About caviman2201

caviman2201 · ‎06-08-2018

I have a bunch of hosts streaming logs that show metrics like cpu count. The problem is that they all send those logs at different times. I'm trying to calculate perform math on the aggregate metrics, but everything is wrong because I can't figure out how to perform math on the values from distinct hosts. I've searched for deduping on a span and got nowhere. Logs look something like this: 1:00:01 - ip=192.168.1.5 cpu_count=8 1:00:01 - ip=192.168.1.6 cpu_count=8 1:00:02 - ip=192.168.1.7 cpu_count=8 1:00:03 - ip=192.168.1.8 cpu_count=8 1:00:03 - ip=192.168.1.7 cpu_count=8 1:00:03 - ip=192.168.1.5 cpu_count=8 1:00:03 - ip=192.168.1.6 cpu_count=8 1:00:04 - ip=192.168.1.7 cpu_count=8 1:00:04 - ip=192.168.1.8 cpu_count=8 what i want to do is something like | dedup span=1m by ip | eval TotalPercent = cpu_count * 100 | timechart sum(TotalPercent) AS TotalAvailableCPUPercent hope that makes sense

caviman2201 · ‎07-21-2014

I have the following data: DateTime GroupName Count 2014-07-14T12:00:00 Group1 15 2014-07-14T12:00:00 Group2 17 2014-07-14T12:00:00 Group3 19 2014-07-15T12:00:00 Group1 18 2014-07-15T12:00:00 Group2 20 2014-07-15T12:00:00 Group3 25 2014-07-16T12:00:00 Group1 19 2014-07-16T12:00:00 Group2 20 2014-07-16T12:00:00 Group3 25 2014-07-17T12:00:00 Group1 22 2014-07-17T12:00:00 Group2 25 2014-07-17T12:00:00 Group3 30 2014-07-18T12:00:00 Group1 25 2014-07-18T12:00:00 Group2 32 2014-07-18T12:00:00 Group3 35 What I want is to have Splunk display it like so: Group Monday Tuesday Wednesday Thursday Friday Group1 15 18 19 22 25 Group2 17 20 20 25 32 Group3 19 25 25 30 35 This will only ever display 1 week's worth of data, so the width of the table isn't a concern. Thanks in advance for any assistance! So far, I have this to pull the weekday out. <search> | eval WeekDay=upper(substr(date_wday,1,1)).substr(date_wday,2)

caviman2201 · ‎07-14-2014

Thanks so much.

caviman2201 · ‎07-14-2014

Ah ha! That worked! for some reason the >, <, = symbols worked but the &gt, etc ones in the XML above did not. Do you know how to get it to sort by FreeSpacePercent so that the lowest is on top? piping that to Sort FreeSpacePercent didn't do anything.

caviman2201 · ‎07-14-2014

This just generates a blank chart with a legend containing redCritical, yellowWarning and greenOK.

caviman2201 · ‎07-14-2014

Here's the search with the working evals: sourcetype="csv" Datastore=* | eval redCritical = if(FreeSpacePercent <= 15,Datastore,0) | eval yellowWarning = if(FreeSpacePercent > 15 AND FreeSpacePercent <=20,Datastore,0) | eval greenOK = if(FreeSpacePercent >20,Datastore,0) | table Datastore,FreeSpacePercent | Sort FreeSpacePercent I just don't know what to do from here and that white paper really doesn't help...

caviman2201 · ‎07-14-2014

I did see that post and was able to generate the "evals" I need to make this work. I just don't know how to actually get the chart to display those evaluated values. It's more the charting part than the eval part that I need help with and that post just says "read this white paper".

caviman2201 · ‎07-14-2014

I have a very simple bar chart that I'm trying to configure so that the bar colors turn red if the value for "FreeSpacePercent" is under 10, yellow if its between 10 and 20 and green if above 20. The chart displays the free space on various datastores in our vCenter environment. Here's my search: sourcetype="csv" Datastore=* | table Datastore,FreeSpacePercent | sort FreeSpacePercent I've looked at several different posts on this, but they all appear to rely on stats and counts. Thanks in advance.

