Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About smahoney
smahoney
Path Finder
Member since:
06-11-2020
06-10-2025
Community Statistics
| Posts | 24 |
| Solutions | 2 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 06-11-2020 |
Activity Feed
- Karma Re: How can I escape double quotes in a token to modify a search? for weidertc. 06-10-2025 10:03 AM
- Posted Re: Anyway to auto refresh Dashboard Studio Panels? on Dashboards & Visualizations. 05-12-2025 03:44 PM
- Posted Anyway to auto refresh Dashboard Studio Panels? on Dashboards & Visualizations. 05-12-2025 10:53 AM
- Posted Re: Unable to use conditions against datamodel on Splunk Search. 11-15-2024 09:25 AM
- Karma Re: tstats timechart for DEAD_BEEF. 11-12-2024 09:32 AM
- Posted Unable to use conditions against datamodel on Splunk Search. 11-12-2024 08:58 AM
- Posted Sankey diagram for order paths based on message field per orderId? on Splunk Search. 03-19-2024 09:11 AM
- Posted Unable to do simple calculation of aggregate durations between 2 states by host on Splunk Search. 02-01-2024 09:11 AM
- Posted Re: Calculate duration sum of consecutive events with other events in between. on Splunk Search. 11-01-2023 06:51 AM
- Posted Re: Calculate duration sum of consecutive events with other events in between. on Splunk Search. 10-31-2023 02:37 PM
- Posted Re: Calculate duration sum of consecutive events with other events in between. on Splunk Search. 10-31-2023 12:34 PM
- Posted Calculate duration sum of consecutive events with other events in between. on Splunk Search. 10-31-2023 10:23 AM
- Posted Re: What is the recommended way to whitelist hosts to apply specific transforms? on Getting Data In. 03-30-2023 09:19 AM
- Posted What is the recommended way to whitelist hosts to apply specific transforms? on Getting Data In. 03-30-2023 08:36 AM
- Posted Why is Dashboard Studio trendInterval in single pane not working? on Installation. 03-17-2023 08:19 AM
- Posted Re: Average of current time window over last week on Splunk Search. 03-15-2023 04:32 PM
- Posted Re: Average of current time window over last week on Splunk Search. 03-15-2023 04:29 PM
- Posted Re: Chart average event occurrence per hour of the day for the last 30 day on Splunk Search. 03-15-2023 04:25 PM
- Posted Average of current time window over last week? on Splunk Search. 03-15-2023 03:46 PM
- Posted Re: Query for count over time of a field value decreasing on Splunk Search. 07-29-2022 06:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-12-2025
03:44 PM
That works, but I can't set refresh per panel from what I see in the documentation.
... View more
05-12-2025
10:53 AM
It doesnt appear this is a feature. Tried all the existing solutions but they are all old and none of them work with 2025 Dashboard Studio.
... View more
Labels
- Labels:
-
Dashboard Studio
11-15-2024
09:25 AM
I figured this out. I had 2 data sets in my model and when I was specifying the datamodel=XXX, I didnt pass a dataset after. So by default this will assume the first listed dataset and work. When I was trying to run the query associated with the other dataset it wouldnt. Simply adding the dataset name as an argument got it working.
... View more
11-12-2024
08:58 AM
Not sure what I am doing wrong. I have a datamodel with a dataset that I can pivot on a field when using the datamodel explorer. When I try to use |tstats it does not work. I get results as expected with
| tstats count as order_count from datamodel=spc_orders
however if I try and pivot
| tstats count as order_count from datamodel=spc_orders where state="CA"
0 results. Whats going on here?
... View more
Labels
- Labels:
-
tstats
03-19-2024
09:11 AM
This seems like it should be simple, but all I ever get is a 2 column sankey visualization with the starting event then the end event ribbons where the ribbons represent the count of events. Is there any way to create a visualization where each orderId starts with a message like "order received", then that order can process through 5-10 other messages, but not all orders will do this. I want to visualize how many say stop at message 3, while also seeing the paths from message three through the process for those that don't end there.
... View more
Labels
- Labels:
-
stats
02-01-2024
09:11 AM
Given that per host there are 2 events logged, one indicating transition to active and one indicating transition to inactive. I cant figure out a query that can accurately do this per host given the following stipulations. Given the first event within the query time range, it can be assumed the host was in the opposite state prior. Only calculate transitions between the 2 states, if there are multiple same events within transitions, calculate of the time of the first occuring. Include the latest condition up until the time the search is run.
