I have two summary reports over an index, and one sourcetype is missing from one. The reports are: index="esam" | eval fred=sourcetype.":".host | eval time=strftime(_time,"%Y-%m-%d") | stats count BY time, fred | xyseries time, fred, count and: index="esam" | eval date=strftime( _time, "%Y-%m-%d" ), channel=COALESCE(channel,' ') | stats min(_time) AS min_time, max(_time) AS max_time, count BY sourcetype, date, channel, host | fieldformat min_time=strftime(min_time, "%Y-%m-%d %H:%M:%S.%3N") | fieldformat max_time=strftime(max_time, "%Y-%m-%d %H:%M:%S.%3N") one sourcetype is present in the results of the first report and missing from the second. Can you advise where to look for the problem? ... View more

I frequently have to create stats reports where some parts are, essentially, executable in parallel with others. An example would be: search <something> | appendpipe [ eval _time=FLOOR(_time/60)*60 | stats DC(id) unique_devices_minute BY device_type, _time ] | appendpipe [ eval _time=FLOOR(_time/3600)*3600 | stats DC(id) unique_devices_hour BY device_type, _time ] | appendpipe [ eval _time=FLOOR(_time/86400)*86400 | stats DC(id) unique_devices_day BY device_type, _time ] | eval _time=FLOOR(_time/60)*60 | stats <<some summaries>> SUM(unique_devices_minute) AS unique_devices_minute, SUM(unique_devices_hour) AS unique_devices_hour, SUM(unique_devices_day) AS unique_devices_day BY device_type, _time | eval period="minute" | appendpipe [ eval _time=FLOOR(_time/3600)*3600 | stats <<sum per-minute to per-hour>> SUM(unique_devices_hour) AS unique_devices_hour, SUM(unique_devices_day) AS unique_devices_day BY device_type, _time | eval period="hour" ] | appendpipe [ where period="hour" | eval _time=FLOOR(_time/86400)*86400 | stats <<sum per-hour to per-day>> SUM(unique_devices_day) AS unique_devices_day BY device_type, _time | eval period="day" ] | eval unique_devices=CASE(period="minute",unique_devices_minute,period="hour",unique_devices_hour,eval period="day",unique_devices_day ) | fields - unique_devices_minute, unique_devices_hour, unique_devices_day This gives the results I want in a single report, but is it the most efficient way to structure this? ... View more

I have two frequent needs which are unnecessarily difficult to do in Splunk: example 1: ... | appendpipe [ where type="A" | makecontinuous span=1m _time | where ISNULL(type) | eval type="A" ] | appendpipe [ where type="B" | makecontinuous span=1m _time | where ISNULL(type) | eval type="B" ] | appendpipe [ where type="C" | makecontinuous span=1m _time | where ISNULL(type) | eval type="C" ] | appendpipe [ where type="D" | makecontinuous span=1m _time | where ISNULL(type) | eval type="D" ] ... example 2: ... | appendpipe [ stats COUNT AS count_up BY _time, type ] | appendpipe [ eval _time=_time+duration | stats COUNT AS count_down BY _time, host ] | where ISNOTNULL(count_up) OR ISNOTNULL(count_down) | stats SUM(count_up) AS count_up SUM(count_down) AS count_down BY _time, host | eval concurrent_change=count_up-count_down | streamstats global=false SUM(concurrent_change) AS concurrency BY host ... (not perfect, but good enough) Both makecontinuous and concurrency commands would be much improved (and the reports run faster) by the addition of a BY clause. Where should I post this suggestion? ... View more

I'm trying to fill in the gaps in a set of data, where there are different gaps for each of the types. I've tried: ... | appendpipe [ stats FIRST(device_id) AS device_id BY day, device_type | map maxsearches=20 search="where device_type=\"$device_type$\" | makecontinuous day span=1 | where ISNULL(device_type) | eval device_type=\"$device_type$\", device_id=\"$device_id$\" " ] ... But I get no results from that. I've tried multiple variants of this, with & without quotes, with & without the where s. All give me nothing ... The makecontinuous on its own does create the missing entries, but without the relevant device_type values, and without multiple events (one for each missing type) on each day. Any advice / comment / better way of doing this? Thanks David ... View more

When installing latest version on Linux, with a splunk OS user set (SPLUNK_OS_USER=splunk) in etc/splunk-launch.conf, I get "unable to write 'random state'" when it's generating the keys. This means the ssh keys have been generated with inadequate randomisation. Is there a workaround? ... View more

I want to create a timechart which has results: - count of distinct IP addresses - average of transaction response time, by request type - count of transactions, by request type Each request has an IP address, a type, and a transaction response time. I can't find a way to create or add the count of distinct IP addresses without doing a second pass through the logs, which is inefficient as we have ~750,000 txns per hour. I've tried many different combinations of bin, stats, chart, & timechart, and I got close (a column for each transaction_type of distinct_ip_addresses, count of transactions, sum of response_time), but then couldn't find a way to create the max(distinct_ip_addresses) across the 8 fields (columns) created. Any advice (or a better way)? ... View more