Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cheriemilk
cheriemilk
Path Finder
Member since:
12-03-2019
12-08-2022
Community Statistics
| Posts | 64 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 12-03-2019 |
Activity Feed
- Posted Re: Help - How to compare and list the difference between search result and lookup file? on Getting Data In. 11-16-2022 10:31 PM
- Posted Re: Help - How to compare and list the difference between search result and lookup file? on Getting Data In. 11-16-2022 10:30 PM
- Posted How to compare and list the difference between search result and lookup file? on Getting Data In. 11-16-2022 12:00 AM
- Karma Re: how to ingest splunk data into MongoDB? for gcusello. 10-01-2022 04:32 AM
- Posted Re: How to ingest splunk data into MongoDB? on All Apps and Add-ons. 09-29-2022 05:42 PM
- Posted Re: How to ingest splunk data into MongoDB? on All Apps and Add-ons. 09-28-2022 08:21 PM
- Posted How to ingest Splunk data into MongoDB? on All Apps and Add-ons. 09-27-2022 01:27 AM
- Posted how to set not continuous number span for bucket value on Splunk Search. 11-04-2021 05:05 PM
- Posted rename row1 after transpose on Splunk Search. 10-28-2021 07:33 PM
- Posted how to combine time chart and bar chart together on Splunk Search. 10-20-2021 12:17 AM
- Posted Re: how to get stats count from 3 multile-value fields on Splunk Search. 10-14-2021 07:20 PM
- Posted how to get stats count from 3 multile-value fields on Splunk Search. 10-13-2021 01:42 AM
- Posted Re: how to create a centile chart on Dashboards & Visualizations. 10-11-2021 01:29 AM
- Posted how to create a centile chart on Dashboards & Visualizations. 10-11-2021 12:35 AM
- Posted Re: [help]Get the time duration within a specific start and end value? on Splunk Search. 08-24-2021 11:07 PM
- Posted Re: [help]Get the time duration within a specific start and end value? on Splunk Search. 08-24-2021 05:32 AM
- Posted [help]Get the time duration within a specific start and end value? on Splunk Search. 08-24-2021 01:42 AM
- Posted how to exclude several patterns by IN function? on Splunk Search. 04-07-2021 10:30 PM
- Posted how to get the user retention rate per month in last 1 year. on Splunk Search. 01-25-2021 10:11 PM
- Tagged how to get the user retention rate per month in last 1 year. on Splunk Search. 01-25-2021 10:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-16-2022
10:31 PM
hi @gcusello Thank you for the help.
... View more
11-16-2022
10:30 PM
Hi @ITWhisperer Thank you for the help. is the stats values() function case senstive? Does it treat 'PQ1' , 'pq2', 'Pq2' and 'pQ2' as a same value or treat them to 4 different values? | stats values(ACT) as ACT values(from) as from by PQ
... View more
11-16-2022
12:00 AM
hi team,
1. I have a query with below 2 columns returned only
PQ, ACT pq1, act1 PQ1, act2 pQ1, act3 pq2, act4 QP2, act5 Pq2, act6 pq3, act7 Pq3, act8 pq_3, act9 ...
2. Then I have a standard pq list csv file uploaded in splunk. In the csv file, there is a clumn called 'pq' with a standard pq values defined. please check below sample.
PQ pq1 pq2 pq3 pq4 pq5 pq6 ...
3. I want to compare the pq values in the splunk query result with the lookup csv file to find out
a) return the PQ and ACT that the PQ value is not exactly matched with the one defined in lookup file, include case sensitive issue.
b) return the PQ and ACT that the PQ value is in the query result but not in the lookup table
c) return the PQ and ACT that PQ value is not in the query but in the lookup table.
How to compose the query to meet the 3 requirements in step3?
BestRegards!