... View more
Labels
- Labels:
-
count
-
eval
-
stats
-
transaction
11-01-2023
06:51 AM
Its the second one, but no streamstats solution provided will work that I have seen. lets say I have between 40 and 1000 events, any ratio can be good vs bad, with no correlation on how often each good vs bad occurs on a time basis and no set amount that occurs before a transition happens for each host. That is the problem I have not seen anyone be able to solve.
... View more
10-31-2023
02:37 PM
Unfortunately that wont work as there can be an unlimited number of consecutive strings of events between the 2 logged events and it needs to calculate the durations of each, which I haven't seen any solutions in the community successfully solve.
... View more
10-31-2023
12:34 PM
The problem I am having is adding up all the consecutive durations of each "period" good and bad, when they occur in random lengths repeatedly throughout the time searched.
... View more
10-31-2023
10:23 AM
Haven't been able to find this, but I want to basically calculate up time percentage for a host based on 2 unique events. One gets logged when something is bad, the other gets logged when everything is fine. An example would be to have a host log 10 minutes of "ok" events, then 4 minutes of "bad" events, then 18 minutes of "on" events, etc. I need to out put the following based on the search range of the query. Host | total_ok_duration | total_bad_duration | percentage_ok_duration this need to be run and return for multiple hosts as well.
... View more
Labels
- Labels:
-
stats
-
transaction
03-30-2023
09:19 AM
Thanks, this will work!
... View more
03-30-2023
08:36 AM
We have a transform to apply which sends events to nullQueue under certain conditions. We would like to initially whitelist only a couple hosts for deployment so we dont have to find out the hard way we missed something applying to 40K + hosts. What is the recommended way to do this? I saw the destkey for renaming hosts based on patterns but not a way to filter at the specific transform key level.
... View more
Labels
- Labels:
-
heavy forwarder
03-17-2023
08:19 AM
I can set up a query with a simple trendinterval single pane value comparing the same time period for 24 hours prior. Add that panel to new clean DashBoard studio and it displays different data for the trend. Add the same exact query to a classic dash and all works as intended. Dash Studio "type": "splunk.singlevalue", "options": { "colorMode": "none", "drilldown": "none", "numberPrecision": 0, "sparklineDisplay": "off", "trendDisplay": "percent", "trellis.enabled": 0, "trellis.scales.shared": 1, "trellis.size": "medium", "trendInterval": "-24h", "unitPosition": "after", "shouldUseThousandSeparators": true, "majorColor": "> majorValue | rangeValue(majorColorEditorConfig)", "trendColor": "> trendValue | rangeValue(trendColorEditorConfig)", "majorFontSize": 100, "trendFontSize": 20 Classic "type": "splunk.singlevalue", "options": { "colorMode": "block", "drilldown": "none", "numberPrecision": 0, "sparklineDisplay": "off", "trendDisplay": "percent", "trellis.enabled": 0, "trellis.scales.shared": 1, "trellis.size": "medium", "trendInterval": "-24h", "unitPosition": "after", "shouldUseThousandSeparators": true, "majorFontSize": 100, "majorColor": "> majorValue | rangeValue(majorColorEditorConfig)", "trendColor": "> trendValue | rangeValue(trendColorEditorConfig)", "trendFontSize": 20
... View more
Labels
- Labels:
-
Windows
03-15-2023
04:32 PM
Lets say the average over that same time window over the last week is 150, it should show 100 in the panel with a down arrow of 40%
... View more
03-15-2023
04:29 PM
If I am running a search at 6pm, I want to snap to the 3, 4, and 5 pm window (so we arent getting partial counts within the hour 6). Lets say that count is 100. Now I want to compare that 100 to the average of the same time window over the last 7 days
... View more
03-15-2023
04:25 PM
Not sure if you are still monitoring these, but I wanted to use this solution and compare the current count against the output of this query in a dashboard panel and its driving me nuts. So if the current hourly count is 5 at 6pm, compare it to the output of the 6PM average from this solution.
... View more
03-15-2023
03:46 PM
Still working on this. I want to create a single pane dashboard panel with trend indicator. This value is going to display: The current count of events over the last 3 hours and the trendline will display the deviation from the average count over the same 3 hour timespan over the last week.
... View more
07-29-2022
06:08 AM
That just returns the current value as the window is 1 and current is false. I could never get streamstats to work so ended up using a join so set the monitor cap. Its not optimal, but can't figure out why streamstats cant compare 2 numeric values in a window of 2.
