Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cheriemilk
cheriemilk
Path Finder
Member since:
12-03-2019
2 weeks ago
Community Statistics
| Posts | 48 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 12-03-2019 |
Activity Feed
- Posted how to exclude several patterns by IN function? on Splunk Search. 2 weeks ago
- Posted how to get the user retention rate per month in last 1 year. on Splunk Search. 01-25-2021 10:11 PM
- Tagged how to get the user retention rate per month in last 1 year. on Splunk Search. 01-25-2021 10:11 PM
- Tagged how to get the user retention rate per month in last 1 year. on Splunk Search. 01-25-2021 10:11 PM
- Posted Re: How to create a summary index for this scenario on Splunk Enterprise. 12-14-2020 05:36 PM
- Posted How to create a summary index for this scenario on Splunk Enterprise. 12-14-2020 01:09 AM
- Posted Re: Dashboard is running extremely slow. on Splunk Search. 12-03-2020 06:54 PM
- Posted Re: Dashboard is running extremely slow. on Splunk Search. 12-02-2020 12:10 AM
- Posted Dashboard is running extremely slow. on Splunk Search. 12-01-2020 01:05 AM
- Karma Re: How to stats ratio based on two fields for ITWhisperer. 11-30-2020 06:26 PM
- Posted How to stats ratio based on two fields on Splunk Search. 11-30-2020 12:44 AM
- Posted Re: How to return first 2 events in a httpSession? on Splunk Search. 10-27-2020 10:44 PM
- Posted Re: How to return first 2 events in a httpSession? on Splunk Search. 10-27-2020 01:56 AM
- Posted How to return first 2 events in a httpSession? on Splunk Search. 10-27-2020 12:22 AM
- Posted Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart. on Splunk Search. 10-26-2020 11:05 PM
- Posted Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart. on Splunk Search. 10-25-2020 11:43 PM
- Posted Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart. on Splunk Search. 10-22-2020 06:23 AM
- Posted Re: [Need Help] how to reverse the time scale and corresponding count in x axis from timechart. on Splunk Search. 10-22-2020 01:50 AM
- Posted Re: "bin=2h time" doesn't split the bucket by every 2 hour. on Splunk Search. 10-22-2020 12:54 AM
- Posted "bin=2h time" doesn't split the bucket by every 2 hour. on Splunk Search. 10-22-2020 12:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
Hi team, I have below sample events in splunk. 2021-04-09 07:12:41 , 323 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.1CMID=shangThai CMN= " shanghai " 2021 -04-08 07:12:41 , 323 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.1CMID=shanghai CMN= " shanghai " 2021-04-08 07:11:57,929 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=shanghaiT1 CMN="shanghai" 2021 -04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=chengdu CMN="chengdu" 2021 -04-08 07:11:53,871 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=chengduT3 CMN="chengdu" 2021 -04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=city CMN="city" 2021 -04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=beijing CMN="beijing" 2021 -04-09 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=Tbeijing CMN="beijing" 2021 -04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=shenyang CMN="shengyang" 2021 -04-08 07:11:33,056 PLV=EVENT DT=MANUALEVENT CIP=0.0.0.2 CMID=shenyangD CMN="shengyang" In the base query, I want to filter out below events with CMID value match below patterns: 1) *T 2) *T#: # is a wildcard stands for a number. 3) *D 4) *D#: # is a wildcard stands for a number. and i am trying to filter them out by IN function, but failed. NOT CMID IN ("*T", "*T#", " *D", "*D#" ) Questions: how to achieve this by IN function? Thanks, Cherie
... View more
Labels
- Labels:
-
other
01-25-2021
10:11 PM
Hi team, I have a stats requirement to get he user retention rate that visit a module per month in last 1 year. Detail Requirement to stats: step1. find the distinct users that visit a module in 2020, January step2. go to 2020, February and find the number of users in step1 visit the module again step3. go to 2020, March and find the number of users in step2 visit the module again step4. go to 2020, April and find .... ..... 2020, December and find ... Log sample in splunk and how can I write the query to get the expected user retention rate? 2021-01-19 06:00:38 , 668 PLV=REQ CIP=0.0.0.0 CMID=test CMN= "testCompany" UID=testUser AGN= "[ Mozilla/5.0 ( Windows NT 10.0 ; Win64 ; x64 ) AppleWebKit/537.36 ( KHTML , like Gecko ) Chrome/84.0.4147.89 Safari/537.36 ]" module =SUCCESSION
