I installed the Google Import/Export App from https://splunkbase.splunk.com/app/2630/
I set it up by adding the json key from this tutorial https://lukemurphey.net/projects/splunk-google-docs/wiki/How_to_setup_app
Now, I am not able to see any sheets in the google drive as input lookup in Splunk
Is there any other setting needed to do this?
... View more
One more thing, as shown in the image, for 2:00 am it shows 0.79, actually, the value should be it should be for 3:00 am. Somehow, splunk searches in reverse way and scans for events in from 3:00 am to 2:00 am and then assigns the value for 2:00 am as in the below image.
I want it in other way round. the value should be shown at 3:00 am
Any idea how can we do it?
... View more
index = "A" | timechart dc(user_id) as active | appendpipe [ | inputlookup users.csv | fields user_id | stats dc(user_id) as total ] | stats values(active) As active values(total) AS total BY _time | eval ratio = active/total
Tried the above, in this "total" column is always empty
... View more
Hi @gcusello
The other index only stores the realtime activity, not the totals.
The lookup is updated by a different process which maintains the totals in lookup.
... View more
My query is something like below
index = "A" | table x | stats dc(x) as total | appendcols [search index = "B" earliest="d" latest="@now" | table y | stats dc (y) as active ] | eval ratio = active/total
index "B" consists of real time events and we get distinct user counts in variable "active".
index "A" consists of total user count
I want to plot ratio over a period of time (span = 1h)
Tried few queries but couldn't get to the result
... View more
Actually it wont help. It will sum the distinct users over hours, and the sum of distinct users might not be the actual count of "distinct users".
Eg:
10-11am 54
11-12 46
Your answer will give distinct as 100, where as distinct users can be just 65. because few of the same users might have logged in for 11-12 also
... View more
Hi,
I need to find out distinct number of users over time per hour.
I have managed to reach the below query:
| timechart span=1h dc(user_id)
What the above query does is that, it finds distinct users for each one hour.
So it returns:
time . distinct_users
12:00 am - 152
1:00 am - 50
2:00 am - 64
and so on..
What I expect is, the counts should be always increasing.
so at 2:00 am above, I expect distinct users from 12:00 am to 2:00am
... View more