Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About srive326
srive326
Explorer
Member since:
09-20-2019
10-23-2020
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 2 |
| Member Since | 09-20-2019 |
Activity Feed
- Got Karma for How to distinguish clusterGroup colors in Maps+ for Splunk?. 01-16-2023 05:17 AM
- Posted How to distinguish clusterGroup colors in Maps+ for Splunk? on All Apps and Add-ons. 10-22-2020 12:51 PM
- Tagged How to distinguish clusterGroup colors in Maps+ for Splunk? on All Apps and Add-ons. 10-22-2020 12:51 PM
- Karma Re: How to export a table filtered through dashboard as CSV? for anilchaithu. 07-14-2020 12:17 PM
- Karma Re: How to export a table filtered through dashboard as CSV? for niketn. 07-14-2020 12:17 PM
- Posted How to export a table filtered through dashboard as CSV? on Dashboards & Visualizations. 07-06-2020 08:31 AM
- Posted Re: How to fill auto-fill missing dates in a time range and fill null with previous value? on Splunk Search. 05-05-2020 01:26 PM
- Posted Re: How to fill auto-fill missing dates in a time range and fill null with previous value? on Splunk Search. 05-05-2020 09:09 AM
- Posted Re: How to fill auto-fill missing dates in a time range and fill null with previous value? on Splunk Search. 05-05-2020 06:54 AM
- Posted Re: How to count events that occurred 60 minutes apart (not on the hour)? on Splunk Search. 05-04-2020 01:37 PM
- Posted How to fill auto-fill missing dates in a time range and fill null with previous value? on Splunk Search. 05-04-2020 01:30 PM
- Tagged How to fill auto-fill missing dates in a time range and fill null with previous value? on Splunk Search. 05-04-2020 01:30 PM
- Tagged How to fill auto-fill missing dates in a time range and fill null with previous value? on Splunk Search. 05-04-2020 01:30 PM
- Tagged How to fill auto-fill missing dates in a time range and fill null with previous value? on Splunk Search. 05-04-2020 01:30 PM
- Posted Re: How to count events that occurred 60 minutes apart (not on the hour)? on Splunk Search. 05-01-2020 11:42 AM
- Posted How to count events that occurred 60 minutes apart (not on the hour)? on Splunk Search. 04-29-2020 02:06 PM
- Tagged How to count events that occurred 60 minutes apart (not on the hour)? on Splunk Search. 04-29-2020 02:06 PM
- Tagged How to count events that occurred 60 minutes apart (not on the hour)? on Splunk Search. 04-29-2020 02:06 PM
- Tagged How to count events that occurred 60 minutes apart (not on the hour)? on Splunk Search. 04-29-2020 02:06 PM
- Tagged How to count events that occurred 60 minutes apart (not on the hour)? on Splunk Search. 04-29-2020 02:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-22-2020
12:51 PM
1 Karma
Hello,
I'm working on customizing a Maps+ for Splunk visualization and I need help distinguishing different clustergroups by color. I've used the SPL command clusterGroup to label different clusters but there's no way to tell which cluster belongs to which group. Any help with this would be appreciated, thank you.
Kind regards,
Stephanie
... View more
- Tags:
- Maps+ for Splunk
Labels
- Labels:
-
other
07-06-2020
08:31 AM
Hello,
I created a dashboard that works as a tool to filter a much larger report.
For example, I'm using inputs/dropdown menus to filter by different columns. When I go to export the table that's been filtered with the dashboard, the icon to export as CSV is disabled. I'm writing to ask if there's a way to work around this?
I know that this question has been asked but most of the threads I see on this question are many years old which is why I wanted to ask again in case anything has changed.
Thank you for your help.
... View more
Labels
- Labels:
-
table
05-05-2020
01:26 PM
Ok, I will write a new question with all those details. I left them out because I thought I would be able to handle the second part of the query on my own.
... View more
05-05-2020
09:09 AM
Hello,
Thank you for your input. I changed the limit to 0 and this helped return more USERNUMBERS.
I modified what to4kawa shared so it now looks like this:
| timechart limit=0 cont=f span=1d list(WEIGHT) by USERNUMBER
| makecontinuous _time span=1d
| rename COMMENT as "Timerange created. check at this"
| filldown
| eval _time=strftime(_time,"%Y-%d-%m %H:%M")
|transpose header_field=_time
This returns the USERNUMBER counts I expected (about 80k) but it only shows the first 5 dates as columns. Is there something else I need to edit to show the other dates?
I did get this error after it finished running: Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.
Also if I don't transpose the program doesn't finish and I get a few different errors.
... View more
05-05-2020
06:54 AM
Good morning,
Thank you for your help with this query. The goal in getting the data in that format is that I then have to look for each USERNUMBER add a conditional statement if the weight on a given day is greater than 500.000 or not, then add how many USERS had a weight over 500 and how many didn't on each day in April. I used your code and it worked in filling in the missing dates and also filling in with previous weights on the missing date (thank you). However, I have over 80,000 unique usernumbers, this means that I should have that many number of columns (splunk truncates them to show just 10). I tried transposing the result so I can instead have a table like this:
USERNUMBER 04/02/2020 04/03/2020
545 245.2400 260.2400
but I still got only 10 USERNUMBERS/rows.