... View more
- Tags:
- stats
- streamstats
12-14-2020
05:36 PM
@nickhills I don't quite understand for 2 questions. 1. in my dashboard, there're 6 panels added which means there're 6 queries will be run at the same time when the dashboard is opened , and the metrics for 6 queries are different, but each metric is aggregated by stats command. do you mean I should create 6 summary index for each stats query? 2. how the summary index is stored the data? when I use sistats to ingest the data to new index, how the new index and corresponding data is saved? as the command sistats is just one-time run. Thanks, Cherie
... View more
12-14-2020
01:09 AM
Hi team, I have below query to search out all raw data and out put to a table format: index=testIndex AND sourcetype=testType AND ACT!="-" AND "DT=MANUALEVENT" AND C_PG="DEVELOPMENT_GOAL_V2" OR C_PG="PERFORMANCE_GOAL_V2" | table _time, SFDC, CMN, CMID, CIP, SID, PUID, UID, MID, PID, C_PG,C_SPG, ACT There're 6 different metrics/panels in the dashboard to stats based on this query result, Question: How to create the summary index based on above query? I found that all the summary index command are below 5 si commands per this official document https://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usesummaryindexing , and I can't figure out which one to use to match my scenario. sichart sitimechart sistats, sitop, sirare
... View more
Labels
12-02-2020
12:10 AM
Hi @gcusello , Thanks for the suggestion. I tried and the performance does improve. But why the progress bar for query in each panel looks like always in "in progress" status after 1 or 2 hours, and never ended (please refer to the attached screenshot below.) The time range I select is 'Last 24h. Is there any other option I can use to speed up the dashboard running?
... View more
12-01-2020
01:05 AM
Hi team, I have created a dashboard with 8 panels, but it is running extremely extremely slow. how to improve the performance? Here is the XML source: <form>
<label>CAL Template Configuration</label>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="field1">
<label>Please select a time range</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="DC">
<label>Please select a data center</label>
<choice value="*">All</choice>
<choice value="DC02">DC02</choice>
<choice value="DC04">DC04</choice>
<choice value="DC08">DC08</choice>
<choice value="DC10">DC10</choice>
<choice value="DC12">DC12</choice>
<choice value="DC15">DC15</choice>
<choice value="DC16">DC16</choice>
<choice value="DC17">DC17</choice>
<choice value="DC18">DC18</choice>
<choice value="DC19">DC19</choice>
<choice value="DC22">DC22</choice>
<choice value="DC23">DC23</choice>
<choice value="DC41">DC41</choice>
<choice value="DC42">DC42</choice>
<choice value="DC44">DC44</choice>
<choice value="DC48">DC48</choice>
<default>*</default>
</input>
<input type="dropdown" token="ENV">
<label>Please select a environment</label>
<choice value="pc">Production</choice>
<choice value="sc">Preview</choice>
<default>pc</default>
</input>
</fieldset>
<row>
<panel>
<title># of Data Source Usage</title>
<chart>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_DS
|dedup C_CTID
|eval dataSource=replace(replace(C_DS,"\[",""),"\]","")
|makemv delim="," dataSource | where dataSource!=others
|stats count by dataSource</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true</option>
</chart>
</panel>
<panel>
<title># of Rating Type Usage</title>
<chart>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_RT
|dedup C_CTID
|eval ratingType=replace(replace(C_RT,"\[",""),"\]","")
|makemv delim="," ratingType
|stats count by ratingType</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="charting.chart.showLabels">true</option>
<option name="charting.chart.showPercent">true</option>
</chart>
</panel>
</row>
<row>
<panel>
<title># of Decimal Rating Usage</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_RT
|dedup C_CTID
|rex max_match=0 field=C_RT "(?P<ratingEnabled>[^\[,\]]+)"
| mvexpand ratingEnabled
|rex max_match=0 field=C_RTD "(?P<decimal>[^\[,]+)Decimal"
|eval decimaled=if(in(ratingEnabled,decimal), 1,0 )
|stats count sum(decimaled) as decimaledCount by ratingEnabled
