done 🙂 Good to hear it helped 🙂 ... View more

@teddyidc1101 if you are using scikit-learn, pandas, statsmodel, numpy, or scipy libraries as forecasting algorithm you should check out Splunk Machine Learning Toolkit (MLTK) and if any of currently supported ML libraries are not already present in MLTK you can extend and import your own algorithm using ML SPL API Also refer to State Space Forecast algorithm introduced in 4.2 which allows you to fit and apply learnt model for time series forecasting: https://docs.splunk.com/Documentation/MLApp/latest/User/Algorithms#StateSpaceForecast ... View more

Try this: (index= Query_details OR index = Request_details) | makemv DB_SPID delim="," | eval SPID=coalesce(SPID, DB_SPID) | makemv DB_TXID delim="," | eval TRANSACTIONID=coalesce(TRANSACTIONID, DB_TX_ID) | fields - DB_*ID | stats values(*) AS * BY TRANSACTIONID SPID | table SPID TRANSACTIONID REQUEST_NAME LOGIN KILLTIME RUNDURATION RESPONSE_MS ... View more

your request works, thanks, but it is very long... is it possible to accelerate it please? could you explain me why when I m doing index="x" sourcetype=y source="z" EventCode=6008 on a 30 days period I have 6 events so 6 hosts but when I m doing `index="x" sourcetype=y source="z" EventCode=6008 (Level=1 OR Level=2 OR Level=3) | dedup host | table _time host EventCode | join type=left host [ search index=master-data-lookups sourcetype="view_splunk_assets" | stats count by HOSTNAME SITE ROOM TOWN CLIENT_USER COUNTRY OS | fields - count | rename HOSTNAME as host] | table _time host COUNTRY TOWN SITE ROOM CLIENT_USER OS | sort -_time limit=10` I have also 6 events on the same period but only 3 events are matching with my CSV file? Last question : the host list I want to compare is in a csv file Do I just have to add [| inputlookup host.csv] after (index="X" sourcetype="Y" source="Z" EventCode=6008) OR (ndex=master-data-lookups sourcetype=":view_splunk_assets" )?? Thanks in advance ... View more

I've tried to test this using the following query. Maybe you can check and tell me if I'm understanding it wrong somewhere: | makeresults count=10 | eval application="app".random()%10 | eval computer="computer".random()%6 | stats values(application) as apps by computer | where mvcount(apps)=1 ... View more

Hey, If your raw data contains a field Service_Recipient_Location and you want to apply all filters than you can write the query like: index=foo sourcetype=bar $region$ $country$ $loc$ ... View more