Activity Feed
- Karma Re: Math Within addtotals for cmerriman. 06-05-2020 12:49 AM
- Karma Re: How to configure "guest" access to Splunk-Web with no password? for breyes_splunk. 06-05-2020 12:45 AM
- Posted Re: Math Within addtotals on Splunk Search. 09-06-2017 10:53 AM
- Posted Math Within addtotals on Splunk Search. 09-06-2017 09:47 AM
- Tagged Math Within addtotals on Splunk Search. 09-06-2017 09:47 AM
- Tagged Math Within addtotals on Splunk Search. 09-06-2017 09:47 AM
- Tagged Math Within addtotals on Splunk Search. 09-06-2017 09:47 AM
- Posted Re: Dashboard date-picker resulting in search error due to field's date format. Help? on Splunk Search. 08-18-2017 09:48 AM
- Posted Re: Dashboard date-picker resulting in search error due to field's date format. Help? on Splunk Search. 08-18-2017 06:55 AM
- Posted Re: Dashboard date-picker resulting in search error due to field's date format. Help? on Splunk Search. 08-17-2017 11:57 AM
- Posted Dashboard date-picker resulting in search error due to field's date format. Help? on Splunk Search. 08-17-2017 10:43 AM
- Tagged Dashboard date-picker resulting in search error due to field's date format. Help? on Splunk Search. 08-17-2017 10:43 AM
- Tagged Dashboard date-picker resulting in search error due to field's date format. Help? on Splunk Search. 08-17-2017 10:43 AM
- Tagged Dashboard date-picker resulting in search error due to field's date format. Help? on Splunk Search. 08-17-2017 10:43 AM
- Posted Re: How to search and alert on anomalies/spikes in multiple fields simultaneously? on Alerting. 03-24-2017 02:22 PM
- Posted Re: How to search and alert on anomalies/spikes in multiple fields simultaneously? on Alerting. 03-24-2017 11:17 AM
- Posted Re: How to search and alert on anomalies/spikes in multiple fields simultaneously? on Alerting. 03-24-2017 09:14 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 | |||
0 |
09-06-2017
09:47 AM
I'm trying to do some math with the values calculated in the addtotals command and put them back into the same line but I can't seem to figure out how to do that.
| eval daysEmployed = round((end - HireDate)/86400,0)
| eval daysCanWork = if(HireDate <= start, numWorkDay, round((daysEmployed/7)*5,0))
| eval posibleHours=(daysCanWork-numHolidays) * 8
| eval totWorked=Billable+NonBillable
| eval perBill=Billable/posibleHours
| eval perNonBill=NonBillable/posibleHours
| eval perWorked=totWorked / posibleHours
| eval Billable=round(Billable,2)
| eval NonBillable=round(NonBillable,2)
| eval totWorked=round(totWorked,2)
| eval perBill=round(perBill,2)*100
| eval perNonBill=round(perNonBill,2)*100
| eval perWorked=round(perWorked,2)*100
| addtotals col=true labelfield=Employee Label="Totals" posibleHours Billable NonBillable totWorked
| eval perWorked=perWorked + "%"
| eval perBill=perBill + "%"
| eval perNonBill=perNonBill + "%"
| sort -perBill
| eval HireDate=strftime(HireDate,"%m/%d/%Y")
| rename "Billing Class" as "Job Title", posibleHours as "Possible Hrs Worked", Billable as "Billable Time", NonBillable as "Non Billable time", totWorked as "Total Hrs Worked", perBill as "% Billable Time Worked", perNonBill as "% Non Billable Time Worked", perWorked as "Total % of time Worked", HireDate as "Date Hired"
| fields Employee, "Job Title", "Date Hired", "Possible Hrs Worked", "Billable Time", "Non Billable time", "Total Hrs Worked", "% Billable Time Worked", "% Non Billable Time Worked", "Total % of time Worked"
I'd like to do the following:
Billable / totworked = perBill
NonBillable / totWorked = perNonBill
possibleHours / totWorked = perWorked
If I just add the perBill,perNonBill,perWorked I just get the sums of those columns which is not what I'm trying to acomplish.
... View more
08-18-2017
09:48 AM
I'm not exactly sure that that means. Can you expand on that thought a bit.
... View more
08-18-2017
06:55 AM
That's what I was trying however I'm having trouble converting the time from the date picker into epoc. I can't determine the format coming from the picker.
| eval DayofMth=strptime(DayofMth,"%m/%d/%Y")
| where DayofMth > $selTime.earliest$ AND DayofMth < $selTime.latest$
| rename Non-Billable as NonBillable
Error in 'where' command: The expression is malformed. An unexpected character is reached at '@y AND DayofMth < now '.
... View more
08-17-2017
11:57 AM
I have to compare the date in the picker with a value in a field not using the _time. This search is based off a flat CSV file.
... View more
08-17-2017
10:43 AM
I have a field with a date in the format of %m/$d/%Y. I'm trying to use the date picker in the dashboard to only search for entries that are between the selected field. However I keep getting the error:
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '@y,"%m/%d/%Y")'.
<form>
<label>NS-Job-Month-Employee</label>
<fieldset autoRun="true" submitButton="false">
<input type="time" token="selTime" searchWhenChanged="true">
<label></label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>NS-Job-Month-Employee</title>
<table>
<search>
<query>|inputlookup NetHoursFile
| eval DayofMth=strptime(DayofMth,"%m/%d/%Y")
| eval stTime=strptime($selTime.earliest$,"%m/%d/%Y")
| eval edTime=strptime($selTime.latest$,"%m/%d/%Y")
| where DayofMth > stTime AND DayofMth < edTime
| rename Non-Billable as NonBillable
| eval totalHrs=Billable+NonBillable
When I do a regular search the below works, but I cant figure out how to make the date picker do the same thing.
|inputlookup NetHoursFile
| where DayofMth > "1/1/17" AND DayofMth < "3/1/17"
| rename Non-Billable as NonBillable
| eval totalHrs=Billable+NonBillable
... View more
03-24-2017
02:22 PM
Fixed this last issue by modifying the last line to:
|timechart sum(spike) as spike_count by UserName useother=0
... View more
03-24-2017
11:17 AM
This seems to have done the trick however for some reason both my Table and Graph are doing some grouping of items into an "OTHER" group as appose to have each UserName a distinct value.
index="my_data" earliest=-10d@d
| bucket _time span=1h
| stats count(EventId) as num_events by UserName _time
| streamstats window=5 mean(num_events) as moving_avg by UserName
| eval spike=if(num_events > (4 * moving_avg),1,0)
|timechart sum(spike) as spike_count by UserName
... View more
03-24-2017
09:14 AM
I'm attempting to do they same thing and have tried the above search however my 'num_events' and 'moving_avg' are showing the same number. I'm not sure why it's not showing the averages.
index="my_data" earliest=-10day
|bin _time span=1h
|stats count(EventId) as num_events by UserName
|streamstats window=1 mean(num_events) as moving_avg by UserName
| eval spike=if(num_events > (3 * moving_avg), 1, 0)
... View more