Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About therockhead
therockhead
Path Finder
Member since:
03-24-2015
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 3 |
| Member Since | 03-24-2015 |
Activity Feed
- Karma Re: Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance? for LukeMurphey. 06-05-2020 12:47 AM
- Karma Re: Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance? for ngatchasandra. 06-05-2020 12:47 AM
- Karma Re: Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance? for LukeMurphey. 06-05-2020 12:47 AM
- Karma Re: Question regarding join for masonmorales. 06-05-2020 12:47 AM
- Got Karma for Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to get percentiles in pivots?. 06-05-2020 12:47 AM
- Posted Re: How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access? on Splunk Search. 06-12-2015 05:37 AM
- Posted How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access? on Splunk Search. 06-12-2015 02:18 AM
- Tagged How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access? on Splunk Search. 06-12-2015 02:18 AM
- Tagged How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access? on Splunk Search. 06-12-2015 02:18 AM
- Tagged How to create and declare a reuseable calculated eval expression that each of my data model's eval fields can access? on Splunk Search. 06-12-2015 02:18 AM
- Posted Is it possible to get percentiles in pivots? on Reporting. 04-07-2015 03:45 AM
- Tagged Is it possible to get percentiles in pivots? on Reporting. 04-07-2015 03:45 AM
- Tagged Is it possible to get percentiles in pivots? on Reporting. 04-07-2015 03:45 AM
- Posted Re: Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance? on Splunk Search. 03-31-2015 02:41 AM
- Posted Re: Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance? on Splunk Search. 03-26-2015 11:43 PM
- Posted Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance? on Splunk Search. 03-26-2015 06:25 AM
- Tagged Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance? on Splunk Search. 03-26-2015 06:25 AM
- Tagged Is it possible to create a dashboard where you must manually select a panel before a search is run to improve performance? on Splunk Search. 03-26-2015 06:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 2 | |||
| 0 |
06-12-2015
05:37 AM
Can this macros be applied to the calculated fields in the data model (not in the actual query as this is created by the pivots) ?
... View more
06-12-2015
02:18 AM
In my data model, I have a number of calculated fields that are derived from an Eval Expression. As the same expression is needed in multiple Data Model's, I'm starting to see some repeated logic. Is it possible for me to declare a function globally that each of my Data Model's expressions fields can access.
So instead of the following in my Expression:
if( 'some_node' = "YES" or 'some_other_node' = "YES", "true", "false")
I would have
if(myFunction(some_node,some_other_node)
Thanks.
... View more
04-07-2015
03:45 AM
1 Karma
Hi,
I'm attempting to port over some searches to pivots and data models for performance reasons. One issue I'm seeing is getting the percentiles. For example the old search may have something like
| stats perc25(Duration) AS "25th Percentile", median(Duration) AS "Median", perc75(Duration) AS "75th Percentile", perc95(Duration) AS "95th Percentile"
Is this possible in pivots?
Thanks,
Bill
... View more
- Tags:
- percentile
- pivot
03-31-2015
02:41 AM
Wow - thanks for the great write up.
... View more
03-26-2015
11:43 PM
Sounds like a great approach. Would definitely be interested in a blog post!
... View more
03-26-2015
06:25 AM
2 Karma
Hi,
I have the task of improving some of the performance issues with our instance of Splunk. One of the issues I see with our installation is that some dashboards have over 30 panels/searches which hammer the server as soon as you navigate to the dashboard and select a time range. Is it possible to have a dashboard where you must manually select the panel before they are run?
Thanks,
Bill
... View more
03-24-2015
09:26 AM
Ok the issue was my Action was nested and the eval didnt like that .... so
stats count(eval(body.ACTION="shop")) would not work
I renamed body.ACTION to ACTION
and changed my query to
count(eval(ACTION="shop"))
and it now works great. Thanks for all your help!!
... View more
03-24-2015
08:57 AM
Also count(eval(ACTION!="shop")) as NonShopperCount returns 0 as well.
... View more
03-24-2015
08:55 AM
So if it dont include stats the data format looks correct. If it add the following for example - stats count(eval(ACTION="shop")) as ShopperCount the result will be 0
... View more
03-24-2015
08:44 AM
Just trying it out now .. its looking better, the join is returning data that looks correct but the stats is not working.
... View more
03-24-2015
07:59 AM
Sure .. for example here are two separate events
message: {
context: {
user_id: 443d5c6c-32ad-460e-a387-b077e9c47f3f
....
}
time: 2015-03-24T14:51:58.721Z
action: shop
}
message: {
context: {
user_id: 443d5c6c-32ad-460e-a387-b077e9c47f3f
.....
}
time: 2015-03-24T14:51:58.721Z
action: login
}
... View more
03-24-2015
07:34 AM
Thanks for response but it did not work for me. The join is only returning the user_id and no action data so that stats always return 0.
... View more
03-24-2015
06:46 AM
Beginner here, I'm trying to do the following in one query
1) Get all unique users and the count of users
2) Using all the unique users from query 1, search for who has done action "shop"
3) Show % of people who did the action "shop"
This is what i have tried so far ..
sourceTag=test index=test | stats dc(user_id) AS "Total Users" | JOIN user_id [search sourceTag=test index=test ACTION="shop" | stats dc(user_id) AS "Shoppers Users" ] | eval PercentageOfUsers=round(tonumber('Shopper Users') * 100 / tonumber('Total Users'))
Any ideas whats wrong?
Thanks,
Bill
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
