About mstark31

mstark31 · ‎12-13-2019

Hello Past mstark31. Current mstark31 thanks you for asking this question 3 years ago.

mstark31 · ‎12-05-2019

I think I was having issues with the suggestion here as well, but I ended up going another route for my original problem. Thank you for coming up with a better solution!

mstark31 · ‎12-03-2019

Why have you decided to use 3 joins? From what I can tell, it looks like the major difference between the 3 different subsearches is the time window. Would it be possible to use an if or case statement to rename fields based on when the events occur? An example: | eval TimeDiv1_Start = relative_time(now(), "@d+7h+30m") | eval TimeDiv1_End = relative_time(now(), "@d+14h+30m") | eval TimeDiv2_Start = relative_time(now(), "@d+14h+30m") | eval TimeDiv2_End = relative_time(now(), "@d+16h+30m") | eval TimeDiv3_Start = relative_time(now(), "-1d@d+16h+30m") | eval TimeDiv3_End = relative_time(now(), "@d+16h+30m") | eval TimeDiff = now() - _time | eval TimeGroup = case((TimeDiff >= TimeDiv1_Start AND TimeDiff < TimeDiv1_End), "Bucket1", (TimeDiff >= TimeDiv2_Start AND TimeDiff < TimeDiv2_End), "Bucket2", (TimeDiff >= TimeDiv3_Start AND TimeDiff < TimeDiv2_End), "Bucket1", 1=1, null())

mstark31 · ‎11-27-2018

I have a main time picker on my dashboard with the token value of $field1$ . I also have a secondary time picker on my dashboard that controls a single search panel. Its token value is $field2$ . I want the dashboard to behave such that when I change the value of the main time picker, the secondary time picker will update. However, I want to be able to then change the value of the secondary time picker. For example, if I was looking at a time frame of 8am to 8pm on the main picker, I'd want that to be reflected on the secondary picker. Then, I could adjust the secondary picker to show 10am to 11am. However, if then I wanted to switch the whole dashboard to show 10am to 10pm, I could adjust the main time picker and both would updated. I tried to use the Advanced section of the secondary time picker to say $field1.earliest$ and $field1.latest$ as the default, but that did not work. I also added the following code in my XML, but that did not work either. <init> <set token="field2.earliest">$field1.earliest$</set> <set token="field2.latest">$field1.latest$</set> </init> Thanks!

mstark31 · ‎11-27-2018

I ended up coming up with a solution that takes care of the majority of cases where I want to join on time but the times aren't identical. It's a bit of a kludge, but it works most of the time. Turns out, most of the events that don't match perfectly are within a few milliseconds of each other. I decided to create a field called joinTime where I take the value of _time and reformat it without the milliseconds ( "%F %T" ). Thus, I can perform my join using the joinTime field, which is now the same for the vast majority of events that need to be combined. I'm still on the hunt for something better, but this will work in the meantime.

mstark31 · ‎11-27-2018

Thank you for your suggestion. Unfortunately, transaction isn't appropriate for this data. I did use a variation of finding a common value in my solution.

mstark31 · ‎11-27-2018

Could there be a syntax error with the fact that there are 3 $ in the token setting expression? $result.$earliest7$

mstark31 · ‎11-20-2018

I have an index containing failure events for both a system as a whole ("System") and individual sections of that system. When an individual section experiences a failure, two events are logged: one for the individual section and one for the system. My goal is to join the two events together (system & section) to have access to information in fields from both events. (Essentially, tag the "system" events with data from the "section" events). About 75% of the time, the value for _time is the same for both events, which makes it easy to join them. However, sometimes the events are a few seconds apart, which means the join on time doesn't work. How can I associate these very close (but not exactly the same time) events together?

mstark31 · ‎11-29-2017

Thank you! I inadvertently discovered the need to specify an earliest time with the latest time in another search yesterday, so good reminder.

mstark31 · ‎11-29-2017

Thank you! This appears to be working. If I wanted to alter the latest time to be based on an offset from the earliest time, would this work? Examples is to make lastest time 5min after earliest time. [| gentimes start=-1 | addinfo | eval latest=info_min_time+300 | table latest] Also, why do you use table vs. return in the last pipe of the gentimes subsearch?

