About ryanprayacn

ryanprayacn · ‎10-10-2017

Thanks for the feedback!

ryanprayacn · ‎10-10-2017

Hello: I have an existing field name "filename" (extracted from Splunk) in this format abcdefg.000000AB.DDD01A222222222222222222.xml. I want to create a new field that extracts the characters in the position of "DDD01A" in the field above. I do not want to lose the existing "filename" extraction - I want to add another column with the new value. The Extract New Fields GUI did not work. Can someone please advise? Thanks!

ryanprayacn · ‎09-30-2017

This one row represents one timeline for a process. In reality, the row has many more date and times but only listed a sample here for simplicity sake.

ryanprayacn · ‎09-29-2017

Hello: I have a long row of time and dates for each overall "event". So the data looks like 8/11/2017 18:00:00 8/15/2017 04:00:00 8/19/2017 15:00:00 Can you recommend the best way to plot this information? I'm a little thrown off since I have multiple timestamps in one row. Thanks!

ryanprayacn · ‎09-27-2017

Thanks this worked!

ryanprayacn · ‎09-26-2017

I have two indexes that I can successfully join via stats. However, both indexes have a common field named "STATUS". I want to be able to separate the STATUS field into STATUS1 and STATUS2 before the join - so I can see both. I have left out STATUS below but showing successful join SPL below: index=customertest OR index=valuetest | stats values(Spend) as spend values(Order) as order by Customer | fillnull value=NULL | mvexpand spend | sort Customer Any recommendations?

ryanprayacn · ‎09-25-2017

Please assume that you must join the tables. Just trying to provide a simple example. Thanks!

ryanprayacn · ‎09-25-2017

The below example provides the output I need, but I will exceed the JOIN command limitations (50k). Can someone advise on a different way to accomplish the join below - without using the JOIN command? So as an example: Primary Table Customer 1, 2, 3 Secondary Table Customer 1,2,3,2 Spend 100, 200, 300, 400 Search: index=primary | join type=left max=0 Customer [search index=secondary] | table Customer Spend Output is Customer 1, 2, 2, 3 Spend 100, 200, 400, 300

ryanprayacn · ‎09-24-2017

Thank you! I had accidentally left out the "type=left" in my example. Not including "max" was my issue. I agree that "join" is a last resort. How would you do this sample search with something more effective (since join is max 50,000). Thanks!

ryanprayacn · ‎09-24-2017

So as an example: Primary Table Customer 1, 2, 3 Secondary Table Customer 1,2,3,2 Spend 100, 200, 300, 400 Search: index=primary | join Customer [search index=secondary] | table Customer Spend Output is Customer 1, 2, 3 Spend 100, 400, 300 It is NOT returning all values from Customer 2. Need ALL values from secondary table, not just one. Please advise. Thanks!

ryanprayacn · ‎08-21-2017

And to be clear, I have fit a model to the "old" data and attempted to apply it to the new data, but it doesn't seem to work very well. And yes, I am using the predict command. The actual "old" data has about 18 data points. New has 3 data points.

ryanprayacn · ‎08-21-2017

So I have this data from the previous device release (old model). Date / # subscribers Old Model Data Month 1: 100 Month 2: 200 Month 3: 300 Month 4: 350 Month 5: 350 Month 6: 350 I want to predict how the new model will fare based on the old model curve. (e.g. next 4 months) New Model Data Month 1: 50 Month 2: 150 Any suggestions appreciated.

ryanprayacn · ‎04-17-2017

Thanks this works. If you wanted to show the Old Value also, would you just use the where command Change="yes" and how would you show Old Value (yesterday's value) on the same line?

ryanprayacn · ‎04-17-2017

Thanks. Are you able to do something similar for string comparisons? For example, assume you have Date and Value columns, but want the Change, Old Value, and New Value. Date Value Change Old Value New Value 4/13 xyz no 4/12 xyz no 4/11 xyz yes abc xyz 4/10 abc no 4/9 abc no

ryanprayacn · ‎04-13-2017

Date Val Change? 4/13 60 no 4/12 60 no 4/11 60 yes 4/10 50 no 4/9 50 no Assuming you have Date and Value, what is the best way to accomplish the Change column? I've seen the TIMEWRAP command, but that seems to be for timechart. I just need the Change column.

ryanprayacn · ‎04-12-2017

This is for the Detect Numeric Outliers capability.

ryanprayacn · ‎04-12-2017

Is there a maximum number of events (e.g. 500,000) that the Machine Learning Toolkit (MLTK) capable of handling? Trying to ingest 7M events, seems to cut off at 500k.

Posts	17
Solutions	0
Karma Given	3
Karma Received	2
Member Since	‎12-09-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Create a new field from a field-extraction

Plotting a timeline

Common Field in Two Different Indexes

Replacement for Join

Left Join Not Returning All Fields

Prediction Question

How to generate a search to display day over day c...

Machine Learning Toolkit: Is there a maximum numbe...

Re: Create a new field from a field-extraction

Create a new field from a field-extraction

Re: Plotting a timeline

Plotting a timeline

Re: Common Field in Two Different Indexes

Common Field in Two Different Indexes

Re: Replacement for Join

Replacement for Join

Re: Left Join Not Returning All Fields

Left Join Not Returning All Fields

Re: Prediction Question

Prediction Question

Re: How to generate a search to display day over d...

Re: How to generate a search to display day over d...

How to generate a search to display day over day c...

Re: Machine Learning Toolkit: Is there a maximum n...

Machine Learning Toolkit: Is there a maximum numbe...