Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About smahoney
smahoney
Explorer
Member since:
06-11-2020
2 weeks ago
Community Statistics
| Posts | 12 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-11-2020 |
Activity Feed
- Posted Why is Dashboard Studio trendInterval in single pane not working? on Installation. 2 weeks ago
- Posted Re: Average of current time window over last week on Splunk Search. 2 weeks ago
- Posted Re: Average of current time window over last week on Splunk Search. 2 weeks ago
- Posted Re: Chart average event occurrence per hour of the day for the last 30 day on Splunk Search. 2 weeks ago
- Posted Average of current time window over last week? on Splunk Search. 2 weeks ago
- Posted Re: Query for count over time of a field value decreasing on Splunk Search. 07-29-2022 06:08 AM
- Posted How to create query for count over time of a field value decreasing? on Splunk Search. 07-28-2022 12:48 PM
- Posted Calculate cumulative time from first event in group for each event on Splunk Cloud Platform. 12-16-2020 11:32 AM
- Posted Re: What would cause a single json attribute to not be extracted while all others are? on Splunk Cloud Platform. 08-05-2020 08:16 AM
- Posted What would cause a single json attribute to not be extracted while all others are? on Splunk Cloud Platform. 08-05-2020 08:03 AM
- Posted bullet points in date value and can't strptime() on Splunk Search. 06-11-2020 09:13 AM
- Tagged bullet points in date value and can't strptime() on Splunk Search. 06-11-2020 09:13 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
I can set up a query with a simple trendinterval single pane value comparing the same time period for 24 hours prior. Add that panel to new clean DashBoard studio and it displays different data for the trend. Add the same exact query to a classic dash and all works as intended. Dash Studio "type": "splunk.singlevalue", "options": { "colorMode": "none", "drilldown": "none", "numberPrecision": 0, "sparklineDisplay": "off", "trendDisplay": "percent", "trellis.enabled": 0, "trellis.scales.shared": 1, "trellis.size": "medium", "trendInterval": "-24h", "unitPosition": "after", "shouldUseThousandSeparators": true, "majorColor": "> majorValue | rangeValue(majorColorEditorConfig)", "trendColor": "> trendValue | rangeValue(trendColorEditorConfig)", "majorFontSize": 100, "trendFontSize": 20 Classic "type": "splunk.singlevalue", "options": { "colorMode": "block", "drilldown": "none", "numberPrecision": 0, "sparklineDisplay": "off", "trendDisplay": "percent", "trellis.enabled": 0, "trellis.scales.shared": 1, "trellis.size": "medium", "trendInterval": "-24h", "unitPosition": "after", "shouldUseThousandSeparators": true, "majorFontSize": 100, "majorColor": "> majorValue | rangeValue(majorColorEditorConfig)", "trendColor": "> trendValue | rangeValue(trendColorEditorConfig)", "trendFontSize": 20
... View more
Labels
- Labels:
-
Windows
2 weeks ago
Lets say the average over that same time window over the last week is 150, it should show 100 in the panel with a down arrow of 40%
... View more
2 weeks ago
If I am running a search at 6pm, I want to snap to the 3, 4, and 5 pm window (so we arent getting partial counts within the hour 6). Lets say that count is 100. Now I want to compare that 100 to the average of the same time window over the last 7 days
... View more
2 weeks ago
Not sure if you are still monitoring these, but I wanted to use this solution and compare the current count against the output of this query in a dashboard panel and its driving me nuts. So if the current hourly count is 5 at 6pm, compare it to the output of the 6PM average from this solution.
... View more
2 weeks ago
Still working on this. I want to create a single pane dashboard panel with trend indicator. This value is going to display: The current count of events over the last 3 hours and the trendline will display the deviation from the average count over the same 3 hour timespan over the last week.
... View more
07-29-2022
06:08 AM
That just returns the current value as the window is 1 and current is false. I could never get streamstats to work so ended up using a join so set the monitor cap. Its not optimal, but can't figure out why streamstats cant compare 2 numeric values in a window of 2.