... View more
Labels
- Labels:
-
CSV
09-29-2022
05:42 PM
Hi @gcusello understood. thank you
... View more
09-28-2022
08:21 PM
HI @gcusello , Thank you for the suggestion. I have one question regarding Summary Index. Our company's data retention policy is only 3 month. the data that retention is greater than 3 month will be cleared in splunk. Then the data in new summary index will be cleared as well. Then I still can't save the data for a longer time. Thanks, Cherie
... View more
09-27-2022
01:27 AM
Hi team,
we have performance log in splunk, but the storage policy is only for 3 month. so i can't see data metric trend from splunk for whole 1 year.
Is there anyway splunk can ingest data into MongoDB? so that I can use powerBI to connect to MongoDB, and do analysis in PowerBI.
Thanks,
Cherie
... View more
Labels
- Labels:
-
other
11-04-2021
05:05 PM
Hi team, I have such event in splunk that log the employee number in each online meeting. I want to find and sats the employee number distribution and percentage% I have below query that the bin span is continuous number 100. <baseQuery>
|bin empNumber span=100
|stats count by empNumber
|eventstats sum(count) as total
|eval ratio%=round(empNumber/total*100,2)
|fields - total,empNumber
|sort - ratio% But now the stats requirement is changed. Because 90% online meeting has employee number less than 100, so I want to set such not continuous bins in one query 1) for online meeting that employee number less than 100, I want to set the bin value to 10 2)for online meeting that employee number greater than 100, I want to set the bin value to 100 And I don't want to query two times, stats by binvalue=100 first, then stats binvalue=10 again. I want to make it happen in one query. Questions: how to change my existing query to meet the query requirement.
... View more
Labels
- Labels:
-
stats
10-28-2021
07:33 PM
hi team, as titled, how to rename 'row1' to 'number' after transpose. I tried rename and replace, but doesn't work.
... View more
Labels
- Labels:
-
other
10-20-2021
12:17 AM
Hi team, 1. I have first query which return me below chart <baseQuery>
|timechart span=4w count(ACT) as countOfOpenSession,
distinct_count(UID) as countOfUserID,
distinct_count(CMN) as countOfCustomer 2. then I have second query which return me below table and chart, which is for getting the CMN value which has highest hit value per month. <baseQuery>
| stats count(ACT) as hit by date_month CMN
| eventstats max(hit) as maxhit by date_month
| where hit=maxhit
| fields - maxhit Expected Chart I want to get from splunk search: 1. combine the two queries into one. (by the way, baseQuery for the two queries in my scenario are same.) 2. combine the timeline chart and bar chart into one chart . 3. From the combined chart->on the bars, to display both CMN(customer Name) and hit count Here is an example chart I want(similar to below) how to edit the query and format to achieve the expected chart?
... View more
10-14-2021
07:20 PM
@ITWhisperer Thank you for the solution.
... View more
10-13-2021
01:42 AM
Hi team, I have below kind of data in splunk, it contains 3 fields ISRF, DSRF and DSFF. they are all multi-value fields. 2021-10-13 19:26:46,813 ISRF="[fullName,managerFullName,title,userName,division,department,location]" DSRF="[fullName,managerFullName,title,userName,division,department,location]" DSFF="[managerFullName,division,department,location,jobCodereasonForLeaving]"
2021-10-12 19:32:31,504 ISRF="[fullName,managerFullName,userName,division,department,location]" C_DSRF="[fullName,managerFullName,title,userName,division,department,location]" DSFF="[managerFullName,division,department,location,custom05,jobCode,riskOfLoss,impactOfLoss,reasonForLeaving]"
......
