I've created a summary index where it contains 6 eval cases, for example: eval 1=case(match(something,"a",...."b","c"), eval 2 =case (d,e,f)....eval 6=case(x,y,z) where a,b,c....x,y,z are the individual detailed functions and 1,2,3,4,5,6 are overall functions. Now I have combined all eval functions into a single value using eval Total_Function = mvappend(1,2,3,4,5,6). But I want to list the table with both overall function & individual detailed function as well. But I am not sure how to get individual detail values in the table along with overall function. Expected table as below: Time Total_Function      Overallfunction Individual function XX     T otal_Function          1                               a YY       Total_Function          1                               b ZZ       Total_Function          1                               c AA       Total_Function         6                               x BB       Total_Function         6                               y CC      Total_Function          6                               z                      Kindly help me please. (Please note, there are multiple individual functions in each eval case) ... View more

Hi Splunk Experts I've created a summary index where it contains 6 eval cases, for example: eval 1=case(match(something,"a",...."b","c"), eval 2 =case (d,e,f)....eval 6=case(x,y,z)  where a,b,c....x,y,z are the individual detailed functions & 1,2,3,,4,5,6 as overall functions. Now I have combined all eval functions into a single value using eval Total_Function = mvappend(1,2,3,4,5,6). But I want to list the table with both overall function & individual detailed function as well. But I am not sure how to get individual detail values in the table along with overall function. Expected table as below: Time Total_Function      Overallfunction Individual function XX     T otal_Function          1                               a YY       Total_Function          1                               b ZZ       Total_Function          1                               c AA       Total_Function         6                               x BB       Total_Function         6                               y CC      Total_Function          6                               z                      Kindly help me please. (Please note, there are multiple individual functions in each eval case)   ... View more

Hello Experts I have 3 dashboards basically. Board 1 represents total login attempts for an hour (including successful & failure attempts) Search example: index=main1 SOURCETYPE=base1 "TEXT MATCHING FOR SUCCESSFUL LOGIN" OR "TEXT MATCHING FOR FAILURE LOGIN" index=main2 SOURCETYPE=base2 "TEXT MATCHING FOR SUCCESSFUL LOGIN" OR "TEXT MATCHING FOR FAILURE LOGIN" index=main3 SOURCETYPE=base3 "TEXT MATCHING FOR SUCCESSFUL LOGIN" OR "TEXT MATCHING FOR FAILURE LOGIN" | dedup username |timechart span=1m count(username) as TOTAL_COUNT | eval _time=_time-now()%3600 | timechart span=1h sum(TOTAL_COUNT) as ALLCOUNT | tail 3 | tail 2 | eval _time=_time+now()%3600 Board 2 represents successful attempts for an hour (among total login counts from board 1) Search example: index=main1 SOURCETYPE=base1 "TEXT MATCHING FOR SUCCESSFUL LOGIN" index=main2 SOURCETYPE=base2 "TEXT MATCHING FOR SUCCESSFUL LOGIN" index=main3 SOURCETYPE=base3 "TEXT MATCHING FOR SUCCESSFUL LOGIN" | dedup username |timechart span=1m count(username) as TOTAL_COUNT | eval _time=_time-now()%3600 | timechart span=1h sum(TOTAL_COUNT) as ALLCOUNT | tail 3 | tail 2 | eval _time=_time+now()%3600 Board 3 represents failed attempts for an hour (among total login counts from board 1) Search example: index=main1 SOURCETYPE=base1 "TEXT MATCHING FOR FAILURE LOGIN" index=main2 SOURCETYPE=base2 "TEXT MATCHING FOR FAILURE LOGIN" index=main3 SOURCETYPE=base3 "TEXT MATCHING FOR FAILURE LOGIN" | dedup username |timechart span=1m count(username) as TOTAL_COUNT | eval _time=_time-now()%3600 | timechart span=1h sum(TOTAL_COUNT) as ALLCOUNT | tail 3 | tail 2 | eval _time=_time+now()%3600 At any point of time total login should show the sum of successful & failure attempts and it has to compare with the trend for last 60 mins (in single value panel and time set as last 120 min) But in my board it both total & successful login showing same values and total attempts is not equal to sum of successful & failure attempts. Kindly help me to tune the query like, total login should show the sum of successful & failure attempts. or any other way to make this simple one please. ... View more