|eval ratio%=round(decimaledCount*100/count, 2) |sort - ratio%</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title># of Guideline Rating Usage</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_RT
|dedup C_CTID
|rex max_match=0 field=C_RT "(?P<ratingEnabled>[^\[,\]]+)"
|mvexpand ratingEnabled
|rex max_match=0 field=C_RTG "(?P<guideline>[^\[,]+)Guideline"
|eval guided=if(in(ratingEnabled,guideline), 1,0 )
|stats count sum(guided) as guidedCount by ratingEnabled
|eval ratio%=round(guidedCount*100/count, 2) | sort - ratio%</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title># of Advanced Option Usage</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_OA
|dedup C_CTID
|eval advancedOptions=replace(replace(C_OA,"\[",""),"\]","")
|makemv delim="," advancedOptions
|stats count by advancedOptions</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title># of enabled user fields on List View</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_FL
|dedup C_CTID
|eval userFields=replace(replace(C_FL,"\[",""),"\]","")
|makemv delim="," userFields
|stats count by userFields</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>Buckets Number of Bin View</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_BN
| dedup C_CTID
| rex field=C_BN max_match=0 "(?P<bin>\w+):(?P<buckets>\d+)"
| eval zip=mvzip(bin, buckets)
| mvexpand zip
| eval split=split(zip,",")
| eval bin=mvindex(split,0), buckets=mvindex(split,1)
| stats count by bin, buckets</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<title>Scale Type of Matrix View</title>
<table>
<search>
<query>index=*bizx_application AND (servername=$ENV$* OR host=$ENV$*) AND SFDC=$DC$ AND sourcetype=perf_log_bizx AND ACT=SAVE_CALIBRATION_TEMPLATE AND C_BM
| dedup C_CTID
| rex field=C_BM max_match=0 "(?P<matrix>\w+\*\w+):(?P<buckets>\d+\*\d+)"
| eval zip=mvzip(matrix, buckets)
| mvexpand zip
| eval split=split(zip,",")
| eval matrix=mvindex(split,0), buckets=mvindex(split,1)
| stats count by matrix, buckets</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
other
11-30-2020
12:44 AM
Hi team, I have a below sample raw events in splunk. 2020-11-30 19:15:26,726 ratingEnabled="[performance]" 2020-11-30 15:59:13,827 ratingEnabled="[objective,competency]" ratingEnabledGuideline="[objectiveGuideline]" 2020-11-30 05:34:40,986 ratingEnabled="[performance]" ratingEnabledGuideline="[performanceGuideline]" stats requirement: I want to get a ratio that enabled guideline per each rating. For example: analyze above sample events, 1. there are 3 ratings enabled(refer to ratingEnabled field): performance, objective and competency 2. there're 2 ratings enabled guideline(refer to ratingEnabledGuideline field): objective and performance So the expected result I want splunk to return is: ratingEnabled count count - enabled Guideline ratio - enabled guideline performance 2 1 50% objective 1 1 100% competency 1 0 0% How to stats the ratio in this scenario?
... View more
Labels
- Labels:
-
stats
10-27-2020
10:44 PM
@ITWhisperer You're right. I ever thought streamstats count as row by sessionID is to count the number of events in a session. Thanks, Cherie
... View more
10-27-2020
01:56 AM
Hi @ITWhisperer I want it return first 2 events in every httpSession, instead of filtering out the sessions where there're less than 3 events. Thanks, Cherie
... View more
10-27-2020
12:22 AM
Hi team, I have below sample raw data in splunk: 2020-10-27 06:43:56.351 action=view_page httpSessionID = 11 2020-10-27 06:43:57.351 action=click_create_button httpSessionID = 11 2020-10-27 06:43:58.351 action=save httpSessionID = 11 2020-10-28 03:33:33.351 action=view_page httpSessionID = 22 2020-10-28 03:33:34.351 action=filter httpSessionID = 22 2020-10-28 03:33:35.351 action=update httpSessionID = 22 2020-10-29 01:11:11.351 action=view_page httpSessionID = 33 the number of event in a httpSessionID is dynamic. For example: it could be 1, 2, 3, 4....10...20 etc.. Now I want splunk to return me the first two events in a httpSessionID, how the query should be? Thanks, Cherie
... View more
10-26-2020
11:05 PM
@ITWhisperer Thanks.
... View more
10-25-2020
11:43 PM
@ITWhisperer I found this way works: <Base Query> | bin span=2h _time | stats count as number by _time SFDC | eval Time=strftime(_time,"%Y/%m/%d %H:%M") | chart values(number) by Time SFDC limit=0 useother=f | reverse
... View more
10-22-2020
06:23 AM
Hi @ITWhisperer there's no direct way to reverse the time order in timechart, right?