...... I expect the report like below format: fields count Of ISRF count Of DSRF count of DSFF fullName 2 2 0 managerFullName 2 2 2 title 1 2 0 ...... ...... resonForLeaving 0 0 1 I am trying below queries, and I am blocked how to continue for getting expected format table. <baseQuery>
|eval includeSearchResultField=replace(replace(C_ISRF,"\[",""),"\]",""),
defaultSearchResultField=replace(replace(C_DSRF,"\[",""),"\]",""),
filterFields=replace(replace(C_DSFF,"\[",""),"\]","")
|makemv delim="," includeSearchResultField
|makemv delim="," defaultSearchResultField
|makemv delim="," filterFields
... View more
Labels
- Labels:
-
stats
10-11-2021
12:35 AM
Hi team, I am using below query to display the value for perc25, perc50, perc75 and perc95 for 'latency' field for different subscribers. <base query> |chart perc25(latency) perc50(latency) perc75(latency) perc95(latency) by subscriber the chart splunk returned is below, but it is not what I want. My expected chart is below. I want : 1. 25, 50, 75 and 95 as the rating scale of x-axis, instead of subscribers. 2. Y axis to display the value returned by perc25, perc50, perc75 and perc95 2. subscribers as legends, instead of perc25, perc50, perc75 and perc95. How to get this chart?
... View more
Labels
- Labels:
-
chart
08-24-2021
11:07 PM
i get expected result by below query: index=*bizx_application AND sourcetype=perf_log_bizx AND PID="PM_REVIEW" AND PLV=EVENT AND ACT="AUTOSAVEFORM_*" AND C_ACTV="*commentEdit*" OR ACT="*SendRequest" | sort _time CMID SID UID | streamstats count(eval(ACT=="AUTOSAVEFORM_trigReq_AutoSaveForm")) as eventCounter by CMID SID UID ACT C_ACTV reset_after="ACT=AUTOSAVEFORM_trigReq_AutoSaveForm" reset_on_change=true | table SN, CMN,CMID, CIP, _time, SID,UID, ACT, C_ACTV,eventCounter | eval ACT=if(ACT=="AUTOSAVEFORM_trigReq_AutoSaveForm" AND C_ACTV=="{reason:commentEditChanged,immediate:false,timeInterval:5000}", ACT+eventCounter, ACT) | sort - _time CMID SID UID | transaction CMID SID UID startswith="ACT=AUTOSAVEFORM_trigReq_AutoSaveForm1" endswith="ACT=AUTOSAVEFORM_after_sendRequest" | table _time CMN duration | chart list(duration) as interval by _time, CMN
... View more
08-24-2021
05:32 AM
Hi @manjunathmeti , Thank you for the solution. But I am wondering if the result based on your suggested query is right or not? The obvious problematic data is for 'eventcount'. In my screenshot->the transaction blocked with red, there're 6 events totally, but the query result shows this transaction only has 3 events for eventcount field. Is this correct? Looks like, the transaction doesn't start with the first 'ACT=AUTOSAVEFORM_trigReq_AutoSaveForm'. Thanks, Cherie
... View more
08-24-2021
01:42 AM
Hi team, I have below data in splunk. And I want to get the time duration when below range. ACT start with "AUTOSAVEFORM_trigReq_AutoSaveForm", and end with "AUTOSAVEFORM_after_sendReques" I have tried below queries , but it doesn;t return the correct result. index=*bizx_application AND sourcetype=perf_log_bizx AND PID="PM_REVIEW" AND PLV=EVENT AND ACT="AUTOSAVEFORM_*" AND C_ACTV="*commentEdit*" OR ACT="*SendRequest" |reverse | transaction CMID SID UID startswith="AUTOSAVEFORM_trigReq_AutoSaveForm" endswith="AUTOSAVEFORM_after_sendRequest" | table _time duration eventcount Can anyone pease help provide a solution?
