About dimoklis

dimoklis · ‎01-22-2016

Did some work around on the way i aggregate the result with stats first. thanks @somesoni2. Marked as answer as it consists a general best practice

dimoklis · ‎01-20-2016

Hi somesoni2 thanks for the reply. I am running it once a day in dead quiet period. Think there is a bottleneck with timechart/untable

dimoklis · ‎01-20-2016

Hello, I have a scheduled saved search which populates a summary index with ~50M events. As the search is triggered, I monitor the progress in the Job Inspector. I noticed that it reaches 100% in about 30mins. After this point, the search fails to report any more progress. I have checked the search.log and the last update is about the "StatsProcessor - flushed stats...." into a gzipped file in the scheduler's job directory. I also checked this directory and in the file status.csv it reports as "FINALIZING". Waiting a couple of hours and no progress. My concern is that in the flushed results reported a count of ~9M events which is correct for based on the indexed events. However, I use timechart and then untable in order to fill empty buckets and this is the expansion to 50M events. Also, scheduler's log in index _internal does not report any error or whatever. Is there another log/process I could check to gather more details? or any more ideas? My limits.conf are configured to handled such big searches as well. thanks, Dimoklis

dimoklis · ‎01-13-2016

Thanks somesoni2, found it yesterday using the same logic as you suggested!

dimoklis · ‎01-12-2016

hi and thanks @Iguinn, please see below: ...|bucket _time span=2h |stats sum(quantity) as total by id, _time | streamstats sum(total) as cumulative_total by id| eval period=strftime(_time,"%H") PS. Ihave tried with timechart which can automatically fill the gaps in time and values but my data gets transposed. I need to maintain the table layout as per the example if possible

dimoklis · ‎01-11-2016

hi sundareshr, yes it is. these are 2h time spans within a day string from 00,02,04,...22 (12 total)

dimoklis · ‎01-11-2016

Hello, I have an output table like below from a streamstats call on my events: period total cummulative_total 1 14 14 3 15 29 4 5 34 6 10 44 where periods are time spans of 2h and total and cumulative total are sums from stats and streamstats respectively. What I would like to ask is whether there is a way to autocomplete data rows for a full set of periods. in the example above periods 2 , 5 ,7....12 are missing as you see. I would like to end up with a table like below: period total cummulative_total 1 14 14 2 0 14 3 15 29 4 5 34 5 0 34 6 10 44 . . . . . . so period 2 and 5 as for example take totals as 0, but keep cumulative ones from previous period stats. Many thanks in advance, Dimoklis.

dimoklis · ‎08-12-2015

Hi all, Sorry for the "same" title as many other posts have, but I have gone through all the related with no luck I am afraid.. My setup is as following: Distributed env 1 SH 1 IND both 6.2.2 DB Connect v2 (2.0.4) installed in SH with Java 8 and MySQL J Connector v5.1.* Setting up DB identities and connections within my app context works perfectly fine. Setting up db lookups is also almost fine, apart from the fact that I am only getting partial (if any) results in the Preview your Lookup step (5) of the creation process. Lets call this MyLookup in DB Connect. I have copied the dblookup.py script in my app's bin folder after getting the error that the script does not exist. I am calling the lookup as following on the DB Fields -call it DBF: ...| rename SPF as DBF| lookup db_connect_MyLookup DBF DBF is renamed from my Splunk Field - call it SPF db_connect_MyLookup is how the db lookup is named automatically in my Splunk Lookups. All access rights and permissions are set properly I think since i am calling the lookup within my app. I am getting the aforementioned error without DB Connect complaining in its "Health" service. The strange thing (for me as a newbie) is that the error comes with my indexer's tag at the front when i am running the search. like: [indexerID] The script for the lookup "MyLookup" returned with error code 1. Results may not be complete...etc... Any thoughts and pointers would be greatly appreciated. PS. I am getting similar errors when trying to lookup in an Oracle DB using the same setup.

dimoklis · ‎06-10-2015

Hello all, apologies for the naive question but i am fairly new into Splunk (v6). So my question is as follows: 1) is it possible through a form for a (end)user to write (or select) a set of values for a field and save them as a group of values for later (e.g. another session)? 2) if (1) is possible, can this -if I may call it - knowledge object- be used as a selection for field value in the same or another form/app (e.g. a search for updating a chart)? Many thank for your help Dimoklis.

Posts	9
Solutions	0
Karma Given	3
Karma Received	3
Member Since	‎03-17-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to troubleshoot why a scheduled saved search t...

How to autofill rows in a table, even if there are...

Splunk DB Connect 2: The (db) lookup script return...

How can a user define a list of field values and s...

Re: How to troubleshoot why a scheduled saved sear...

Re: How to troubleshoot why a scheduled saved sear...

How to troubleshoot why a scheduled saved search t...

Re: How to autofill rows in a table, even if there...

Re: How to autofill rows in a table, even if there...

Re: How to autofill rows in a table, even if there...

How to autofill rows in a table, even if there are...

Splunk DB Connect 2: The (db) lookup script return...

How can a user define a list of field values and s...