... View more
10-22-2020
01:50 AM
I tried with stats and chart . but the chart doesn't reverse as expected. baseQuery | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S") | bin span=2h _time | stats count by _time SFDC | chart values(count) by _time, SFDC | reverse
... View more
10-22-2020
12:54 AM
Hi @ITWhisperer ， It works by using _time, but I have another requirement that I want to display the time order in chart descendly, by reverse command , which means latest time and corresponding count are put in left, instead of right. So with below query, the reverse command doesn't reverse _time actually. That why I didn't use _time at first. Any idea? index=*bizx_application AND sourcetype=perf_log_bizx AND AutoSaveForm OR SaveFormV2 OR SaveForm | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S") | bin span=2h _time | stats count by _time SFDC | chart values(count) by _time SFDC | reverse
... View more
10-22-2020
12:04 AM
Hi team, with below query, I can't get expected result with the bins splitted by every 2 hour which I specified by "| bin span=2h TIME" index=*bizx_application AND sourcetype=perf_log_bizx AND AutoSaveForm OR SaveFormV2 OR SaveForm | eval TIME=strftime(_time,"%Y-%m-%d %H:%M:%S") | bin span=2h TIME | stats count by TIME SFDC The result I got from above query is below table. As you see, the TIME column, it's not splitted by 2 hour. What's wrong here?
... View more
10-21-2020
07:26 PM
Hi team, I have below query index=*bizx_application AND sourcetype=perf_log_bizx AND AutoSaveForm OR SaveFormV2 OR SaveForm | timechart count by SFDC useother=false limit=0 the timechart returned as below. Now I want to adjust the _time scale in x axis to display from latest to earliest which means put the latest _time and corresponding count in the left. How should I modify my query to achieve this adjustment?
... View more
Labels
- Labels:
-
timechart
10-14-2020
12:55 AM
Hi @ITWhisperer Here are the queries for two screenshots. 1. query with span=1d and result screenshot. Time Range for these 2 queries are both ' 2 days before' that I selected from from time range picker. (host=pc* OR servername=pc*) AND (( index=*bizx_web sourcetype=access_log_bizx AND "POST /acme?acme_form_type=pm360&itrModule=talent&_s.crb=*" ) OR ( index=*bix_application sourcetype=server_log_bizx AND SaveFormImpl "Total Time for createDetailedRecords" )) | rex field=_raw "POST\s+(?<RequestURL>.*)HTTP.*company\=(?<CMID>.*?)\&" | eval autosave=if(RequestURL like "%autosave=true%", "1", "0") | bin span=1d _time | stats count(eval(autosave=1)) as autosave count(eval(autosave=0 OR autosave=1)) as total by _time SFDC | eval percent=round(autosave * 100 / total,2) | chart values(total) as total values(autosave) as autosave values(percent) as percent by _time SFDC useother=false limit=0 As you see , the stats count result is not splitted by a day. Looks like it was splitted by hours. 2. query with span=24h and result screenshot is (host=pc* OR servername=pc*) AND (( index=*bizx_web sourcetype=access_log_bizx AND "POST /acme?acme_form_type=pm360&itrModule=talent&_s.crb=*" ) OR ( index=*bix_application sourcetype=server_log_bizx AND SaveFormImpl "Total Time for createDetailedRecords" )) | rex field=_raw "POST\s+(?<RequestURL>.*)HTTP.*company\=(?<CMID>.*?)\&" | eval autosave=if(RequestURL like "%autosave=true%", "1", "0") | bin span=24h _time | stats count(eval(autosave=1)) as autosave count(eval(autosave=0 OR autosave=1)) as total by _time SFDC | eval percent=round(autosave * 100 / total,2) | chart values(total) as total values(autosave) as autosave values(percent) as percent by _time SFDC useother=false limit=0
... View more
10-12-2020
06:38 PM
Hi @ITWhisperer and @soutamo , I change span=1d to span=24h, and not the table split the data by day. please refer to below screenshot. I think span=1d and span=24h are same. why they ouput different result? 1. with span=24h (this is what i want to get.) 2. with span=1d (this is what I don't want to get as same day appears multiple times.)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