... View more
07-28-2022
12:48 PM
I have metrics that are basically _time host1 monitor_count=2 _time host1 monitor_count=1 This is over different hosts and dynamic monitor_count values. What I want to do is make a query that counts the amount of times the monitor_count depreciated over a given time range. So if host 1 throttles back and forth between 2 and 1, how many times did that happen? I'm trying many options of streamstats with window=2 earliest(monitor_count) as prev_count by host, but that doesn't seem to be working. When it drops from 2 to 1, a 1 is recorded for previous and current to that time range.
... View more
Labels
- Labels:
-
stats
12-16-2020
11:32 AM
Basically data looks like this. I want to calculate the average time to complete an order across many orders each with different amounts of items. _time,orderId,"receivedOrder" _time,itemId,orderId,"completedItemProcessing" _time,itemId,orderId,"completedItemProcessing" _time,itemId,orderId,"completedItemProcessing" I have a query that works, but its hugely inefficient and throws errors due to hitting the stats limit. There has to be a better way to do this, streamstats or delta just gave me the duration from the previous event in the chain and I need to have that evaluate against the order time for all items in an order, not the previous item. index=index "@mt"="itemComplete" OR @mt="orderReceived"
| fillnull value=orderReceived itemComplete
| stats earliest(_time) as orderReceived list(itemId) as itemId,list(_time) as prepTime by orderId
| mvexpand prepTime
| eval timeToPrep=prepTime-orderReceived
| stats avg(timeToPrep) as avgItemCompletedDuration
| where startOfPreperation>0
... View more
08-05-2020
08:16 AM
Ok, I figured this out, but its odd as hadn't seen the impact anywhere until recently. There was a field alias that renamed an extracted correlationId to Properties.CorrelationId and the checkbox somehow got marked to overwrite field value, which was not the case earlier. that field is now available.
... View more
08-05-2020
08:03 AM
Recently I noticed that an important field is not being auto extracted with the _json sourcetype while all other attributes are still being extracted as fields just fine. In the example below, the Properties.CorrelationId is not available and attempting to run stats on it produces no results. This has always worked, what would cause this? {
"Level":"Error",
"MessageTemplate":"SPC Fulfillment controller has reported an error with message: [{httpResponseMessage}], code: [{httpResponseCode}] and status code [{httpResponseStatusCode}]",
"RenderedMessage":"SPC Fulfillment controller has reported an error with message: [\"Server will not process, error in request. SKU not found [1105716399999].\"], code: [\"015-002-017\"] and status code [400]",
"Properties":{
"httpResponseMessage":"Server will not process, error in request. SKU not found [1105716399999].",
"httpResponseCode":"015-002-017",
"httpResponseStatusCode":400,
"EndpointVersion":"v2",
"SourceContext":"SPC.Services.Fulfillment.API.Controllers.OrdersController",
"ApplicationName":"fabric:/spc/fulfillment",
"ApplicationTypeName":"SPC.Services.Fulfillment",
"CodePackageVersion":"2.81.0.2020072462946-08d393d6",
"ServiceName":"fabric:/spc/fulfillment/API",
"ServiceTypeName":"SPC.Services.Fulfillment.APIType",
"InstanceId":132406486505333708,
"PartitionId":"898c1f6a-ab4e-4c96-81f4-da999f2eb0f1",
"ServiceManifestVersion":"2.81.0.2020072462946-08d393d6",
"NodeName":"_sbp01-1FE_3",
"CorrelationId":"abb55590-1527-f9c2-d919-8ea586f1083a",
"Environment":"p01-1"
}
}
... View more
Labels
- Labels:
-
troubleshooting
-
using Splunk Cloud
06-11-2020
09:13 AM
For some reason there are invisible bullet points being extracted from the windows event message and I cant seem to be able to remove them to use it as a time. The date gets extracted as the image below and prevents me from using it as a dateTime. How do you strip those out? The previous system shutdown at 10:48:10 AM on 6/11/2020 was unexpected. | rex field=Message "(?i)at\s(?P<shutdown_time>[^\s].+)\son\s(?P<shutdown_date>[^\s]+)" | eval shutdownAt=shutdown_date+" "+shutdown_time | eval shutdownepoch=strptime(shutdownAt,"%e/%d/%Y %I:%M:%S %p") This is unable to to assign shutdownepoch
... View more
- Tags:
- strpftime
Labels
- Labels:
-
field extraction
