Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mark_groenveld
mark_groenveld
Path Finder
Member since:
05-19-2016
a week ago
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 8 |
| Karma Received | 1 |
| Member Since | 05-19-2016 |
Activity Feed
- Posted Comparing results from two different dates vertically on Splunk Search. a week ago
- Got Karma for Re: How can I represent the stats for 5 minutes before and the top of the hour?. 01-08-2024 05:11 PM
- Posted Re: How can I represent the stats for 5 minutes before and the top of the hour? on Splunk Search. 01-08-2024 05:07 PM
- Karma Re: How can I represent the stats for 5 minutes before and the top of the hour? for dtburrows3. 01-08-2024 05:07 PM
- Karma Re: How can I represent the stats for 5 minutes before and the top of the hour? for dtburrows3. 01-08-2024 05:07 PM
- Posted Re: How can I represent the stats for 5 minutes before and the top of the hour? on Splunk Search. 01-08-2024 10:58 AM
- Posted How can I represent the stats for 5 minutes before and the top of the hour? on Splunk Search. 01-08-2024 10:35 AM
- Posted Re: How can I extract just a section of a field? on Splunk Search. 12-19-2023 12:12 PM
- Karma Re: How can I extract just a section of a field? for dtburrows3. 12-19-2023 12:11 PM
- Posted How can I extract just a section of a field? on Splunk Search. 12-19-2023 10:29 AM
- Karma Re: How to extract value from a field? for richgalloway. 12-19-2023 08:45 AM
- Posted Re: How can I find an event count of event that are less than a p95 duration? on Splunk Search. 11-08-2023 04:49 PM
- Posted Re: How can I find an event count of event that are less than a p95 duration? on Splunk Search. 11-08-2023 01:54 PM
- Posted Re: How can I find an event count of event that are less than a p95 duration? on Splunk Search. 11-08-2023 01:51 PM
- Karma Re: How can I find an event count of event that are less than a p95 duration? for richgalloway. 11-08-2023 01:51 PM
- Posted How can I find an event count of event that are less than a p95 duration? on Splunk Search. 11-07-2023 11:01 AM
- Tagged How can I find an event count of event that are less than a p95 duration? on Splunk Search. 11-07-2023 11:01 AM
- Tagged How can I find an event count of event that are less than a p95 duration? on Splunk Search. 11-07-2023 11:01 AM
- Tagged How can I find an event count of event that are less than a p95 duration? on Splunk Search. 11-07-2023 11:01 AM
- Tagged How can I find an event count of event that are less than a p95 duration? on Splunk Search. 11-07-2023 11:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
a week ago
I would like to compare specific response status stats vertically and not horizontally so that the values line up and do not rely on the appendcols command.
My search:
| multisearch [search NOT status IN ( 200, 203, 204, 302, 201, 202, 206, 301, 304, 404, 500, 400, 401, 403, 502, 504 ) earliest=-4h@m latest=@m | eval date="Today"] [search NOT status IN (200, 203, 204, 302, 201, 202, 206, 301, 304, 404, 500, 400, 401, 403, 502, 504 ) earliest=-4h@m-1w latest=@m-1w | eval date="LastWeek"] | timechart span=1d count by status
Example display of current results
Desired results
Status
Today
LastWeek
412
1
0
413
1
0
415
0
1
418
0
2
422
6
7
... View more
Labels
- Labels:
-
timechart
01-08-2024
05:07 PM
1 Karma
I found a shorter example to display the result set. Thank you for your efforts dtburrows3. | bin span=10m _time | eval minute=strftime(_time,"%M") | where minute>54 OR minute<6 | stats count by _time
... View more
01-08-2024
10:58 AM
Thanks dtburrows3 for replying. The chiefs requesting the data want 10 minute increments.