... View more
04-07-2021
10:30 PM
Hi team, I have below sample events in splunk. 2021-04-09 07:12:41,323 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.1CMID=shangThai CMN="shanghai" 2021-04-08 07:12:41,323 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.1CMID=shanghai CMN="shanghai" 2021-04-08 07:11:57,929 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=shanghaiT1 CMN="shanghai" 2021-04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=chengdu CMN="chengdu" 2021-04-08 07:11:53,871 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=chengduT3 CMN="chengdu" 2021-04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=city CMN="city" 2021-04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=beijing CMN="beijing" 2021-04-09 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=Tbeijing CMN="beijing" 2021-04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=shenyang CMN="shengyang" 2021-04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=shenyangD CMN="shengyang" In the base query, I want to filter out below events with CMID value match below patterns: 1) *T 2) *T#: # is a wildcard stands for a number. 3) *D 4) *D#: # is a wildcard stands for a number. and i am trying to filter them out by IN function, but failed. NOT CMID IN ("*T", "*T#", " *D", "*D#" ) Questions: how to achieve this by IN function? Thanks, Cherie
... View more
Labels
- Labels:
-
other
01-25-2021
10:11 PM
Hi team, I have a stats requirement to get he user retention rate that visit a module per month in last 1 year. Detail Requirement to stats: step1. find the distinct users that visit a module in 2020, January step2. go to 2020, February and find the number of users in step1 visit the module again step3. go to 2020, March and find the number of users in step2 visit the module again step4. go to 2020, April and find .... ..... 2020, December and find ... Log sample in splunk and how can I write the query to get the expected user retention rate? 2021-01-19 06:00:38,668 PLV=REQ CIP=0.0.0.0 CMID=test CMN="testCompany" UID=testUser AGN="[Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36]" module=SUCCESSION
... View more
- Tags:
- stats
- streamstats
12-14-2020
05:36 PM
@nickhills I don't quite understand for 2 questions. 1. in my dashboard, there're 6 panels added which means there're 6 queries will be run at the same time when the dashboard is opened , and the metrics for 6 queries are different, but each metric is aggregated by stats command. do you mean I should create 6 summary index for each stats query? 2. how the summary index is stored the data? when I use sistats to ingest the data to new index, how the new index and corresponding data is saved? as the command sistats is just one-time run. Thanks, Cherie
... View more
12-14-2020
01:09 AM
Hi team, I have below query to search out all raw data and out put to a table format: index=testIndex AND sourcetype=testType AND ACT!="-" AND "DT=MANUALEVENT" AND C_PG="DEVELOPMENT_GOAL_V2" OR C_PG="PERFORMANCE_GOAL_V2" | table _time, SFDC, CMN, CMID, CIP, SID, PUID, UID, MID, PID, C_PG,C_SPG, ACT There're 6 different metrics/panels in the dashboard to stats based on this query result, Question: How to create the summary index based on above query? I found that all the summary index command are below 5 si commands per this official document https://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usesummaryindexing , and I can't figure out which one to use to match my scenario. sichart sitimechart sistats, sitop, sirare
... View more
Labels
12-02-2020
12:10 AM
Hi @gcusello , Thanks for the suggestion. I tried and the performance does improve. But why the progress bar for query in each panel looks like always in "in progress" status after 1 or 2 hours, and never ended (please refer to the attached screenshot below.) The time range I select is 'Last 24h. Is there any other option I can use to speed up the dashboard running?
... View more
12-01-2020
01:05 AM
Hi team, I have created a dashboard with 8 panels, but it is running extremely extremely slow. how to improve the performance? Here is the XML source: <form>
<label>CAL Template Configuration</label>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="field1">
<label>Please select a time range</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="DC">
<label>Please select a data center</label>
<choice value="*">All</choice>
<choice value="DC02">DC02</choice>
<choice value="DC04">DC04</choice>
<choice value="DC08">DC08</choice>
<choice value="DC10">DC10</choice>
<choice value="DC12">DC12</choice>
<choice value="DC15">DC15</choice>
<choice value="DC16">DC16</choice>
<choice value="DC17">DC17</choice>
