Correct, this does not improve performance. Is Splunk planning on providing a true sampling function that is applied at the index level? With the amount of data being processed today, sampling is the only manageable way to produce metrics. Thanks ... View more

It appears as though users would like this to be a function like addcoltotals. Is Splunk planning on adding this feature (and possibly other stats functions) for totals? Thanks ... View more

Explanation but no answer. What is the solution to this problem? Can we tell Splunk not to store the job? ... View more

That's it! Thank you. ... View more

I can't get to the link provided. Thanks ... View more

What is the root cause of the directory filling up? Going in once a week to clean it manually seems ridiculous to me. ... View more

I tried this, but the criteria I need to check on has not been established and the variable from streamstats (cumulativeAmount) which could be used to establish the criteria, does not appear to be available in the eval statement. It passes the isnull(cumulativeAmount) check every time. ... View more

The value CUSUM is used later (omitted for brevity) to determine if a function is out of control. Anything CUSUM > than H is out of control. When the value continues to increase and gets very large, even after the function gets back into control, the variation from the mean is too small to register. For this reason I need CUSUM = min(H, max(CUSUM, 0). However, since it's getting accumulated using the streamstats, there is no way to update that value to stay within the range. Perhaps I just need to use a different method than streamstats to accumulate the ZBAR values. ... View more

This is what was suggested to me in the original answer. The problem is this way, CUSUM_SUM will go way outside the range of 0 to H. I'm starting to feel that there is no solution to this problem. ... View more

Thanks. I tried: search blah | eval CUSUM = max(0.000000, CUSUM)| eval CUSUM = min(H, CUSUM) | eval ZBAR = AVGFREQ - (CONTROLMEAN + K ) | streamstats sum(ZBAR) as CUSUM | table blah blah blah I also tried: search blah | eval CUSUM = if(CUSUM < 0, 0, if(CUSUM > H, H, CUSUM)) | eval ZBAR = AVGFREQ - (CONTROLMEAN + K ) | streamstats sum(ZBAR) as CUSUM | table blah It appears as though there are 2 variables with the name CUSUM. One is scoped to the streamstats level and the other is scoped to the event level. Just my guess. ... View more

Here is what I did: | eval ZBAR = blah blah blah | streamstats sum(ZBAR) as CUSUM | eval CUSUM = if(CUSUM < 0, 0, if(CUSUM > DECLIMIT, DECLIMIT, CUSUM)) CUSUM never got reset, in most cases it get getting more negative or positive. ... View more

Here is what I'm getting: READING_DATETIME SENSOR FREQUENCY AVGFREQ K H ZBAR ACCUMCUSUM CUSUM INCONTROL 8/15/2015 0:00 STAT 95 95 0.243851 2.43851 93.539915 93.539915 2.43851 FALSE 8/15/2015 0:05 STAT 87 91 0.243851 2.43851 89.539915 183.07983 2.43851 FALSE 8/15/2015 0:10 STAT 94 92 0.243851 2.43851 90.539915 273.619745 2.43851 FALSE 8/15/2015 0:15 STAT 89 91.25 0.243851 2.43851 89.789915 363.40966 2.43851 FALSE 8/15/2015 0:20 STAT 94 91.8 0.243851 2.43851 90.339915 453.749575 2.43851 FALSE 8/15/2015 0:25 STAT 92 91.833333 0.243851 2.43851 90.373248 544.122823 2.43851 FALSE 8/15/2015 0:30 STAT 89 91.428571 0.243851 2.43851 89.968486 634.091309 2.43851 FALSE 8/15/2015 0:35 STAT 84 90.5 0.243851 2.43851 89.039915 723.131224 2.43851 FALSE 8/15/2015 0:40 STAT 84 89.777778 0.243851 2.43851 88.317693 811.448917 2.43851 FALSE Here is what I want to see: READING_DATETIME SENSOR FREQUENCY AVGFREQ K H ZBAR ACCUMCUSUM CUSUM INCONTROL 8/15/2015 0:00 STAT 95 95 0.243851 2.43851 93.539915 2.43851 2.43851 FALSE 8/15/2015 0:05 STAT 87 91 0.243851 2.43851 89.539915 2.43851 2.43851 FALSE 8/15/2015 0:10 STAT 94 92 0.243851 2.43851 90.539915 2.43851 2.43851 FALSE 8/15/2015 0:15 STAT 89 91.25 0.243851 2.43851 89.789915 2.43851 2.43851 FALSE 8/15/2015 0:20 STAT 94 91.8 0.243851 2.43851 90.339915 2.43851 2.43851 FALSE 8/15/2015 0:25 STAT 92 91.833333 0.243851 2.43851 90.373248 2.43851 2.43851 FALSE 8/15/2015 0:30 STAT 89 91.428571 0.243851 2.43851 89.968486 2.43851 2.43851 FALSE 8/15/2015 0:35 STAT 84 90.5 0.243851 2.43851 89.039915 2.43851 2.43851 FALSE 8/15/2015 0:40 STAT 84 89.777778 0.243851 2.43851 88.317693 2.43851 2.43851 FALSE Similar if the ZBAR was a negative value, limit the accumulation of CUSUM to 0. ... View more

I tried that, but the variable used in the streamstats is not one you can alter. ... View more

I figured it out. It is a combination of eval and if: min(eval(if(status=="LOGOUT", _time,NULL))) Thanks for getting me on the right track! ... View more

I tried this, the logout_time is empty. Not sure why the "if" statements isn't working. I even tried if(1==1, _time, NULL). ... View more

This was giving me an error: min(eval(status=="LOGOUT", _time,NULL)) as logout_time I think you meant: min(if(status=="LOGOUT", _time,NULL)) as logout_time This did not produce an error, but is not returning what I need either. Thanks ... View more