Hi Splunk Experts As I m trying to show the trend for 7 days, I have involved the below eval expression to seperate the _time things (date_hour,date_minute,date_wday,date_mday,date_month,date_year). Time Expression: | eval Date=strftime(_time,"%Y-%m-%d") | rex field="Date" "^(?[^-]+)-(?[^-]+)-(?.+)" | eval date_hour=strftime(_time,"%H") | eval date_minute=strftime(_time,"%M") | eval date_wday=strftime(_time,"%w") and I m using the below trend query to show 7 days trend. stats dc(user_id) AS USERS by date_hour, date_wday, Platform | chart eval(round(avg(USERS),0)) AS "AVERAGE USERS LOGGED IN" over date_hour by Platform However I could see the date_hour from 0 to 9 is repeated twice in graph like showing as 0,00,1,01,2,02.....9,09 but both 0,00 is showing the same value. Could You please suggest me how to eliminate this repeated values for the date_hour on the graph. And for your reference I am using Summary Index concept and from that I am picking up the fields to draw the trend. ... View more

Hello Experts Actually I am trying to show the usage trends across one application on different platforms (Online, Mobile & other platforms) as different trends as 30 days, 7 days and 24 hrs trends. Here are the details: There are 3 indexes 1a,2b and 3c with many source types. index=1a (ONLINE PLATFORM) In index=1a the field ( say "ClientId" which I required is directly there I am doing the lookup against the file. ( since in the index 1a, both userid and clientId fields are there I Can evaluate the Userid and then join the ClientId through the lookup. Source types are sourcetype="ONLINE_ACTIVITYLOG" index=2b (other platform) But in index=2b, I have to evaluate the field "Userid" from different source types and do input lookup and join the "ClientId" from the same input lookup. Source types are : sourcetype="PROD_APPLOG",HTTP_USER, sourcetype="PROD_APPLOG",UserID, sourcetype="PROD_APPLOG",userId, sourcetype="PROD_APPLOG",usrLogin, sourcetype="PROD_APPLOG",http_user, sourcetype="PROD_APPLOG",user_cookie, sourcetype="PROD_APPLOG",userID, sourcetype="PROD1_APPLOG",Http_User, sourcetype="PROD1_APPLOG",prod_USER, sourcetype="PROD_WEBLOG",HTTP_USER, sourcetype="PROD_WEBLOG",user_cookie, sourcetype="PROD_WEBLOG",userID, sourcetype=="F5_APPLOG",http_user, sourcetype=="F5_APPLOG",user_cookie, index=3c (MOBILE PLATFORM) Source types are: sourcetype="MOBILE_WEBLOG",HTTP_USER, sourcetype="MOBILE_APPLOG",user_cookie Inputlookup Filename: UserId.csv Inputlookup file format: Userid Clientid User1 Client1 User2 Client2 As mentioned, When I tried to show the trend for 30 days,7 days & 24 hrs (across 12 panels in one dashboard) - the data is not at all loading and performance is very slow. When I verified with few of my Engineering colleagues, they said "I am searching the same query in multiple panels on the dashboard that causing slowness and asking me to CREATE a BASE SEARCH and use that to draw the trend as required" As I am fairly new to splunk, I am confused how to create a base search for this issue since it is across multiple indexes. Also is the data model & search base query concepts are same? And they are asking me to accelerate the search once created the base query ***. Could you please help me to create search base query for above issue. ** ACTUAL QUERY which I am using across all the panels in the dashboard: index= "1a" OR index="2b" OR index="3c" | eval Platform = case( index="1a", "Online", index="2b", "Mobile", index="3c", "OtherPlatforms") | eval