mstark31 · ‎11-29-2017

I have a situation where I want to run a main search of one index over a time period driven by the time picker on a dashboard, but annotate the results with information from a second search. The subsearch doing the annotation needs to run over a time period that searches a week earlier than the main search. My subsearch: | join foo type=outer [search earliest=$field1.earliest$-604800 index="someindex" This works fine as long as the format of the time coming from the token is relative (@w, -d@d, etc.). If that token value is epoch time format (using date or date/time on the picker), the subsearch doesn’t run. earliest=1511969191-608400 will not evaluate. earliest=@w-604800 will evaluate.

mstark31 · ‎10-10-2017

Thank you for helping with my debugging process. Despite the fact that I was copying and pasting the value for Reason from my data table, there was another space in there causing the problem. I went back to our original database that is sending to Splunk and found the space. I feel silly, but at least I was able to rule out the need to escape the forward /.

mstark31 · ‎10-10-2017

I am in 6.6.2. I tried your search, and it does exactly what yours does (basically, works). I had to abstract things for the search I shared in my question, but my original search still doesn't function properly. I am in the process of making sure I'm not missing anything else.

mstark31 · ‎10-10-2017

I have a conditional statement (part of an eval case) in which I need to check for the value of a field. The desired value contains a forward slash ( / ). | eval Bool = case(Reason=="Thing1 / Thing2", 0, ... 1=1, 1) . This statement will evaluate to Bool = 1 . I've tried to escape it with a back slash ( / ), but that didn't work. | eval Bool = case(Reason=="Thing1 \/ Thing2", 0, ... 1=1, 1) . This still evaluates to Bool = 1 . I can technically use a like statement, which is how I know the / is causing the issue. | eval Bool = case(Reason like "Thing1 % Thing2", 0, ... 1=1, 1) . This evaluates to Bool = 0 . | eval Bool = case(Reason like "Thing1%Thing2", 0, ... 1=1, 1) . This evaluates to Bool = 0 . (The only difference is no spaces around the % character.) Is there a solution that will let me use an exact match search vs. the like statement?

mstark31 · ‎08-14-2017

The kludge fix is to change it to | eval FakeQty = Qty1 - (-1*Qty2) , but this is clearly a temporary workaround.

mstark31 · ‎08-14-2017

I am using the new Drilldown feature in Splunk Enterprise 6.6 to drilldown to a search. In the Drilldown Editor dialog, I specified "Link to search" and Custom. My search string includes a simple eval statement using addition: | eval FakeQty = Qty1 + Qty2 When I test the drilldown after saving the dashboard, the search that appears in the search bar in the new window omits the plus sign in my eval statement, which causes the search to throw an error. | eval FakeQty = Qty1 Qty2 I have tried this with other operators (subtract, multiply, and divide) successfully, but not with addition. I have been able to replicate the error on multiple searches and dashboards. I also tried to edit the XML and use + instead of + , but that did not work. I found this answer, but since I'm not the one in my organization who manages the .conf files, I want to make sure I can give correct instructions regarding my specific issue to the person who does. I'm not 100% sure this is my situation. https://answers.splunk.com/answers/10281/drilldown-search-operators-out-of-order.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev

mstark31 · ‎07-19-2017

That second block of code should say chart on line 2 instead of stats

mstark31 · ‎07-19-2017

Thank you. While this does work to get all the data series on a single chart, it does not work if I want to do a trellis view separating by Style.

mstark31 · ‎07-19-2017

I have a set of lab samples that have a Percent value measured in 3 different locations across the sample, identified as A, B, and C. Each sample is also associated with a different style. My end goal is to have a line chart with SampleID on the x-axis and Pct on the y-axis with a set 3 different data series for each of the locations A, B, and C for each style. (So Style1PctA, Style1PctB, Style1PctC, Style2PctA, Style2PctB, Style2PctC,...) Then, I want to use Trellis view to separate by Style, so I'd have a graph with the series for A, B, and C for each Style. My search is as follows: | stats avg(Pct) as Pct by SampleID, Location, Style which of course gives me a table that contains the following fields: SampleID, Location, Style, Pct. This results in a graph with 3 series: Location, Style, and Pct, but Pct is the only one that shows up on the graph and there is no differentiation by Location or Style. From there, I can Trellis by Style, but there is no differentiation by Location. I know that I can accomplish this by doing a separate search (or using a token) to filter by Style before graphing, but then I have to hard-code each of my Styles into either an input on a dashboard, or a series of graphs. | search Style=123 | stats avg(Pct) as Pct by SampleID, Location Is there a better way to accomplish this?