... View more
07-28-2022
12:48 PM
I have metrics that are basically _time host1 monitor_count=2 _time host1 monitor_count=1 This is over different hosts and dynamic monitor_count values. What I want to do is make a query that counts the amount of times the monitor_count depreciated over a given time range. So if host 1 throttles back and forth between 2 and 1, how many times did that happen? I'm trying many options of streamstats with window=2 earliest(monitor_count) as prev_count by host, but that doesn't seem to be working. When it drops from 2 to 1, a 1 is recorded for previous and current to that time range.
... View more
Labels
- Labels:
-
stats
12-16-2020
11:32 AM
Basically data looks like this. I want to calculate the average time to complete an order across many orders each with different amounts of items. _time,orderId,"receivedOrder" _time,itemId,orderId,"completedItemProcessing" _time,itemId,orderId,"completedItemProcessing" _time,itemId,orderId,"completedItemProcessing" I have a query that works, but its hugely inefficient and throws errors due to hitting the stats limit. There has to be a better way to do this, streamstats or delta just gave me the duration from the previous event in the chain and I need to have that evaluate against the order time for all items in an order, not the previous item. index=index "@mt"="itemComplete" OR @mt="orderReceived"
| fillnull value=orderReceived itemComplete
| stats earliest(_time) as orderReceived list(itemId) as itemId,list(_time) as prepTime by orderId
| mvexpand prepTime
| eval timeToPrep=prepTime-orderReceived
| stats avg(timeToPrep) as avgItemCompletedDuration
| where startOfPreperation>0
... View more
Labels
- Labels:
-
other
08-05-2020
08:16 AM
Ok, I figured this out, but its odd as hadn't seen the impact anywhere until recently. There was a field alias that renamed an extracted correlationId to Properties.CorrelationId and the checkbox somehow got marked to overwrite field value, which was not the case earlier. that field is now available.
... View more
08-05-2020
08:03 AM
Recently I noticed that an important field is not being auto extracted with the _json sourcetype while all other attributes are still being extracted as fields just fine. In the example below, the Properties.CorrelationId is not available and attempting to run stats on it produces no results. This has always worked, what would cause this? {
"Level":"Error",
"MessageTemplate":"SPC Fulfillment controller has reported an error with message: [{httpResponseMessage}], code: [{httpResponseCode}] and status code [{httpResponseStatusCode}]",
"RenderedMessage":"SPC Fulfillment controller has reported an error with message: [\"Server will not process, error in request. SKU not found [1105716399999].\"], code: [\"015-002-017\"] and status code [400]",
"Properties":{
"httpResponseMessage":"Server will not process, error in request. SKU not found [1105716399999].",
"httpResponseCode":"015-002-017",
"httpResponseStatusCode":400,
"EndpointVersion":"v2",
"SourceContext":"SPC.Services.Fulfillment.API.Controllers.OrdersController",
"ApplicationName":"fabric:/spc/fulfillment",
"ApplicationTypeName":"SPC.Services.Fulfillment",
"CodePackageVersion":"2.81.0.2020072462946-08d393d6",
"ServiceName":"fabric:/spc/fulfillment/API",
"ServiceTypeName":"SPC.Services.Fulfillment.APIType",
"InstanceId":132406486505333708,
"PartitionId":"898c1f6a-ab4e-4c96-81f4-da999f2eb0f1",
"ServiceManifestVersion":"2.81.0.2020072462946-08d393d6",
"NodeName":"_sbp01-1FE_3",
"CorrelationId":"abb55590-1527-f9c2-d919-8ea586f1083a",
"Environment":"p01-1"
}
}
... View more
Labels
- Labels:
-
troubleshooting
-
using Splunk Cloud
06-11-2020
09:13 AM
For some reason there are invisible bullet points being extracted from the windows event message and I cant seem to be able to remove them to use it as a time. The date gets extracted as the image below and prevents me from using it as a dateTime. How do you strip those out? The previous system shutdown at 10:48:10 AM on 6/11/2020 was unexpected. | rex field=Message "(?i)at\s(?P<shutdown_time>[^\s].+)\son\s(?P<shutdown_date>[^\s]+)" | eval shutdownAt=shutdown_date+" "+shutdown_time | eval shutdownepoch=strptime(shutdownAt,"%e/%d/%Y %I:%M:%S %p") This is unable to to assign shutdownepoch
... View more
- Tags:
- strpftime
Labels
- Labels:
-
field extraction
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
