Hello everyone, I am getting incorrect values while using appendcols to fetch the different results like a currentweek, 1weekago,  2weeksago.   |bin _time span=1h | stats count{trid) as transaction_count_1WAgo avg(duration) as Average RT_1WAgo by _time ABC | fields *   |appendcols [search earliest=** latest=** | |bin _time span=1h | stats count(trid) as transaction_count_2WAgo avg(duration) as Average RT_2WAgo by _time ABC | fields * ]   |appendcols [search earliest=** latest=** | |bin _time span=1h | stats count{trid) as transaction_count_currentweek avg(duration) as Average RT_currentweek by _time ABC| fields *]   If I run all this queries individually it shows some results and when I am trying to use them in a single search by appending using "appendcols" they shows different..   Please suggest on this? Note: i have used all latest, earliest time frames correctly but didn't show here. ... View more

Hi All, here I'm trying to build a query, which produces the values of yesterday and today. earliest=-1d@d latest=@d index="summary" | stats count(count) as yesterday_count by orig_sourcetype | appendcols [ search earliest=@d latest=now index="summary" | stats count(count) as today_count by orig_sourcetype] What I'm looking for is, I want a report of day-1, day-2, day-3, day-4.. if anyone of the day-4 count is more/less than 30% of previous days.. It should trigger the alert. ... View more

Hello, Getting this error message everytime when I'm trying to add the search peer to master. Failed to register with cluster master reason: failed method=POST path=/services/cluster/master/peers/?output_mode=json master=113.134.117.122:8089 rv=0 gotConnectionError=0 gotUnexpectedStatusCode=1 actual_response_code=500 expected_response_code=2xx status_line="Internal Server Error" socket_error="No error" remote_error=Cannot add peer=18.218.129.11 mgmtport=9089 (reason: http client error=Connect Timeout, while trying to reach https://18.218.129.11:9089/services/cluster/config). [ event=addPeer status=retrying AddPeerRequest: { _id= _indexVec=''active_bundle_id=3BA0B5A63B5F98681601E92106214CBE add_type=Initial-Add base_generation_id=0 batch_serialno=1 batch_size=2 last_complete_generation_id=0 latest_bundle_id=3BA0B5A63B5F98681601E92106214CBE mgmt_port=9089 name=EE4D1ED7-70B3-4AAC-A5E6-0A920EEE2FFC register_forwarder_address= register_replication_address= register_search_address= replication_port=8080 replication_use_ssl=0 replications= server_name=ip-12-31-4-60.us-east-2.compute.internal site=default splunk_version=8.0.2.1 splunkd_build_number=f002026bad55 status=Up } ]. 3/27/2020, 2:15:20 AM Can someone help me with this? I tried, remove the old configuration in server.conf and restarted many ties but no use. ... View more

Hello everyone, I have a python script which will connect to splunk and search with the query which I passed through a script and fetches the results. So now my script is working fine and fetching the splunk results. Now I want to send these results to Prometheus.. i have Prometheuslib installed... Can anyone help me with docs, or script on this? ... View more

Hello, I have a Splunk query which generates some output so I want to send this output to Grafana/premethes. So what are the steps to be followed to achieve this? ... View more