Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gregorymountfor
gregorymountfor
Explorer
Member since:
10-02-2018
08-13-2021
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 10-02-2018 |
Activity Feed
- Posted PerfmonMk:CPU underreports _Total %_Processor_Time on Getting Data In. 08-13-2021 07:19 AM
- Tagged PerfmonMk:CPU underreports _Total %_Processor_Time on Getting Data In. 08-13-2021 07:19 AM
- Tagged PerfmonMk:CPU underreports _Total %_Processor_Time on Getting Data In. 08-13-2021 07:19 AM
- Karma Re: How do you Calculate _time difference between subsearch and main search? for chrisyounger. 06-05-2020 12:50 AM
- Karma Re: How do you Calculate _time difference between subsearch and main search? for woodcock. 06-05-2020 12:50 AM
- Posted Re: How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-12-2019 02:54 AM
- Posted Re: How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-12-2019 02:27 AM
- Posted Re: How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-12-2019 12:47 AM
- Posted Re: How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-12-2019 12:33 AM
- Posted Re: How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-12-2019 12:19 AM
- Posted How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-11-2019 07:45 AM
- Tagged How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-11-2019 07:45 AM
- Tagged How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-11-2019 07:45 AM
- Tagged How do you Calculate _time difference between subsearch and main search? on Splunk Search. 02-11-2019 07:45 AM
- Posted Join two stats searches and run stats/group on the result on Splunk Search. 10-02-2018 04:13 AM
- Tagged Join two stats searches and run stats/group on the result on Splunk Search. 10-02-2018 04:13 AM
- Tagged Join two stats searches and run stats/group on the result on Splunk Search. 10-02-2018 04:13 AM
- Tagged Join two stats searches and run stats/group on the result on Splunk Search. 10-02-2018 04:13 AM
- Tagged Join two stats searches and run stats/group on the result on Splunk Search. 10-02-2018 04:13 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-13-2021
07:19 AM
I track the overall CPU usage on a server with: index=mcadth_metrics host=IS20_DB sourcetype=PerfmonMk:CPU instance=_Total And it works well for all other servers, and for this server until it went down for a reboot about 10 days ago. The server's average CPU load (%_Processor_Time) is usually around 40%, but has been reporting in Splunk at about 5% since the reboot. No config was changed over the time of the reboot; and the Splunk forwarder has been restarted with no change. Image below shows Splunk search for %_Processor_Time returning with an Average of 5.35%. Image below shows actual server metrics reporting at 41% utilization.
... View more
Labels
- Labels:
-
other
02-12-2019
02:54 AM
I just tried the join version again and it worked - I must have forgotten to pass the renamed UID out.
So this was successful:
index=mca_mmr sourcetype=ixs-9 Method=Ingest
| join UID
[ search index=mca_mmr earliest=-4h sourcetype=jbpm process=publishEnd
| eval pub_time=_time | rename uid as UID
| fields UID pub_time]
| eval process_time = pub_time-_time | table UID process_time
... View more
02-12-2019
02:27 AM
still no joy: for some reason the start_time is not getting populated.
I put a | table uid pub_time start_time after this expression and I can see that the start_time is just nonexistent.
I moved the eval start_time = _time to just after the subsearch (before the stats latest(*) ) and now for some reason its value is exactly the same as the pub_time value
... View more
02-12-2019
12:47 AM
yup, I noticed & corrected that.
looking at the outputlookup documentation, I'm suspecting that maybe I don't have appropriate permissions to use the command. I'll check that with our admin later today about that.
... View more
02-12-2019
12:33 AM
I can't understand why the first version (with join ) doesn't work - it just returns 0 results.
I tried renaming uid in the inner & outer search to match but no joy.
The second version (with append ) returns the expected amount of events, but the output table is just uid & pub_time ; not actually the process_time .
I tried adding | table uid process_time which just leaves an empty process_time column, so I'm not sure that the eval is actually working
... View more
02-12-2019
12:19 AM
this gives me errors "Streamed search execute failed because: Error in 'lookup' command: Lookups: The lookup table 'pubtimes.csv' does not exist or is not available. "
I've not used a lookup before so am not sure how to debug this further just yet.
... View more
02-11-2019
07:45 AM
I'm trying to calculate the _time difference between the subsearch and main search; but if I try and pass the time through to the main search, it seems to want to include it in the actual search and return me no results.
So, I have two systems, one to publish and one to ingest. For each publish in the last 4 hours, I want to look back in time and find when its ingestion was to see how long it spent in the system. The linkage between the two searches is the "UID"; but in the subsearch, I have to rename it from uid to UID
My search as follows gives me all the ingest events for the last 4hours' worth of successfully published events
index=mca_mmr sourcetype=ixs-9 Method=Ingest [search index=mca_mmr earliest=-4h sourcetype=jbpm process=publishEnd | rename uid as UID | fields UID]
I would expect something similar to this to work, although I don't know how to pass pub_time through to the main search:
index=mca_mmr sourcetype=ixs-9 Method=Ingest [search index=mca_mmr earliest=-4h sourcetype=jbpm process=publishEnd | rename uid as UID | eval pub_time=_time | fields UID] | eval process_time=pub_time-_time
... View more
10-02-2018
04:13 AM
I'd like to join two searches and run some stats to group the combined result to see how many users change/update browsers how often.
In my IIS logs I have one search that gives me a user agent string ( cs_User_Agent ) and a SessionId ; then another that has the SessionId and the UserId
search 1 retrieves a table of cs_User_Agent and SessionId :
host=HOST1 index=iis sc_status=200 getLicense | sistats dc(SessionId) count by cs_User_Agent
SessionId cs_User_Agent count
0014D886099319E6 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/64.0.3282.140+Safari/537.36+Edge/17.17134 12
0014D953D99FD234 Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/69.0.3497.100+Safari/537.36 5
0014D953D99FD234 Mozilla/5.0+(Windows+NT+6.3;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/69.0.3497.100+Safari/537.36 5
00154D82F471A7AA Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/69.0.3497.100+Safari/537.36 2
0015B3CAC0EC3940 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/68.0.3440.106+Safari/537.36 30
0015C53D737B2991 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/68.0.3440.106+Safari/537.36+OPR/55.0.2994.61 16
search 2 retrieves a table of SessionId and UserId :
host=HOST1 index=iis sc_status=200 authorize | stats count by SessionId, UserId
SessionId UserId count
00061D40BFAB4208 4BJKKEAWGYXEAJH0F5F9DHSC0024 2
0008F091D8E8BE1A 1I7WKS9XIMZ92DCZF6CVKA4E001Q 2
000E5B538CC0A7B2 KQCZIHHPG9IOC9UD7MJICESS005B 1
000FC56381D4EA4B 3PH0F08V00SY9GFPGVCQBIQN006N 3
00106C907ED66683 JALM1LNJ8SV72BNHE1C5H0I50020 3
0013143CBC157C26 ETW9HL7L71PQJB7P492LLFEM006E 4
001E25B42A554F79 702EBB0O8MKG0VI94VIQ01ZE0031 1
I need to join these together to see how many different cs_User_Agent strings the users had during the period and count those.
Basically to see how many of the users change/update browsers very often.
So, my result should look like this:
Number of UA Strings in the period | Number of Users in grouping
>20 1
>10 3
>5 4
5 10
4 3
3 3
2 1
1 14
The results for search 1 & 2 would return A LOT of data, and from reading the subsearch info it sounds like that's not ideal as the whole subsearch would have to stay in RAM? Is there a better way than subsearch to do this?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-13-2021
01:25 PM
|