mstark31 · ‎05-18-2017

Different approach - but cool way to solve the problem. Also works. I've also done a chart variation with index=animalfood | chart count by Animal, Food limit=0

mstark31 · ‎05-18-2017

If this is something you can accomplish with stats and not transaction, I've found a way to do it. It appears that psobisch's original problem was solved, but in case anyone lands here from a search like I did, here you go. Let's say I have a dataset that records every time an Animal eats a certain type of Food. Multiple Animals eat multiple types of Food. My first search to make a full list of each time an Animal eats Food was this: index=animalfood | transaction Animal mvlist=t | table * Then, I wanted to count and list, by Animal, how many times they ate each kind of food. Keeping the multivalue format was important - I only wanted each Animal listed once. I was able to uses stats twice to accomplish what I wanted. index=animalfood | stats count by Animal, Food | stats list(Food) list(count) by Animal The first stats creates the Animal, Food, count pairs. The second stats creates the multivalue table associating the Food, count pairs to each Animal.

mstark31 · ‎04-18-2017

Bonus question - how do I escape quotes without using XML (this code is going in a macro)? My map search pipe needs to look like this: | map search = "search earliest=$earliest$ index=my_index Process="Thing & Thing" Parameter=my_parameter" I've determined that the quotes around "Thing & Thing" are messing up the search string. My workaround is to add another line below map search with | search Process="Thing & Thing" but this seems really kludgy.

mstark31 · ‎04-06-2017

Some minor typos, but otherwise this works. Thank you! | makeresults | eval earliest=if(now()>=relative_time(now(),"-7h@d+7h") AND now()<relative_time(now(),"-7h@d+19h"),"-7h@d+7h", "-7h@d+19h") | map search="search earliest=$earliest$ Your Search Here"

mstark31 · ‎04-05-2017

I have a search that needs to either snap to 7am ( -7h@d+7h ) or 7pm ( -7h@d+19h ) depending on whether the time of search ( now() ) is between 7am-7pm or 7pm-7am. For example, if it is 8:30am, I need to see my search using earliest=-7h@d+7h , but if it is 21:15, I need see my search using earliest=-7h@d+19h . I tried the following if statement, but it doesn't work. earliest=if(now()>="-7h@d+7h" AND now()<"-7h@d+19h", "-7h@d+7h", "-7h@d+19h") This is for an embedded report, so I wasn't thinking I could use any XML or tokens. Thanks!

mstark31 · ‎03-17-2017

Thank you everyone for your answers. I ended up going in a slightly different direction with my solution, but I've learned so many new things based on your collective input.

Posts	33
Solutions	1
Karma Given	16
Karma Received	9
Member Since	‎07-20-2016

Online Status	Offline
Date Last Visited	‎01-18-2021 03:14 PM

Link Time Pickers on Dashboard

Join events with similar times

Modify subsearch time starting with timerange pick...

Escaping a forward slash / in conditional statemen...

Drilldown Search Removing Math Operators

How to get a Line Chart with 3 Split by Clauses?

If statement for earliest time

How to generate a conditional search based on time...

How to build a regular expression that will split ...

Can eval be used to calculate the standard deviati...

Re: How to build a regular expression that will sp...

Re: Modify subsearch time starting with timerange ...

Re: How to combine Multiple joins with subsearch?

Link Time Pickers on Dashboard

Re: Join events with similar times

Re: Join events with similar times

Re: time picker

Join events with similar times

Re: Modify subsearch time starting with timerange ...

Re: Modify subsearch time starting with timerange ...

Modify subsearch time starting with timerange pick...

Re: Escaping a forward slash / in conditional stat...

Re: Escaping a forward slash / in conditional stat...

Escaping a forward slash / in conditional statemen...

Re: Drilldown Search Removing Math Operators

Drilldown Search Removing Math Operators

Re: How to get a Line Chart with 3 Split by Clause...

Re: How to get a Line Chart with 3 Split by Clause...

How to get a Line Chart with 3 Split by Clauses?

Re: stats on transaction

Re: stats on transaction

Re: If statement for earliest time

Re: If statement for earliest time

If statement for earliest time

Re: How to generate a conditional search based on ...