Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About amitmenon123
amitmenon123
New Member
Member since:
02-26-2017
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-26-2017 |
Activity Feed
- Posted Re: Why does using the by and over clauses not work simultaneously with the chart command? on Splunk Search. 03-30-2017 04:25 AM
- Posted Re: Why does using the by and over clauses not work simultaneously with the chart command? on Splunk Search. 03-21-2017 09:50 PM
- Posted Re: Why does using the by and over clauses not work simultaneously with the chart command? on Splunk Search. 03-21-2017 09:47 PM
- Posted Why does using the by and over clauses not work simultaneously with the chart command? on Splunk Search. 03-20-2017 11:59 PM
- Tagged Why does using the by and over clauses not work simultaneously with the chart command? on Splunk Search. 03-20-2017 11:59 PM
- Tagged Why does using the by and over clauses not work simultaneously with the chart command? on Splunk Search. 03-20-2017 11:59 PM
- Tagged Why does using the by and over clauses not work simultaneously with the chart command? on Splunk Search. 03-20-2017 11:59 PM
- Tagged Why does using the by and over clauses not work simultaneously with the chart command? on Splunk Search. 03-20-2017 11:59 PM
- Posted Re: Why does the same search produce different results? on Splunk Search. 02-27-2017 10:40 PM
- Posted Why does the same search produce different results? on Splunk Search. 02-26-2017 10:30 PM
- Tagged Why does the same search produce different results? on Splunk Search. 02-26-2017 10:30 PM
- Tagged Why does the same search produce different results? on Splunk Search. 02-26-2017 10:30 PM
- Tagged Why does the same search produce different results? on Splunk Search. 02-26-2017 10:30 PM
Topics I've Started
03-30-2017
04:25 AM
source = "Copy of ETT-newc3.csv" host = "M2B-D-80NCVQ1" sourcetype = csv Resource = "" "Contract Category" = "" | stats list( January_) as January_,list(February_) as February_ by Resource Team "Contract Category"
gives the right classification. just that instead of list when i sum it. it doesn work can anyone help/
... View more
03-21-2017
09:50 PM
i think the answer is in subearches but i want to figure out a way to pass values in subsearches like
for each resource and for each team of resource add up the weekly hours first then sum it by months
... View more
03-21-2017
09:47 PM
This didnt work though,. the clarity on charting is appreciated. But i think it is basically related to the way we are proceeding. Since my table has multiple entries with same name team and contract category, the problem is in directly summing it by resource or contract category and trying anotherr level of grouping. For eg.
source="Mysource.csv" host="M2B-D-80NCVQ1" sourcetype="csv" Resource="*" NOT Resource="Grand Total"|chart list(Team),list("Contract Category") as "Contract Category", list(*Jan*) as *Jan* ,list(*Feb*) as *Feb* by Resource
Gives me the exact table entries as it is in the sheet for the resource. Now i can proceed to sum it by Contract Category and then by team. The problem i am still facing is it doesnt iterate for every resource like
source="Copy of ETT-newc2.csv" host="M2B-D-80NCVQ1" sourcetype="csv" Resource="*" NOT Resource="Grand Total"|chart list(Team),list("Contract Category") as "Contract Category", list(*January*) as *January* ,list(*February*) as *February* by Resource| chart sum(*January*) as *January* ,sum(*February*) as *February* by "Contract Category",Resource
doesnt work and
source="Copy of ETT-newc2.csv" host="M2B-D-80NCVQ1" sourcetype="csv" Resource="*" NOT Resource="Grand Total"|chart list(Team),list("Contract Category") as "Contract Category", list(*January*) as *January* ,list(*February*) as *February* by Resource| chart sum(*January*) as *January* ,sum(*February*) as *February* by "Contract Category"
again gives total hours not by resource
... View more
03-20-2017
11:59 PM
Hello guys,
i have a csv file with rows
Resource Contract Category Sub Activity Team Activity Description 5-January-2017 12-January-2017 19-January-2017 26-January-2017
where the fields with January are basically week wise expansion of hours of a resource. I wanted the sum of hours in the whole month of January based on each contract category for every resource. Also there are multiple entries for same value of resource and contract category like
Resource Contract Category Team 5-January-2017 12-January-2017
A MT Ab 0 1
A MT Ab 1 0
So
source = "Mysource.csv" host = "M2B-D-80NCVQ1" sourcetype = csv Resource="*" "Contract Category"="*" | chart sum(*Jan*) as *Jan* ,sum(*Feb*) as *Feb* over "Contract Category"| addtotals *Jan* fieldname="January" | addtotals *Feb* fieldname="February"| table "Contract Category",January, February | addtotals
gives the total hours by perfectly
but
source = "Mysource.csv" host = "M2B-D-80NCVQ1" sourcetype = csv Resource="*" "Contract Category"="*" | chart sum(*Jan*) as *Jan* ,sum(*Feb*) as *Feb* over "Contract Category" by Resource | addtotals *Jan* fieldname="January" | addtotals *Feb* fieldname="February"| table "Contract Category",January, February | addtotals
doesn't give a statistics or visualization. Theres no error for the search either
How can i get
Contract Category January February Total hours for every resource in the sheet?
... View more
02-27-2017
10:40 PM
this was indeed the case. The field internal tea was extracted from a lookup file and that file had duplicate values reesulting in multivalued fields for some events. Hope this helps someone else. 🙂
... View more
02-26-2017
10:30 PM
I am automating a report.
So for that i use 4 dump CSV files whose names i don't change. When i used to change the dump i used to 'delete' the earlier source and upload the new one with the same name in the search app. I had another app installed which uses this search and the process worked fine until recently when i uploaded new data.
To elaborate.
for the below query
source="Dump Tier 2 Runfactory.csv" host="M2B-D-80NCVQ1" sourcetype="csv" Internal_Team = "*" |eval / = "Tier 2 Tickets By RunFactory" |append [search source="Dump Tier 2.csv" host="M2B-D-80NCVQ1" sourcetype="csv" Internal_Team = "*" | eval / = "Tier 2 Tickets"] | append [ search source="Dump Tier 1.5 Runfactory.csv" host="M2B-D-80NCVQ1" sourcetype="csv" Internal_Team = "*" |eval / = "Tier 1.5 Tickets by RunFactory" ] | append [ search source="Dump Tier 1.5.csv" host="M2B-D-80NCVQ1" sourcetype="csv" Internal_Team = "*" | eval / = "Tier 1.5 Tickets" ] | chart count by /, Internal_Team | addtotals
i get count of tier 2 as 3800 odd events
and when i do
source="Dump Tier 2.csv" host="M2B-D-80NCVQ1" sourcetype="csv" Internal_Team = "*"
it gives me count as 3335 which is the correct one
this happens within my installed app and in the searching app too.
whats wrong?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
