Hi Folks, Can i create summary without using sistats, sicharts etc. My search outputs a table as i don't require to use inbuilt functions like avg, first, count etc. Hence I cannot use one of these si commands. I was wondering if i can just use table field1,filed2, field3 | | addinfo | collect index=summary addtime=t marker=info_search_name=somesearchname ? Thanks, Amit ... View more

Hi Folks, I need to use conditional stats e.g current: | stats avg(res_time) count(res_time) by transaction required | if transaction == tname stats sum(somefield) else count(res_time) by transaction. only one transaction i need sum but count for rest ? More Info: Thanks for the prompt response,Not sure if i'm able to explain the issue properly. Here are details. I had tried eval as you had suggested but since every transaction is one event. I have no issue with avg which i'm already calculating in eval. my event line is: "2011-11-22 00:00:00 tname res_time trans_count" with value let's say: "2011-11-22 00:00:00 SELECT 5 3" |eval res_time = if (transaction =="tname",res_time/trans_count,res_time) | stats by avg(res_time),count(res_time) but requirement is trans_count should be summed up in count for taking volume of transaction and one way was doing is sum(trans_count) only for this transaction and simple count(res_time) for all others since they have one occurrence (trans_count): so that why i need conditional sum for one type of transaction and count for rest. Thanks, Amit ... View more

Hi All, I had distributed search configured with 4.1.3 "forwarder@splunk.com". I have upgraded the splunk to 4.2.1 with free trial license and it was still working. As soon as I changed the license group to use forwarder license. I have lost configurations (for multiple indexers) from distributed search. Can someone help ? i'm unable to configure distributed search from search head ???? ... View more

This is little tricky.....I already know there's a method available which can give me percentile...perc90... but what i would want is not discard the events by value of a percentile but number of events of a percentile....e.g. sorted values are : 1,2,3,4,5,6,6,6,7,8,9.Let's say x percentile of dataset is 5 (by value)... and if i discard greater than 5. it would discard all the three 6. but what i would want is sort and calculate the average X percentage of total which means may be 1,2,3,4,5,6,6. Is there any suggestions how to do this ? Already have search query as below which gives by value...need to find how i can fit the sort and than head x percentage by count ??? .. | eventstats perc90(response_time) as response_time_90p | where response_time < response_time_90p | stats avg(response_time) UPDATE: Thanks for the prompt response. Sorry if I'm not clear. Let's say if i have response times: 1) data= 1,1,3,3,4,4,4,5,6,6,6,9,9,9,9,7,7,7,7,8,8,8,8,2,2 2) Sort data :1,1,2,2,3,3,4,4,4,5,6,6,6,7,7,7,7,8,8,8,8,9,9,9,9 3) Discard Highest 10% of data and keep 90% by volume and not by value. I'm left with 1,1,2,2,3,3,4,4,4,5,6,6,6,7,7,7,7,8,8,8,8,9,9 (CORRECT) 4) take an average of the 90% Did you see the difference if i use perc90(data) on above series I get '9' and If i will calculate average of series less than value 9 i would get 1,1,2,2,3,3,4,4,4,5,6,6,6,7,7,7,7,8,8,8,8 (WRONG) and would miss out on last two nines. Please compare the series WRONG and CORRECT. I hope i'm able to explain the issue. Thanks, Amit ... View more

We are trying to create a dashboard and populated many fields in the drop down to filter. But the data is increasing on drop down , so we are trying to group the data based upon daily, weekly, monthly. I was wondering how do we achieve this in Splunk drop down. In a one line, we would like to populate data in drop down based upon previous select ? Thanks in advance...... ... View more

I need to get average 90th percentile of my results from response time. let say if there are 200 data points; I need to ignore top 20 and take an average of 90%. Something very similar in excel : http://office.microsoft.com/en-us/excel-help/percentile-HP005209211.aspx Kind of reverse top .I tried perc90(response_time) on stats but this ould calulate X=95% of Y and not ignore the entire range. Thanks ... View more