... View more
01-08-2024
10:35 AM
I am looking to represent stats for the 5 minutes before and after the hour for an entire day/timeperiod. The search below will work but still breaks up the times into 5 minute chunks as it crosses the top of the hour. Is there a better way to search? index=main (earliest=01/08/2024:08:55:00 latest=01/08/2024:09:05:00) OR (earliest=01/08/2024:09:55:00 latest=01/08/2024:10:05:00) OR (earliest=01/08/2024:10:55:00 latest=01/08/2024:11:05:00) | bin _time span=10m | stats count by _time Received results
... View more
12-19-2023
12:12 PM
That worked. Thanks dtburrows3!
... View more
12-19-2023
10:29 AM
I have a key called message Inside the value are several results but I need to only extract one result in the middle of the results. Sample: message: template: 1234abcd, eeid: 5678efgh, consumerid: broker My rex is below but returns the template value but also the results for eeid and consumerid when I only need the template value of 1234abcd. | rex field=message "template: (?<TemplateID>[^-]+)"
... View more
Labels
- Labels:
-
rex
11-08-2023
04:49 PM
I need the count of events.
... View more
11-08-2023
01:54 PM
Thanks Robert. I would like to clarify the search as I need the events less than the p95 duration. Shouldn't the eval section be: | eval search = "dur<"+p95Dur
... View more
11-08-2023
01:51 PM
Thanks for your response Rich. Using eventstats took too long to complete to the point it wasn't usable.
... View more
11-07-2023
11:01 AM
I need to identify the count of events that have a duration that is less than the p95 value. Sample search index=xyz status=complete | stats p95(dur) as p95Dur What can I add to the end of the search to id the number of events less than the p95Dur value?
... View more
Labels
- Labels:
-
stats
08-16-2023
08:36 AM
That works. Many thanks!
... View more
08-15-2023
11:14 AM
I am looking to sum up cumulative column totals by hour in a separate column. Here is the search: index=main CompletedEvent | bin _time span=1h | stats dc(clientid) as HourlyClients by _time I would like there to be a 2nd result column that accumulates the 1st column by hour. For example: the result in row 2 of the 2nd column will be the sum of rows 1 and 2 in the 1st column, the result of row 3 of the 2nd column will be the sum of rows 1 to 3 in the 1st column, etc. Thanks in advance.
... View more
Labels
- Labels:
-
stats
10-25-2022
01:01 PM
That worked. Many thanks!
... View more
10-24-2022
10:02 PM
We are looking to provide the last part of a request uri that identifies a file name and has a client identifier variable in the middle of the uri. Sample uri request: GET /someportal/rest/product/v1_0/clientidentifier/filename/fnm_123456789abcd.png HTTP/1.1 The underlined text is the value that I need to extract. Note the space after the .png. My current attempt is this: index=index source=/source sourcetype=sourcetype | rex field=_raw "GET /someportal/rest/product/v1_0/*/filename/(?<FileName>\d+)" Please let me know how far off I am. Thanks
... View more
08-15-2022
05:44 PM
Thanks Rich for the solution.
... View more
08-12-2022
04:51 PM
I have a key:value for db names but need only the first part.
Example
Current DBNAME : db001_inst1:schemanamexyx Or DBNAME : db01_inst1:schemanamexyx
Requested REX statement to provide only the values in front of the colon. I.E., db001_inst1 or db01_inst1
... View more
07-20-2016
06:04 PM
This is great. I have been busting on this for quite some time. I was able to get it to work by using the format below. Thanks a bunch for the tip.
This provides a search between 8am and 10pm for the day or days selected.
ERRORCODE=001 | eval hour_of_the_day=strftime(_time,"%H") | where hour_of_the_day>07 | where hour_of_the_day<22
... View more
05-19-2016
09:44 PM
We would like to count the number of error events in 15 minute intervals and show that number as the number of errors per minute for the previous 15 minutes. How would I do that using the timechart command?
Sample search: index=main loglevel=error earliest=-15m | timechart span=15m
What would the rest be?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
