Hi Experts,                         I wondered the best way of comparing the below data.  So I have a query which returns as so . index=myindex sourcetype=mysourcetype host="myhost" |table process, tier, country This returns a 100 or so processes their tier and country as expected.  There is only 4 countries  uk, usa, denmark and spain It returns something like this  process              tier              country process1          roman         uk process2          roman         usa Process3         roman          Denmark process4         anglo            uk process5       anglo              usa process6       anglo             Denmark process7       anglo             spain The roman tier should be present in each country . If Spain is missing as above how to I only show the missing entry for spain as the outlier ? This is basically for a rec purpose so we can see whats missing. thanks in advance !      ... View more

Hi Experts,                    As part of an new initiative looking at SLO metrics. I have created the below query which nicely counts the amount of errors per day over a 30 day window and also provides a nice average level on the same graph using an overlay for easy viewing. earliest=-30d@d index=fx ERROR sourcetype=mysourcetype source="mysource.log" | rex field=source "temp(?<instance>.*?)\/" | stats count by _time instance | timechart span=1d max(count) by instance | appendcols [search earliest=-30d@d index=fx ERROR sourcetype=mysourcetype source="mysource.log" | rex field=source "temp(?<instance>.*?)\/" | stats count by _time instance | stats avg(count) AS 30d_average]|filldown 30d_average I wanted to somehow work out the percentage of good results (anything that is lower then the average value) and the percentage of bad results (above the average) and show in a stats table for each instance. Help needed! thanks in advance Theo ... View more

Hi All,            As part of one of my SRE objectives I was trying to find out the following in splunk.  The High(Max) count of ERRORs within a given time period (1hr / 24hr/ 144hr) compared to monthly 99 Percentile I was starting off with baby steps assuming that the count is obviously zooming in on anything 'ERROR' index=myIndex ERROR source="/test.log" | timechart count by status | addtotals | addtotals fieldname=ERROR | eval ErrorRate=round(Errors/Total*100,2) | fields _time 5* ErrorRate But that doesn't seem to even work.  Help would be really appropriated .   Thanks in advance team !    ... View more

Hi Experts! ,                       Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff Example 2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000} Manually looking the difference is  2021-10-05 04:49:10.138 -(Standard time) 2021-10-05 04:49:07.600 -(EPOCH time) Difference 2.54 seconds Thanks in advance ... View more

Hi I am really struggling to find the difference between the 51= time and the 59= time below and add to a separate column My log extract example is  2021-01-06 12:37:57.411 [FIDO1] INFO LogAuditor - [FIDO2] Outgoing [12294][0] : 8=FIX.4.4
9=541
35=D
49=FIDO1
56=FIDO2_192_168_0_1
34=15992
51=20210106-17:37:57.410
11=1609686062170-FIDO15140WTZ000878
15=USD
21=1
38=1000000
40=2
44=19.6321
54=2
55=PECEOF
59=3
59=20210106-17:37:57.409 Thanks in advance experts  ... View more