I have a savedsearch thats on a dashboard that is run every hour. It gives a table with or each hour of that day a row with some stats (like the % of slow transactions). Now i would like to add an alert to this saved search, to be notified if the % of slow transactions is above a certain percentage. A conditional alert with condition search slowpct>10 does the trick ... but once we have had an hour with a lot of slow transactions it will always gets triggers. So i am looking for a way to do this search only on the last row of my table with results so i only get an alert when that line has a slowpct>10 . ... View more

sourcetype="log4j" source="*server*" | rex field=_raw "nonce created : (?<nonce>[0-9a-z-]*)" | transaction thread startswith="startTx" endswith="closeTx" This first search gives transactions that have a field 'nonce' ... now i want to filter out only the transactions with a specific nonce ... i can find the nonces i am interested in with this query: sourcetype="log4j" failed nonce | rex field=_raw "Failed with nonce (?<nonce>[0-9a-z-]*)" | fields + nonce So i would like to do some sort of | where nonce in [search {search2}] What is the correct syntax to do such a thing. Do mind that this loglines that are in search2 are not part of the transaction in the first search, so i cant just filter the transactions more based on their own contence. ... View more

host=myserver JobWrapper | transaction keepevicted=true jobid | where job="provisioningJob" | stats max(duration) AS readytime by jobcallerref our logfiles has different provisioningJobs for each user (identified by the jobcallerref), the 'readytime', the time before the user is fully provisioned is determined by the longest running job. with the above query i get a list of the longest durations for each user. now i would like to chart it over time ... i am no longer interested in tje jobcallerref, so i want to graph those 'readytime's over the time they occured. can't figure out how to feed these results back into a timechart ... ... View more

What would be the recommended syntax for writing kv pairs in our logs to easily get extracted by splunk. (performance wise and robustness) key1="String value", key2="Another, string, value", key3=123 I want it to support string value (so they can contain the delimiter character), quoted or not, but i want it to be able to contain the delimiter sequence. And i want to support numbers. I am still free to choose the format so please give me recommendations. ... View more

I have selected and filtered a bunch of transactions that are part of KPI in our SLA. We define "slow" transactions as transactions with a duration over 3 seconds. Now that i have all transactions (and thus their durations) that have to be taken into account, how can i calculate how many % of those is considered "slow" ? Thanks in advance ... View more

I would use the example on this page as the base for my question: eventtype="CONTENT_EVENTS" | transaction accountNumber subscriberID maxspan=1m maxpause=30s | timechart span=1m avg(duration) Averages are great ... but if there is a spike i would like to know the size of the sample the average was taken over. So i would like to add to this timechart also the count of the number of transactions in that timeframe. Anyone know if this is possible ? ... View more

I would like to combine the following two searches in one timechart: host="appserv" OAuth participants POST | regex _raw="/organizations/[a-z0-9-]*/participants/?$" | timechart count and host="appserv" deadlock | timechart count sounds pretty simple question but i cant find how to do it. ... View more