About jdaivs

jdaivs · ‎05-12-2014

So I have it now, but it is VERY ugly and takes quite a while to load because the 90 day data is cold. `sourcetype=mysourcedata | eval DEVICE_NAME=coalesce(tag,DEVICE_NAME) | stats count BY DEVICE_NAME, date_month, date_mday | stats avg(count) AS "Average_Alert_Count" BY DEVICE_NAME | inputlookup append=t DEVICE_NAME.csv | fillnull value=0 "Recent_Event_Count" | dedup DEVICE_NAME | eval Average_Alert_Count=round(Average_Alert_Count,2) | join DEVICE_NAME append [search sourcetype=mysourcedata earliest=-24h latest=now | eval DEVICE_NAME=coalesce(tag,DEVICE_NAME) | stats count as Recent_Event_Count by DEVICE_NAME | inputlookup append=t DEVICE_NAME.csv | fillnull value=0 "Recent_Event_Count" | dedup DEVICE_NAME]` Using the lookup table in the subsearch first I was able to get all of the 0 count for last 24h devices but I was still missing a few where the 90 day average was 0 also so I added it to the main search as well and now I am getting everything even where the average and count are 0. Thanks for all the help! This is a mess though. I'd welcome any recommendations on how to clean this up and make to cold data return faster.

jdaivs · ‎05-12-2014

Ok, I almost have it. I had to make some minor adjustments to what you all provided but I am seeing the 90-day average and the last 24 hour event count with the below: sourcetype=mysourcedata | eval DEVICE_NAME=coalesce(tag,DEVICE_NAME) | stats count BY DEVICE_NAME, date_month, date_mday | stats avg(count) AS "Average_Event_Count" BY DEVICE_NAME | eval Average_Event_Count=round(Average_Event_Count,2) | join DEVICE_NAME [search sourcetype=mysourcedata earliest=-24h latest=now | stats count as Recent_Event_Count by DEVICE_NAME] The only problem I have now is that the join search is limiting my results to devices that have had > or = 1 event for the last 24 hours.

jdaivs · ‎05-09-2014

I've tried all of the suggestions above as is and variations but I keep coming up with 0 results. This is improvement, though, because I was getting errors before. I am starting to think that there may be something on the back-end not set up to allow the use of some of these commands. Is there a way to use two separate searches then bring them both together?

jdaivs · ‎05-08-2014

I am trying to compare the event count from each of my devices for the last 24 hours to the daily average of each device over the last 90days. Here is my query: sourcetype=eventsfrommydevice | eval DEVICE_NAME=coalesce(tag,DEVICE_NAME) | stats count BY DEVICE_NAME, date_month, date_mday | stats avg(count) AS "Average_Event_Count" BY DEVICE_NAME | eval Average_Event_Count=round(Average_Alert_Count,2) The time window is set to the last 90 days. The first eval statement is there because the device names changed during the last 90 days and throws of the average because it looks at each device name as separate, so I tagged the old device name with the new and this eval, where the device name is tagged, replaces the old name value with the value in the tag. Then I am making a daily count. The next stat averages the daily event count. The last eval just rounds the average to 2 decimal places. I want to have another column in the results that shows the event count for the last 24 hours. Eventually I want to set a threshold to tell me when the event counts are too far above or too far below the average but I need to analyze the results first. i can accomplish both sets of aggregation separately but I can't seem to get them together. I've tried using sub-searches and various eval expressions but no-go. Any help would be appreciated.

jdaivs · ‎05-08-2014

Unfortunately I cannot view the video from work. If this is the case, though I would have to assume that there is something on the back-end that isn't set up correctly for this to work since this did not happen natively.

jdaivs · ‎05-08-2014

Using a combination of both recommendations I managed to solve my problem. First, I tagged the old device names that were showing up with the new device names. Then I used eval coalesce() recommended when I asked a similar question. <my search criteria> | eval DEVICE_NAME=coalesce(tag,DEVICE_NAME) | stats count BY DEVICE_NAME, date_month, date_mday | stats avg(count) AS "Average_Alert_Count" BY DEVICE_NAME | eval Average_Alert_Count=round(Average_Alert_Count,2) The next thing I want to do is show the event count for the last 24 hours compared to the average. I am reviewing some of the other documentation/answers on the site for pointers, but step one is done! Thanks for the help.

jdaivs · ‎05-08-2014

Why not this ? eval DEVICE_NAME=coalesce(tag,DEVICE_NAME) I moved your comment to the answer section so i can vote it up because it worked. With my fresher mind this morning I realized I was doing the evaluation (including this one) after the aggregation functions which I changed and it worked! Thank you

jdaivs · ‎05-07-2014

I have a field in my data-set that shows the device name that an event was was generated from. Recently our naming convention was updated and these names where changed. I have tagged the older values with the newer values and I am trying to get the newer value to display instead of the older so that the aggregated results I am trying to pull don't look at the same device twice. I am not a wiz with sed, rex or eval but I tried adding the following to my query and I get an error stating that the eval function was expecting closing parens. eval DEVICE_NAME=if(isnotnull(tag),rex DEVICE_NAME mode=sed "s/DEVICE_NAME/tag",DEVICE_NAME)

jdaivs · ‎05-06-2014

I appreciate this but although the new naming convention has a pattern, the old one does not.

jdaivs · ‎05-06-2014

Here is the search I am using to get the daily average sourcetype=ids_alerts | stats count BY DEVICE_NAME, date_month, date_mday | stats avg(count) AS "Daily Average" BY DEVICE_NAME I do have a old-to-new name table but there are only a handful of the older device names showing and eventually are going to age off. So I don't know that a lookup table will be ideal (but would be good to know how). I have tagged the older names with the newer name but I am unclear on how to merge the tag in place of the old device name.

jdaivs · ‎05-06-2014

We recently implemented a new naming convention for devices logging to Splunk a managing device. The only way of determining that an event came from a specific device is from the device name field in the event. I want to do a daily average of the event counts from each device but the numbers are off because the values in the device name field have changed. There isn't another piece of data available in the logs that are fed into Splunk that I can use instead so my question is whether there is a way to combine the old and new device names so that the stats are more accurate? Any suggestions would be greatly appreciated.

Posts	11
Solutions	2
Karma Given	0
Karma Received	2
Member Since	‎05-06-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Compare 90-day average to last 24-hour count

Replace a fields value with it's tag value

Device names (normally static data) have changed

Re: Compare 90-day average to last 24-hour count

Re: Compare 90-day average to last 24-hour count

Re: Compare 90-day average to last 24-hour count

Compare 90-day average to last 24-hour count

Re: Device names (normally static data) have chang...

Re: Device names (normally static data) have chang...

Re: Replace a fields value with it's tag value

Replace a fields value with it's tag value

Re: Device names (normally static data) have chang...

Re: Device names (normally static data) have chang...

Device names (normally static data) have changed