Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About p_splunk
p_splunk
Engager
Member since:
05-11-2012
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 05-11-2012 |
Activity Feed
- Karma Re: two different time modifiers in one search? for lguinn2. 06-05-2020 12:46 AM
- Posted Re: two different time modifiers in one search? on Splunk Search. 02-20-2013 10:08 AM
- Posted two different time modifiers in one search? on Splunk Search. 02-20-2013 04:18 AM
- Tagged two different time modifiers in one search? on Splunk Search. 02-20-2013 04:18 AM
- Tagged two different time modifiers in one search? on Splunk Search. 02-20-2013 04:18 AM
- Tagged two different time modifiers in one search? on Splunk Search. 02-20-2013 04:18 AM
- Posted Re: filldown by clause? on Splunk Search. 11-15-2012 02:34 AM
- Posted Re: filldown by clause? on Splunk Search. 11-14-2012 07:17 AM
- Posted filldown by clause? on Splunk Search. 11-14-2012 03:47 AM
- Tagged filldown by clause? on Splunk Search. 11-14-2012 03:47 AM
- Tagged filldown by clause? on Splunk Search. 11-14-2012 03:47 AM
- Posted Re: Schedule a report to run each day so that query is not run every time viewed on Reporting. 10-10-2012 04:41 AM
- Posted Re: Schedule a report to run each day so that query is not run every time viewed on Reporting. 10-05-2012 05:10 AM
- Posted Re: How do i do a timechart -like resulting, but want the concerned data growing from a fixed startime on Splunk Search. 10-02-2012 05:59 AM
- Posted How do i do a timechart -like resulting, but want the concerned data growing from a fixed startime on Splunk Search. 09-28-2012 06:24 AM
- Tagged How do i do a timechart -like resulting, but want the concerned data growing from a fixed startime on Splunk Search. 09-28-2012 06:24 AM
- Tagged How do i do a timechart -like resulting, but want the concerned data growing from a fixed startime on Splunk Search. 09-28-2012 06:24 AM
- Tagged How do i do a timechart -like resulting, but want the concerned data growing from a fixed startime on Splunk Search. 09-28-2012 06:24 AM
- Posted How to accum a field extra for each user? on Splunk Search. 05-11-2012 07:04 AM
- Tagged How to accum a field extra for each user? on Splunk Search. 05-11-2012 07:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-20-2013
04:18 AM
The problem I'm facing is that I want a search that comes up with the possibility to set different time modifiers for different events.
For examples i want all account-registrations of january and all item-buys of january AND february.
I'm aware of the possibility of append (but it only works on results right, is there a similar function to append events?), but since this uses a subsearch which performs badly I'm searching for a different possibilty.
... View more
11-14-2012
07:17 AM
yes i know this usage (im actually often using | sort 0 +_time ... wonder which one is the "faster")
but the problem is somehow that with big data something stops working, i could imagine of something like maxout or smth, but i cant find any error message in the inspection (any of u have another hint what can be the reason?).
... View more
11-14-2012
03:47 AM
i have events for player accounts, which have player-levels, and have additional events for these accounts, which dont have the field player_level, looks e.g like this
GENERAL-EVENT [ account-name=xxx account-level=1]
GENERAL-EVENT [ account-name=xxx account-level=2]
SPECIAL-EVENT [ account-name=xxx other-field=xxx]
GENERAL-EVENT [ account-name=xxx account-level=3]
SPECIAL-EVENT [ account-name=xxx other-field=xxx]
SPECIAL-EVENT [ account-name=xxx other-field=xxx]
GENERAL-EVENT [ account-name=xxx account-level=4]
and i want to give the SPECIAL-EVENTS the field account-level at which this special-thing has "happened".
so i found | filldown account-level
which works well as long i do a search only over one account-name, but when i want to do searches over all accounts there is nothing like
| filldown account-level by account-name
is there any work-around?????
i'm using 4.3.3
edit: i tried variants with streamstats, but somehow when i use it for a bigger timeframe with many data, it dowsnt work the right way, cuz at some account-levels the level-sum contains 0 special-events, but where i know, that there are some, when i use the search for a specific account.
... View more
10-10-2012
04:41 AM
hey, i found it out now,
you have to have the specific search saved before and then after "edit search" you have to click "Select a saved search" then u are where lguinn says (i think so 😉
that's how mine worked out,
thx
... View more
10-05-2012
05:10 AM
when i see my view/dashboard, do i need to click vie result for every search and then create a scheduled search of this search?
beacuase I cannot find the checkbox u are talking about (i have 4.3.3)
thx for answer
... View more
10-02-2012
05:59 AM
thanks, dunno why i didnt think back to accum function. maybe lost in typing weird requests.
thanks
... View more
09-28-2012
06:24 AM
Hi,
I for example want to track a ratio like UsersWithTag1/AllUsers
wher the users with the specified tag are growing over time and of course also all users.
When i use timechart i can eg. calculate the ratio with span=1d for every day extra and follow how this changes.
This would look like
_time
AllUsers
UsersWithTag1
UsersWithTag1/AllUsers
01.09.2012
50
39
0,78
02.09.2012
60
46
0,77
03.09.2012
62
40
0,65
04.09.2012
52
36
0,69
05.09.2012
34
28
0,82
06.09.2012
44
36
0,82
07.09.2012
92
55
0,60
But what i want is smth where i get daily results for the ratio since the beginning and how this moves. For above example this is
_time
AllUsers
UsersWithTag1
UsersWithTag1/AllUsers
01.09.2012
50
39
0,78
02.09.2012
110
85
0,77
03.09.2012
172
125
0,73
04.09.2012
224
161
0,72
05.09.2012
258
189
0,73
06.09.2012
302
225
0,75
07.09.2012
394
280
0,71
And does splunk have any possiblity to show an trend resp. indicator arrow in the next right column of UsersWithTag1/AllUsers with green for up und red for down or smth like this?
Thanks
... View more
05-11-2012
07:04 AM
Hi,
i want to accumulate a field per user (and time).
so lets say the users are distinguishable by the field user and the field i want to accumulate per user is XP.
if i do smth like
...| sort 0 +_time | stats c(user) as XPgains by user | accum XP as accumXP
I see in the list of logevents that the function accumulates over all users beginnining from first time event to the very last and the accum fct doesn't take any "by user" or smth like this.
how can I get a field which starts counting new for every user?
... View more
- Tags:
- accum