<choice value="DC18">DC18</choice>
<choice value="DC19">DC19</choice>
<choice value="DC22">DC22</choice>
<choice value="DC23">DC23</choice>
<choice value="DC41">DC41</choice>
<choice value="DC42">DC42</choice>
<choice value="DC44">DC44</choice>
<choice value="DC48">DC48</choice>
<default>*</default>
</input>
<input type="dropdown" token="ENV">
<label>Please select a environment</label>
<choice value="pc">Production</choice>
<choice value="sc">Preview</choice>
<default>pc</default>
</input>
</fieldset>
<row>
<panel>
<title># of Data Source Usage</title>
<chart>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_DS
|dedup C_CTID
|eval dataSource=replace(replace(C_DS,"\[",""),"\]","")
|makemv delim="," dataSource | where dataSource!=others
|stats count by dataSource</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true</option>
</chart>
</panel>
<panel>
<title># of Rating Type Usage</title>
<chart>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_RT
|dedup C_CTID
|eval ratingType=replace(replace(C_RT,"\[",""),"\]","")
|makemv delim="," ratingType
|stats count by ratingType</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true</option>
</chart>
</panel>
</row>
<row>
<panel>
<title># of Decimal Rating Usage</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_RT
|dedup C_CTID
|rex max_match=0 field=C_RT "(?P<ratingEnabled>[^\[,\]]+)"
| mvexpand ratingEnabled
|rex max_match=0 field=C_RTD "(?P<decimal>[^\[,]+)Decimal"
|eval decimaled=if(in(ratingEnabled,decimal), 1,0 )
|stats count sum(decimaled) as decimaledCount by ratingEnabled
|eval ratio%=round(decimaledCount*100/count, 2) |sort - ratio%</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title># of Guideline Rating Usage</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_RT
|dedup C_CTID
|rex max_match=0 field=C_RT "(?P<ratingEnabled>[^\[,\]]+)"
|mvexpand ratingEnabled
|rex max_match=0 field=C_RTG "(?P<guideline>[^\[,]+)Guideline"
|eval guided=if(in(ratingEnabled,guideline), 1,0 )
|stats count sum(guided) as guidedCount by ratingEnabled
|eval ratio%=round(guidedCount*100/count, 2) | sort - ratio%</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title># of Advanced Option Usage</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_OA
|dedup C_CTID
|eval advancedOptions=replace(replace(C_OA,"\[",""),"\]","")
|makemv delim="," advancedOptions
|stats count by advancedOptions</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title># of enabled user fields on List View</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_FL
|dedup C_CTID
|eval userFields=replace(replace(C_FL,"\[",""),"\]","")
|makemv delim="," userFields
|stats count by userFields</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>Buckets Number of Bin View</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_BN
| dedup C_CTID
| rex field=C_BN max_match=0 "(?P<bin>\w+):(?P<buckets>\d+)"
| eval zip=mvzip(bin, buckets)
| mvexpand zip
| eval split=split(zip,",")
| eval bin=mvindex(split,0), buckets=mvindex(split,1)
| stats count by bin, buckets</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Scale Type of Matrix View</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_BM
| dedup C_CTID
| rex field=C_BM max_match=0 "(?P<matrix>\w+\*\w+):(?P<buckets>\d+\*\d+)"
| eval zip=mvzip(matrix, buckets)
| mvexpand zip
| eval split=split(zip,",")
| eval matrix=mvindex(split,0), buckets=mvindex(split,1)
| stats count by matrix, buckets</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
other
11-30-2020
12:44 AM
Hi team, I have a below sample raw events in splunk. 2020-11-30 19:15:26,726 ratingEnabled="[performance]" 2020-11-30 15:59:13,827 ratingEnabled="[objective,competency]" ratingEnabledGuideline="[objectiveGuideline]" 2020-11-30 05:34:40,986 ratingEnabled="[performance]" ratingEnabledGuideline="[performanceGuideline]" stats requirement: I want to get a ratio that enabled guideline per each rating. For example: analyze above sample events, 1. there are 3 ratings enabled(refer to ratingEnabled field): performance, objective and competency 2. there're 2 ratings enabled guideline(refer to ratingEnabledGuideline field): objective and performance So the expected result I want splunk to return is: ratingEnabled count count - enabled Guideline ratio - enabled guideline performance 2 1 50% objective 1 1 100% competency 1 0 0% How to stats the ratio in this scenario?
... View more
Labels
- Labels:
-
stats
10-27-2020
10:44 PM
@ITWhisperer You're right. I ever thought streamstats count as row by sessionID is to count the number of events in a session. Thanks, Cherie
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-08-2022
04:48 AM
|