Given these details, what would be the best way to display the data so I can add the conditional statements? Thank you again for your help.
... View more
05-04-2020
01:37 PM
That worked perfectly, thank you!
... View more
05-04-2020
01:30 PM
Hello everyone,
I need help with a query.
I have a table with the following fields:
_time USERNUMBER WEIGHT
2020-04-02 07:17:12.397 545 245.2400
2020-04-02 07:17:12.400 547 100.0011
2020-04-03 07:15:37.956 545 260.2400
2020-04-06 07:16:41.763 545 245.2400
2020-04-09 07:15:38.864 545 612.5600
2020-04-10 07:15:59.845 545 245.2400
2020-04-10 07:17:12.401 547 100.0011
2020-04-13 07:16:32.169 545 245.0258
2020-04-15 07:15:37.027 545 245.2400
2020-04-15 07:15:37.027 547 120.2400
2020-04-16 07:15:44.469 545 156.2400
2020-04-17 07:15:46.726 545 245.0215
2020-04-20 07:16:45.495 545 142.2400
2020-04-22 07:15:54.629 545 245.0214
2020-04-22 07:15:54.629 547 106.0521
2020-04-23 07:15:43.608 545 965.2850
2020-04-25 07:15:50.403 545 245.2100
2020-04-27 07:16:48.186 545 335.2400
2020-04-28 07:15:52.713 545 245.5596
2020-04-29 07:15:54.472 545 520.2400
2020-05-01 07:15:52.179 545 245.0018
I want to show for each USERNUMBER the weight on each day of the month of April. The problem is, that
the weight is only updated when there has been a change. How can I autofill the missing dates in April, and also
populate the WEIGHT for those missing dates with the WEIGHT that was there the previous day for that USER.
So for example if I'm only looking at USERNUMBER 545 the rows from 04/02 to 04/09 will look like:
2020-04-02 07:17:12.397 545 245.2400
2020-04-03 07:15:37.956 545 260.2400
2020-04-04 00:00:00.000 545 260.2400
2020-04-05 00:00:00.000 545 260.2400
2020-04-06 07:16:41.763 545 245.2400
2020-04-07 00:00:00.000 545 245.2400
2020-04-08 00:00:00.000 545 245.2400
2020-04-09 07:15:38.864 545 612.5600
Sidenote: The Hour/Time component of the date is not important to me
I hope this makes sense, thank you in advance for your help.
... View more
05-01-2020
11:42 AM
Hi,
Thank you so much for your answer. I implemented it on my data and I noticed that there is one thing I should add. There can be multiple users/USERNUMBER so using
|autoregress _time as prev_time
on my data has the effect of using another users previous time instead of the prev_time specific to that user. Is there a way I can make the |autoregress _time as prev_time conditional to the USERNUMBERs so that for example each unique USERNUMBER will have null for the first time they visit a site on the prev_time column. Thank you again for your help.
... View more
04-29-2020
02:06 PM
Hello everyone,
I need help with a search.
I have a table with the following fields:
VISITDATE USERNUMBER WEBSITE
4/19/2020 7:15:11 001 www.google.com
4/26/2020 10:24:03 001 www.google.com
4/26/2020 10:33:03 001 www.google.com
4/26/2020 11:15:12 001 www.google.com
4/26/2020 11:30:12 001 www.google.com
4/28/2020 14:30:12 001 www.google.com
I want to count the number of visits (by usernumber and website) that occurred 60 minutes apart, and return the earliest
time in that 60-minute bucket.
VISITDATE USERNUMBER WEBSITE COUNT
4/19/2020 7:15:11 001 www.google.com 1
4/26/2020 10:24:03 001 www.google.com 3
4/26/2020 11:30:12 001 www.google.com 1
4/28/2020 14:30:12 001 www.google.com 1
For example, using bins or buckets with a 60-min/1-hour time span that snap to the hour 10:00 -11:00 is one hour and that would give me this result, which I don't want:
VISITDATE USERNUMBER WEBSITE COUNT
4/19/2020 7:15:11 001 www.google.com 1
4/26/2020 10:24:03 001 www.google.com 2
4/26/2020 11:15:12 001 www.google.com 2
4/28/2020 14:30:12 001 www.google.com 1
Thank you in advance for your help.
... View more
09-20-2019
01:12 PM
I found a solution in another post which is to fill the NULL values with the string "NULL"
| fillnull field_of_interest value="NULL" | latest(field_of_interest)
... View more
09-20-2019
09:20 AM
I found a solution in another post which is to fill the NULL values with the string "NULL"
| fillnull field_of_interest value="NULL" | latest(field_of_interest)
... View more
09-20-2019
08:53 AM
Hello,
I'm trying to extract some fields for the latest event based on unique account numbers. I've tried using latest(field) but the issue I'm running into is for example:
Event date: 9/20/2019 field_of_interest: NULL
9/19/2019 field_of_interest: "04/09/2019"
9/18/2019 field_of_interest: NULL
When I do latest(field_of_interest) I'm being returned "04/09/2019" when I want to retrieve the NULL from 09/20/2019.
I've read other answers that lead me to believe I may need to do latest(_raw) and look for the field with a regex but maybe there is another approach?
Thank you in advance for your help in this, I hope the question is clear!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-23-2020
12:14 AM
|
