About bowa

Ant1D · ‎05-18-2011

No problem, it's a useful question

bowa · ‎05-16-2011

doesn't work for me ... just using |extract works but all values are still with the single quotes around them .

stanwin · ‎08-31-2015

Will the EXTRACT strategy work for multi row output like top command which necessitates multikv? Specifically there is custom multikv parsing logic , but extracted fields need to be referenced in search query where the EXTRACT will help.. index=main sourcetype=JOBI [ search index=main sourcetype=JOBI | tail 1 | multikv conf=JOBI_mkv | eval JOB = Subs.".".User.".".Number | return JOB ] | head 1 | multikv conf=JOBI_mkv | eval JOB = Subs.".".User.".".Number eval JOB = Subs.".".User.".".Number concatenates 3 fields to create a primary key.

chris_lewis · ‎06-11-2013

me four..........

sideview · ‎04-01-2011

Sounds like you're getting there. Timechart doesnt know what kind of rows you're giving it. Just as long as you give it a _time field it'll happily chart the rows as though they were events. So this might get you a step closer. host=myserver JobWrapper | transaction keepevicted=true jobid | where job="provisioningJob" | stats max(_time) as _time max(duration) AS readytime by jobcallerref | timechart max(readytime) by jobcallerref although i suspect you may be hoping for something closer to a Gantt chart, which cant really be done.

ftk · ‎03-30-2011

That format looks good. Here are some other questions that have been asked before on this subject that are helpful: http://answers.splunk.com/questions/1951/what-is-the-best-custom-log-event-format-for-splunk-to-eat http://answers.splunk.com/questions/5357/what-is-the-best-timestamp-format-to-use-for-my-custom-log-to-be-indexed-by-splun

bowa · ‎03-22-2011

You rock Ayn 🙂

bowa · ‎03-12-2011

Thanks a lot ! exactly what i needed

jcai_splunk · ‎12-24-2016

Cool! exactly what I want!

Posts	21
Solutions	0
Karma Given	2
Karma Received	7
Member Since	‎03-09-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

only interested in the last line of the table for ...

extract with quoted values

where in subsearch

outcome of stats into timechart

Recommended kv extract syntax

SLA monitoring: percentage of slow transactions

timechart avg vs count

combine searches in one timechart

Re: only interested in the last line of the table ...

Re: extract with quoted values

Re: where in subsearch

Re: Splunk BlueCoat - HiddenSavedSearch

Re: outcome of stats into timechart

Re: Recommended kv extract syntax

Re: SLA monitoring: percentage of slow transaction...

Re: timechart avg vs count

Re: combine searches in one timechart

Join the Conversation