caviman2201 · ‎07-03-2014

Sure - I understand that. We're all about automating here and that's exactly what we're doing now... generating the reports in Excel. The problem is that it has to be done by hand. Part of the whole purpose of us purchasing Splunk was to automate a lot of these analytic reports.

caviman2201 · ‎07-02-2014

Well, it's a report for management, so they really just want one chart that can be slapped on a PP slide...

caviman2201 · ‎07-02-2014

This is awesome - we're getting closer. This helps with the mouse-over time values, but the problem now is the time period. The goal is for this to be a 6-month chart... 😞

caviman2201 · ‎07-02-2014

This works, but for me it creates exactly the same chart as the stats chart. Using the cont=F option removes the time on the X-axis and still displays the mouse-over time values in that ugly format. My 2nd option regarding timechart was only because the normal (cont=T) timechart displays mouse-over time values as human-readable and includes the dates on the X-axis.

caviman2201 · ‎07-02-2014

I have built a dashboard panel for management that shows concurrent connections by hour during peak hours to one our VDI environment. It also includes a trendline. It works great except by doing a chart using "stats" instead of "timechart", I can't get the X-axis to show the dates and the mouse-over values show the date as this hard to read format. For instance, 4/10/2014 at 3PM shows as "2014-04-10T15:00:00.000-04:00". When I display my data, which is excluding nights and weekends, in a timechart, the dates appear and the time values are human-readable, but the nights and weekends are just plotted with no data instead of a smooth line. I either need to figure out how to get dates to show on the X-axis of a stats chart along with readable time values or I need to figure out how to get timechart to exclude nights and weekends completely... as in not plot them all so the line at 5PM on Friday directly connects to 9AM on Monday. Here is my query: sourcetype=csv host=host123 date_hour>=9 date_hour<=17 (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR date_wday=friday) | stats sum(ConnectedSessions) by _time | trendline sma24(sum(ConnectedSessions)) as "24hr Moving Average" | rename sum(ConnectedSessions) as "Hourly Live Connections"

caviman2201 · ‎06-30-2014

So there's really no point to a Heavy Forwarder then over a Light Forwarder if I have to do almost everything in the text files anyway... The problem I'm running into is that I want to be able to use the GUI's text file preview/source type creation wizard AND have the forwarder send the events to my indexer as opposed to indexing them locally... Are you saying that isn't possible?

caviman2201 · ‎06-27-2014

I have several heavy forwarders in my environment and when I configure data inputs on them, to get the forwarder to send the events to my indexer and put them in a specific index, I have to use inputs.conf. Is there any way to add the indexes on my indexer to the available indexes in the drop-down menu on the web interface of the heavy forwarder?

caviman2201 · ‎06-13-2014

I have the following data: Time FileName FileSize 5/4/2010 stuff.txt 151 7/15/2010 whatever.txt 252 6/5/2011 things.txt 353 6/7/2012 yes.txt 454 8/5/2012 no.txt 555 9/10/2013 blah.txt 656 What I need is an output showing the number of files from each year and the total size of files from that year. I got the first part by doing: index=temp_index | stats count by date_year This outputs: Date_Year Count 2010 2 2011 1 2012 2 2013 1 What I need is a third column that adds the total file sizes for each year so: Date_Year Count TotalFileSize 2010 2 403 2011 1 353 2012 2 1009 2013 1 656

Posts	16
Solutions	0
Karma Given	5
Karma Received	3
Member Since	‎04-23-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Sum value from distinct hosts over time

Create Table Group Results

Bar Chart Column Color Based on Value

Display Time in Stats Chart

Add Remote Index to Heavy Forwarder

Sum Total File Size By Year

Sum value from distinct hosts over time

Create Table Group Results

Re: Bar Chart Column Color Based on Value

Re: Bar Chart Column Color Based on Value

Re: Bar Chart Column Color Based on Value

Re: Bar Chart Column Color Based on Value

Re: Bar Chart Column Color Based on Value

Bar Chart Column Color Based on Value

Re: Display Time in Stats Chart

Re: Display Time in Stats Chart

Re: Display Time in Stats Chart

Re: Display Time in Stats Chart

Display Time in Stats Chart

Re: Add Remote Index to Heavy Forwarder

Add Remote Index to Heavy Forwarder

Sum Total File Size By Year