earliest=-48h@h latest=-24h@h index="my-live-srv" sourcetype="Perfmon:sqlserver:sql_errors" counter="Errors/sec"| where instance="User Errors" | stats avg(Value) as PrevErrors | appendcols [ search earliest="-24h@h" latest="@h" index="my-live-srv" sourcetype="Perfmon:sqlserver:sql_errors" counter="Errors/sec" instance="User Errors" | stats avg(Value) as CurrErrors ]| eval PrevErrors=if(isnull(PrevErrors), 0, PrevErrors) | eval CurrErrors=if(isnull(CurrErrors), 0, CurrErrors) | eval CurrErrors=round(CurrErrors,3) |eval PrevErrors=round(PrevErrors,3) |eval CurrErrors=(CurrErrors + " Errors/sec") | eval PrevErrors=(PrevErrors + " Errors/sec") | appendcols [search earliest="-48h" latest="@h" index="my-live-srv" sourcetype="sql-trace" |where Date!="*$" | eval time_marker = if (_time < relative_time(now(), "-24h"), "yesterday", "today")| eval _time = if (time_marker=="yesterday", _time + 24*60*60, _time) ]| streamstats current=f window=1 global=f last(PrevErrors) as PrevErrors | streamstats current=f window=1 global=f last(CurrErrors) as CurrErrors|table CurrErrors,PrevErrors,time_marker,Date,Time, ID, HostName, ClientProcessID, ApplicationName, LoginName, SPID, Severity, EventClass, State, Error, DatabaseName, EventSequence I want to save this as an alert but I want the alert to trigger only when CurrErrors >1. How can I do this ? I have tried with where condition but I dont have the expected result ... View more

Is anyway to find all historical results of a scheduled report in splunk? I've seen about REST and the | history command but that command shows only when that report has been scheduled but I want the results of that scheduled report. I've seen also the summary indexing case but summary indexing only collects data from that report but doesn't offer any historical links where to click and see the results. ... View more

earliest=-72h@h latest=@h index=dga | transaction EventType maxevents=2 |stats count as total | appendcols [search earliest=-72h@h latest=@h index=dga | transaction EventType maxevents=2| where Result="False" OR Result="false" |timechart span=1h count | eval time=_time-now()%259200 | timechart span=24h sum(count) as count | tail 3 | tail 2 | eval _time=_time+now()%259200] | eval percentage=count*100/total | table count, p Why can't it calculate the whole percentage? It calculates only for the first row ... View more