Userid= case( sourcetype="PROD_APPLOG",HTTP_USER, sourcetype="PROD_APPLOG",UserID, sourcetype="PROD_APPLOG",userId, sourcetype="PROD_APPLOG",usrLogin, sourcetype="PROD_APPLOG",http_user, sourcetype="PROD_APPLOG",user_cookie, sourcetype="PROD_APPLOG",userID, sourcetype="PROD1_APPLOG",Http_User, sourcetype="PROD1_APPLOG",prod_USER, sourcetype="PROD_WEBLOG",HTTP_USER, sourcetype="PROD_WEBLOG",user_cookie, sourcetype="PROD_WEBLOG",userID, sourcetype=="F5_APPLOG",http_user, sourcetype=="F5_APPLOG",user_cookie, sourcetype="ONLINE_ACTIVITYLOG" AND ACTIVITY_CATEGORY=="{signin}",USR_LOGIN, sourcetype="MOBILE_WEBLOG",HTTP_USER, sourcetype="MOBILE_APPLOG",user_cookie) | lookup Userid.csv Userid AS Userid output Clientid | stats dc(Clientid) as total_clients by date_hour,date_wday,Platform | chart avg(Clientid) over date_hour by Platform only the "| stats dc(Clientid) as total_clients by date_hour,date_wday,Platform | chart avg(Clientid) over date_hour by Platform" -> this part is varying across all panels as I am showing as chart(avg) & dc etc. ... View more

Hi experts! Since I am new to Splunk, I understand that we cannot use a time chart with inputlookup(?). But I am using (outputlookup + scheduled report) concept to run every hr and using that as inputlookup in the dashboard to draw the trends for 24 hrs and 7 days. Here the format of the lookup: Inputlookup name: customerslog.csv Userid Clientid date_year date_month date_mday date_wday date_hour date_minute channel abc1 clientid1 2019 november 1 friday 17 55 ONLINE abc2 clientid2 2019 november 1 friday 19 25 MOBILE abc3 clientid1 2019 october 31 thursday 11 44 ONLINE abc4 clientid1 2019 november 1 friday 13 26 MOBILE abc5 clientid2 2019 october 31 thursday 12 4 MOBILE abc6 clientid2 2019 november 2 saturday 16 23 MOBILE abc7 clientid1 2019 november 1 friday 18 2 MOBILE abc8 clientid2 2019 november 1 friday 17 53 MOBILE abc9 clientid2 2019 october 31 thursday 11 47 MOBILE abc10 clientid2 2019 november 1 friday 20 14 ONLINE abc11 clientid1 2019 october 30 wednesday 19 10 MOBILE abc12 clientid2 2019 november 1 friday 18 3 ONLINE abc13 clientid2 2019 november 1 friday 12 1 MOBILE abc14 clientid2 2019 november 1 friday 19 26 MOBILE abc15 clientid1 2019 november 1 friday 11 59 ONLINE abc16 clientid2 2019 october 31 thursday 11 45 MOBILE abc17 clientid1 2019 october 31 thursday 12 8 MOBILE abc18 clientid2 2019 october 30 wednesday 11 56 MOBILE abc19 clientid1 2019 october 30 wednesday 16 57 ONLINE I would like to show the clientid volume as AVERAGE VOLUME FOR LAST 7 days and Userid volume for last 24 hrs with respect to current time with interval (span=15m) by using the same above inputlookup. To show the average of Client volume across the channel for last 7 days : |inputlookup customerslog.csv | dedup clientid | stats count(clientid) AS CLIENTS by date_hour, date_wday, channel | chart eval(round(avg(CLIENT),0)) AS "AVERAGE NO.OF CLIENTS LOGGED IN" over date_hour by Channel To show the trend for last 24 hrs: |inputlookup customerslog.csv | stats count(Userid) AS USERSONLY by date_hour, date_wday, channel | chart eval(round(avg(USERSOLNY),0)) AS "AVERAGE NO.OF USERS LOGGED IN" over date_hour by Channel --> this is giving same result similar to 7 days trend |inputlookup customerslog.csv | timechart avg(USERONLY) span=15m --> Not Working |inputlookup customerslog.csv where earliest=-24h@h latest=now | timechart sum(Userid) as USERSONLY by channel --> Not working |inputlookup customerslog.csv | timechart span=15m sum(Userid) As "USERSONLY" by channel --> Not working Should I really use earliest and now for the 24hrs trend? Kindly help me with this please and share the search if you have? ... View more

