About cosminstefanmar

cosminstefanmar · ‎02-21-2020

We are getting same error, did you find an explanation of why a big chunk of users might be missing when pulling via REST API?

cosminstefanmar · ‎06-25-2019

Reason for using proportional is to be able to give different probabilities to certain items, based on a baseline created on a longer period of time. At the same time I need count in order to sample different sizes based on "by" field clause.

cosminstefanmar · ‎06-20-2019

I thought about it as well, will explore this in more detail. Another alternative would be to modify sample.py directly and introduce the missing functionality in the Splunk command itself. This can be a direct contribution to the community.

cosminstefanmar · ‎06-19-2019

Tried that already, doesn't provide the expected output. I'll give you an example: | sample proportional="some_field" generates random output, say 5 which means the immediate | sample count=20 won't be able to pull 20 events, because it doesn't make sense anymore, in this case it will be limited to only 5!!

cosminstefanmar · ‎06-19-2019

I am afraid using count and proportional at the same time is not allowed by the command itself. I already mentioned about it in the description. In my opinion this is the weakness of the command, and it should be dealt by Splunk as a feature enhancement.

cosminstefanmar · ‎06-19-2019

I noticed sample command in Splunk is limited in how many parameters can be used at the same time: https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Customsearchcommands#sample I am interested in replicating below functionality of numpy.random.choice library in python, here's an example of it's output: >>>aa_milne_arr = ['pooh', 'rabbit', 'piglet', 'Christopher'] >>>np.random.choice(aa_milne_arr, 5, p=[0.5, 0.1, 0.1, 0.3]) array(['pooh', 'pooh', 'pooh', 'Christopher', 'piglet'] So basically I would like to sample based on both "proportional" and "count", both at the same time. Has anyone come across this issue before and how did you work around it in SPL? Thank you.

Posts	6
Solutions	0
Karma Given	13
Karma Received	2
Member Since	‎09-13-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Sample command limitations

Re: Users missing from Access Control

Re: Sample command limitations

Re: Sample command limitations

Re: Sample command limitations

Re: Sample command limitations

Sample command limitations