Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pmhelfrich
pmhelfrich
Explorer
Member since:
07-18-2016
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 07-18-2016 |
Activity Feed
- Karma Re: How do you filter results after using the tostring "duration"? for whrg. 06-05-2020 12:50 AM
- Karma Re: How to search and display two sources in a table? for sundareshr. 06-05-2020 12:48 AM
- Posted Re: Stats: pulling forward data into table results on Splunk Search. 04-04-2019 12:02 PM
- Posted Stats: pulling forward data into table results on Splunk Search. 04-04-2019 11:41 AM
- Tagged Stats: pulling forward data into table results on Splunk Search. 04-04-2019 11:41 AM
- Tagged Stats: pulling forward data into table results on Splunk Search. 04-04-2019 11:41 AM
- Posted Re: How do you filter results after using the tostring "duration"? on Getting Data In. 12-10-2018 09:46 AM
- Posted How do you filter results after using the tostring "duration"? on Getting Data In. 12-07-2018 12:34 PM
- Tagged How do you filter results after using the tostring "duration"? on Getting Data In. 12-07-2018 12:34 PM
- Tagged How do you filter results after using the tostring "duration"? on Getting Data In. 12-07-2018 12:34 PM
- Tagged How do you filter results after using the tostring "duration"? on Getting Data In. 12-07-2018 12:34 PM
- Tagged How do you filter results after using the tostring "duration"? on Getting Data In. 12-07-2018 12:34 PM
- Tagged How do you filter results after using the tostring "duration"? on Getting Data In. 12-07-2018 12:34 PM
- Posted Re: How to search and display two sources in a table? on Splunk Search. 07-19-2016 02:28 PM
- Posted Re: How to search and display two sources in a table? on Splunk Search. 07-19-2016 02:13 PM
- Posted Re: How to search and display two sources in a table? on Splunk Search. 07-19-2016 10:29 AM
- Posted How to search and display two sources in a table? on Splunk Search. 07-18-2016 02:36 PM
- Tagged How to search and display two sources in a table? on Splunk Search. 07-18-2016 02:36 PM
- Tagged How to search and display two sources in a table? on Splunk Search. 07-18-2016 02:36 PM
- Tagged How to search and display two sources in a table? on Splunk Search. 07-18-2016 02:36 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
04-04-2019
12:02 PM
@vnravikumar , thanks for the response. I tried eventstats, and that does pull the data forward, but it also duplicates Type, rather than having 1 result per type.
... View more
04-04-2019
11:41 AM
I am trying to create a table by counting rows, then doing a stats command on the results to determine the Avg, Max, and Min of those counts. I also want to pull 3 other values forward from the 1st stats command, that I want to remain untouched through the 2nd Stats command.
Original data:
Date Time | Filename | Transaction Count | Type
4/13/19 | abcde | 5 | T1
4/13/19 | efghi | 10 | T2
4/14/19 | jklmn | 17 | T1
4/14/19 | opqrs | 2 | T2
4/15/19 | tuvwx | 20 | T2
My query:
| bucket _time span=1d
| stats count
avg(TRANS_COUNT) as AverageTransCount
max(TRANS_COUNT) as MaxTransCount
min(TRANS_COUNT) as MinTransCount by _time TYPE
| table SERVICE_TYPE count AverageTransCount MaxTransCount MinTransCount
| stats avg(count) as AverageFileCount
max(count) as MaxFileCount
min(count) as MinFileCount by TYPE
| table TYPE AverageFileCount MaxFileCount MinFileCount AverageTransCount MaxTransCount MinTransCount
When I run the two stats commands separately, they work, but I can't figure out how to pull " AverageTransCount MaxTransCount MinTransCount" forward to the final results.
I'd like my results to look like so:
| SERVICE_TYPE | AverageFileCount | MaxFileCount | MinFileCount | AverageTransCount | MaxTransCount | MinTransCount |
All help is much appreciated!
... View more
12-10-2018
09:46 AM
Thanks @whrg, that did the trick! So it seems basically all time is dumbed down into seconds as a base, good to know!
... View more
12-07-2018
12:34 PM
I used the answer from this thread to create my query, but I can't figure out how to narrow them down.
https://answers.splunk.com/answers/108248/tostring-x-duration-working-wierd.html
I'm trying to show only the results where OLDEST_ECA Date/time is older than 12 hrs from now so I can trigger an alert. The difference can span up to days/weeks. I have the calculation showing the results appropriately, but can't figure out the filtering part.
OLDEST_ECA stored as: 2018-12-06 18:26:16.486
| eval OLDEST = strptime(OLDEST_ECA, "%Y-%m-%d %H:%M:%S")
| eval NOW_DATE = strftime(now(), "%Y-%m-%d %H:%M:%S")
| eval diff = tostring((now() - OLDEST), "duration")
| Table OLDEST_ECA NOW_DATE OLDEST NOW diff
Example result:
OLDEST_ECA NOW_DATE OLDEST NOW diff
2018-12-06 08:00:56.831 2018-12-07 14:31:56 1544104856.000000 1544214716 1+06:31:00.000000
... View more
07-19-2016
02:28 PM
When you say "other columns," does that mean they have to be columns that match on each table, or just any column that I want from sourcetype B?
... View more
07-19-2016
02:13 PM
The query that I gave above is the exact query with renamed values. I just checked and there is definitely data available in both sourcetypes and that would qualify for a "join." When I run what you gave and add |search common_col=(value), It pulls two rows, and each has the others data blank. In other words, the query is looking at both sourcetypes, just not combining anything.
My understanding is the columns you specify in the |table command won't effect the results and is just for display, correct?
... View more
07-19-2016
10:29 AM
Unfortunately this didn't work. I'm still only getting columns from one of the tables. The other tables columns are just showing blank.
... View more
07-18-2016
02:36 PM
I found this thread, but wasn't able to get it to work for me:
https://answers.splunk.com/answers/74245/joining-data-from-2-data-sources-in-splunk.html
I have 2 sources that I would like to display in a table. The two sources use 2 columns as the "join" to know that it's the same data.
In other words i have:
Source A, Column_A, Column_B (as well as other columns)
Source B, Column_A, Column_C (as well as other columns)
Column_A=Column_A and Column_B=Column_C (has to be both matching, not just one set of columns or the others)
Based on the link above, I have tried:
index=index* (sourcetype=A OR sourcetype=B)
| rename Column_C as Column_B
| table
Maybe it doesn't matter, but I'm hung up on how Slunk knows what to join on if I don't tell it.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
