Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About jegreene
jegreene
New Member
Member since:
10-11-2016
06-05-2020
Community Statistics
| Posts | 4 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-11-2016 |
Activity Feed
- Posted Re: How to edit my search to count a certain event, then group that count by another field in a time chart? on Splunk Search. 10-13-2016 08:27 PM
- Posted How to edit my search to count a certain event, then group that count by another field in a time chart? on Splunk Search. 10-13-2016 04:56 PM
- Tagged How to edit my search to count a certain event, then group that count by another field in a time chart? on Splunk Search. 10-13-2016 04:56 PM
- Tagged How to edit my search to count a certain event, then group that count by another field in a time chart? on Splunk Search. 10-13-2016 04:56 PM
- Tagged How to edit my search to count a certain event, then group that count by another field in a time chart? on Splunk Search. 10-13-2016 04:56 PM
- Tagged How to edit my search to count a certain event, then group that count by another field in a time chart? on Splunk Search. 10-13-2016 04:56 PM
- Tagged How to edit my search to count a certain event, then group that count by another field in a time chart? on Splunk Search. 10-13-2016 04:56 PM
- Posted Re: How to get a field from a unique transaction and group another transaction by the unique field? on Splunk Search. 10-11-2016 09:34 AM
- Posted How to get a field from a unique transaction and group another transaction by the unique field? on Splunk Search. 10-11-2016 06:48 AM
- Tagged How to get a field from a unique transaction and group another transaction by the unique field? on Splunk Search. 10-11-2016 06:48 AM
- Tagged How to get a field from a unique transaction and group another transaction by the unique field? on Splunk Search. 10-11-2016 06:48 AM
- Tagged How to get a field from a unique transaction and group another transaction by the unique field? on Splunk Search. 10-11-2016 06:48 AM
- Tagged How to get a field from a unique transaction and group another transaction by the unique field? on Splunk Search. 10-11-2016 06:48 AM
- Tagged How to get a field from a unique transaction and group another transaction by the unique field? on Splunk Search. 10-11-2016 06:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
10-13-2016
08:27 PM
x = time
y = number of connections where UT=10
group by = login string
Those are the three variables.
Makes sense?
Something is wrong in my logic because I am only getting the connections
Essentially the connections should be replaced by the login string
... View more
10-13-2016
04:56 PM
Variables :
LoginString
Connections
UT=10
UT=45
Essentially, I want to grab the login string where UT=45and then tie that LoginString to the Connections. I want to then count the number of times UT=10 happens on that same connection, and group that count by LoginString in a timechart
[01/May/2015:20:39:47 -0400] Connections=12345 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=12345 random=1 - RESULT err=0 UT=45 nentries=0 etime=0.000000 LoginString="randomString"
[01/May/2015:20:39:47 -0400] Connections=12345 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=223333 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=223333 random=1 - RESULT err=0 UT=45 nentries=0 etime=0.000000 LoginString="veryUnRandom"
[01/May/2015:20:40:47 -0400] Connections=55555 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:40:47 -0400] Connections=55555 random=1 - RESULT err=0 UT=45 nentries=0 etime=0.000000 LoginString="veryUnRandom"
[01/May/2015:20:40:47 -0400] Connections=55555 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:40:47 -0400] Connections=55555 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:40:47 -0400] Connections=55555 random=1 - RESULT err=0 UT=45 nentries=0 etime=0.000000 LoginString="veryUnRandom"
In this case, the timechart should have 3 dots with 2 of them being the same color.
randomstring would have 2 and veryUnRandom would have 1 for the first dot and 3 for the second dot
I am close in that I am using eventstats values(LoginString) as LoginStringby conn | where tag=10| timechart span=1h count by LoginString , but it's giving me the connection instead.
Any advice?
... View more
10-11-2016
09:34 AM
[01/May/2015:20:39:47 -0400] Connections=12345 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=12345 random=1 - RESULT err=0 UT=45 nentries=0 etime=0.000000 LoginString="randomString"
[01/May/2015:20:39:47 -0400] Connections=12345 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=223333 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=223333 random=1 - RESULT err=0 UT=45 nentries=0 etime=0.000000 LoginString="veryUnRandom"
[01/May/2015:20:39:47 -0400] Connections=55555 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=55555 random=1 - RESULT err=0 UT=45 nentries=0 etime=0.000000 LoginString="veryUnRandom"
[01/May/2015:20:39:47 -0400] Connections=55555 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=55555 - RESULT error=0 UT=10 nentries=0 etime=0.000000
[01/May/2015:20:39:47 -0400] Connections=55555 random=1 - RESULT err=0 UT=45 nentries=0 etime=0.000000 LoginString="veryUnRandom"
In this instance I would want my timechart to have 2 for randomString and 1 for notSoRandom and 3 for VeryUnRandom
The issue I am having is how do I group by the LoginString. Right now if I transaction by Connections I have a giant string of the UT=45 and UT=10 but all I want is the count for the number of UT=10 appears in the event
... View more
10-11-2016
06:48 AM
I have an event that will generate a login string for a user. Once that login string is generated, the connection string should be tied to that very same login string and be able to be grouped by. However, that login string only exists in the initial connection.
When the connection string is generated, a unique token is tied to it, lets say it's 10. I want to count the number of times the unique token happens (lets say it's 45) and group by the login string.
Variable:
LoginString
Connections
UT=10
UT=45
So essentially I want to grab the login string where UT=10 and then tie that LoginString to the Connections. I want to then count the number of times UT=45 happens on that same connection, and group that count by LoginString in a timechart
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