Hello Experts Actually I am trying to show the usage trends across one application on different platforms (Online, Mobile & other platforms) as different trends as 30 days, 7 days and 24 hrs trends. Here are the details: There are 3 indexes 1a,2b and 3c with many source types. index=1a (ONLINE PLATFORM) In index=1a the field ( say "ClientId" which I required is directly there I am doing the lookup against the file. ( since in the index 1a, both userid and clientId fields are there I Can evaluate the Userid and then join the ClientId through the lookup. Source types are sourcetype="ONLINE_ACTIVITYLOG" index=2b (other platform) But in index=2b, I have to evaluate the field "Userid" from different source types and do input lookup and join the "ClientId" from the same input lookup. Source types are : sourcetype="PROD_APPLOG",HTTP_USER, sourcetype="PROD_APPLOG",UserID, sourcetype="PROD_APPLOG",userId, sourcetype="PROD_APPLOG",usrLogin, sourcetype="PROD_APPLOG",http_user, sourcetype="PROD_APPLOG",user_cookie, sourcetype="PROD_APPLOG",userID, sourcetype="PROD1_APPLOG",Http_User, sourcetype="PROD1_APPLOG",prod_USER, sourcetype="PROD_WEBLOG",HTTP_USER, sourcetype="PROD_WEBLOG",user_cookie, sourcetype="PROD_WEBLOG",userID, sourcetype=="F5_APPLOG",http_user, sourcetype=="F5_APPLOG",user_cookie, index=3c (MOBILE PLATFORM) Source types are: sourcetype="MOBILE_WEBLOG",HTTP_USER, sourcetype="MOBILE_APPLOG",user_cookie Inputlookup Filename: UserId.csv Inputlookup file format: Userid Clientid User1 Client1 User2 Client2 As mentioned, When I tried to show the trend for 30 days,7 days & 24 hrs (across 12 panels in one dashboard) - the data is not at all loading and performance is very slow. When I verified with few of my Engineering colleagues, they said "I am searching the same query in multiple panels on the dashboard that causing slowness and asking me to CREATE a BASE SEARCH and use that to draw the trend as required" As I am fairly new to splunk, I am confused how to create a base search for this issue since it is across multiple indexes. Also is the data model & search base query concepts are same? And they are asking me to accelerate the search once created the base query ***. Could you please help me to create search base query for above issue. ACTUAL QUERY which I am using across all the panels in the dashboard: index= "1a" OR index="2b" OR index="3c" | eval Platform = case( index="1a", "Online", index="2b", "Mobile", index="3c", "OtherPlatforms") | eval Userid= case( sourcetype="PROD_APPLOG",HTTP_USER, sourcetype="PROD_APPLOG",UserID, sourcetype="PROD_APPLOG",userId, sourcetype="PROD_APPLOG",usrLogin, sourcetype="PROD_APPLOG",http_user, sourcetype="PROD_APPLOG",user_cookie, sourcetype="PROD_APPLOG",userID, sourcetype="PROD1_APPLOG",Http_User, sourcetype="PROD1_APPLOG",prod_USER, sourcetype="PROD_WEBLOG",HTTP_USER, sourcetype="PROD_WEBLOG",user_cookie, sourcetype="PROD_WEBLOG",userID, sourcetype=="F5_APPLOG",http_user, sourcetype=="F5_APPLOG",user_cookie, sourcetype="ONLINE_ACTIVITYLOG" AND ACTIVITY_CATEGORY=="{signin}",USR_LOGIN, sourcetype="MOBILE_WEBLOG",HTTP_USER, sourcetype="MOBILE_APPLOG",user_cookie) | lookup Userid.csv Userid AS Userid output Clientid | stats dc(Clientid) as total_clients by date_hour,date_wday,Platform | chart avg(Clientid) over date_hour by Platform only the "| stats dc(Clientid) as total_clients by date_hour,date_wday,Platform | chart avg(Clientid) over date_hour by Platform" -> this part is varying across all panels as I am showing as chart(avg) & dc etc., ... View more

Hello Experts Actually I am trying to join the results of two searches. There are 3 indexes 1a,2b, and 3c with many source types. In index=1a the field ( say "ClientId" which I required is directly there I am doing the lookup against the file. ( since in the index 1a, both userid and clientId fields are there I can evaluate the Userid and then join the ClientId through the lookup. But in index=2b, index= 3c I have to evaluate the field "Userid" from different sourcetypes and do input lookup and join the "ClientId" from the same input lookup. But when I am charting the results with index 2b and 2c , the values for index 1a is not showing however it is showing the huge volume. Inputlookup Filename: UserId.csv Inputlookup file format: Userid Clientid User1 Client1 User2 Client2 index= "1a" OR index="2b" OR index="3c" | eval Platform = case( index="1a", "Online", index="2b", "Mobile", index="3c", "OtherPlatforms") [ search sourcetype="onlineindex" AND CATEGORY="{signin}" [inputlookup UserId.csv] ] | append [ | eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue) | lookup Userid.csv Userid AS Userid | join ClientId [inputlookup UserId.csv] ] | Stats dc(clientId) as total_clients by date_hour,date_wday,Platform | chart avg(ClientId) over date_hour by platform ANOTHER METHOD: As mentioned earlier, for the index-="1a" both userid and clientId fields are there I Can evaluate the Userid and then join the ClientId through the lookup ( instead I am looking for direct Clientid field in the events) In the below search I am evaluating the clienId like other sourcetypes and joining "ClientId" thru input lookup. index= "1a" OR index="2b" OR index="3c" | eval Platform = case( index="1a", "Online", index="2b", "Mobile", index="3c", "OtherPlatforms") | eval Userid=case(sourcetype="onlineindex" AND CATEGORY="{signin}",Userid, sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue) | lookup Userid.csv Userid AS Userid | join ClientId [inputlookup UserId.csv] ] | Stats dc(clientId) as total_clients by date_hour,date_wday,Platform | chart avg(ClientId) over date_hour by platform In the above searches I am suspecting only the sourcetype="onlineindex" AND CATEGORY="{signin}" , the AND operator is giving issue. Please assist me. Is there any better way to redefine the search? Multisearch also I tried but it is giving some sublimi search error beacuse I am pulling millions of records. ... View more

Hello Experts Actually I am trying to join the results of two queries and show in dashboard. There are 3 indexes 1a,2b and 3c with many source types. In index=1a the field ( say "ClientId" which I required is directly there I am doing the lookup against the file. ( since in the index 1a, both userid and clientId fields are there I Can evaluate the Userid and then join the ClientId through the lookup. But in index=2b, index= 3c I have to evaluate the field "Userid" from different sourcetypes and do input lookup and join the "ClientId" from the same input lookup. But when I am charting the results with index 2b and 2c , the values for index 1a is not showing however it is showing the huge volume. Inputlookup Filename: UserId.csv Inputlookup file format: Userid Clientid User1 Client1 User2 Client2 index= "1a" OR index="2b" OR index="3c" | eval Platform = case( index="1a", "Online", index="2b", "Mobile", index="3c", "OtherPlatforms") [ search sourcetype="onlineindex" AND CATEGORY="{signin}" [inputlookup UserId.csv] ] | append [ | eval Userid=case(sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue) | lookup Userid.csv Userid AS Userid | join ClientId [inputlookup UserId.csv] ] | Stats dc(clientId) as total_clients by date_hour,date_wday,Platform | chart avg(ClientId) over date_hour by platform ANOTHER METHOD: As mentioned earlier, for the index-="1a" both userid and clientId fields are there I Can evaluate the Userid and then join the ClientId through the lookup ( instead I am looking for direct Clientid field in the events) In the below query I am evaluating the clienId like other sourcetypes and joining "ClientId" thru input lookup. index= "1a" OR index="2b" OR index="3c" | eval Platform = case( index="1a", "Online", index="2b", "Mobile", index="3c", "OtherPlatforms") | eval Userid=case(sourcetype="onlineindex" AND CATEGORY="{signin}",Userid, sourcetype=="type1",user,sourcetype=="type2",userids,sourcetype=="type3",useridvalue) | lookup Userid.csv Userid AS Userid | join ClientId [inputlookup UserId.csv] ] | Stats dc(clientId) as total_clients by date_hour,date_wday,Platform | chart avg(ClientId) over date_hour by platform In the above queries I am suspecting only the sourcetype="onlineindex" AND CATEGORY="{signin}" , the AND operator is giving issue. Please assist me. Are there any better way to redefine the query. Multisearch also I tried but it is giving some sublimit search error because I am pulling millions of records. ... View more