21 GB 2% 2. 1MB to 10MB 5,186 5% 22.94 GB 15% 3. 10MB+ to 20MB 3,032 3% 43.55 GB 17% 4. Above 9GB 4,924 2% 77.16 TB 30% Thank you in advance! ... View more

Good day Splunkers. Splunk newbie here, I have been testing it for a few days already. I can now create searches and dashboards based on saved searches. However, I am having trouble in making 'drill down' to work. For example, I have a pie chart on panel 1 of my dashboard that is drill down enabled.. When I click on a piece, it still opens a new window instead of passing it to the panel below. I already followed the instructions in http://www.splunk.com/base/Documentation/latest/User/UnderstandTableandChartDrilldownActions#Advanced_drilldown_behavior but I might be missing something. Any example / link regarding this would highly be appreciated. Thank you in advanced regards, jeff ... View more