About smahoney

smahoney · ‎11-15-2024

I figured this out. I had 2 data sets in my model and when I was specifying the datamodel=XXX, I didnt pass a dataset after. So by default this will assume the first listed dataset and work. When I was trying to run the query associated with the other dataset it wouldnt. Simply adding the dataset name as an argument got it working.

smahoney · ‎11-12-2024

Not sure what I am doing wrong. I have a datamodel with a dataset that I can pivot on a field when using the datamodel explorer. When I try to use |tstats it does not work. I get results as expected with | tstats count as order_count from datamodel=spc_orders however if I try and pivot | tstats count as order_count from datamodel=spc_orders where state="CA" 0 results. Whats going on here?

smahoney · ‎03-19-2024

This seems like it should be simple, but all I ever get is a 2 column sankey visualization with the starting event then the end event ribbons where the ribbons represent the count of events. Is there any way to create a visualization where each orderId starts with a message like "order received", then that order can process through 5-10 other messages, but not all orders will do this. I want to visualize how many say stop at message 3, while also seeing the paths from message three through the process for those that don't end there.

smahoney · ‎02-01-2024

Given that per host there are 2 events logged, one indicating transition to active and one indicating transition to inactive. I cant figure out a query that can accurately do this per host given the following stipulations. Given the first event within the query time range, it can be assumed the host was in the opposite state prior. Only calculate transitions between the 2 states, if there are multiple same events within transitions, calculate of the time of the first occuring. Include the latest condition up until the time the search is run.

smahoney · ‎11-01-2023

Its the second one, but no streamstats solution provided will work that I have seen. lets say I have between 40 and 1000 events, any ratio can be good vs bad, with no correlation on how often each good vs bad occurs on a time basis and no set amount that occurs before a transition happens for each host. That is the problem I have not seen anyone be able to solve.

smahoney · ‎10-31-2023

Unfortunately that wont work as there can be an unlimited number of consecutive strings of events between the 2 logged events and it needs to calculate the durations of each, which I haven't seen any solutions in the community successfully solve.

smahoney · ‎10-31-2023

The problem I am having is adding up all the consecutive durations of each "period" good and bad, when they occur in random lengths repeatedly throughout the time searched.

smahoney · ‎10-31-2023

Haven't been able to find this, but I want to basically calculate up time percentage for a host based on 2 unique events. One gets logged when something is bad, the other gets logged when everything is fine. An example would be to have a host log 10 minutes of "ok" events, then 4 minutes of "bad" events, then 18 minutes of "on" events, etc. I need to out put the following based on the search range of the query. Host | total_ok_duration | total_bad_duration | percentage_ok_duration this need to be run and return for multiple hosts as well.

smahoney · ‎03-30-2023

Thanks, this will work!

smahoney · ‎03-30-2023

We have a transform to apply which sends events to nullQueue under certain conditions. We would like to initially whitelist only a couple hosts for deployment so we dont have to find out the hard way we missed something applying to 40K + hosts. What is the recommended way to do this? I saw the destkey for renaming hosts based on patterns but not a way to filter at the specific transform key level.

smahoney · ‎03-17-2023

I can set up a query with a simple trendinterval single pane value comparing the same time period for 24 hours prior. Add that panel to new clean DashBoard studio and it displays different data for the trend. Add the same exact query to a classic dash and all works as intended. Dash Studio "type": "splunk.singlevalue", "options": { "colorMode": "none", "drilldown": "none", "numberPrecision": 0, "sparklineDisplay": "off", "trendDisplay": "percent", "trellis.enabled": 0, "trellis.scales.shared": 1, "trellis.size": "medium", "trendInterval": "-24h", "unitPosition": "after", "shouldUseThousandSeparators": true, "majorColor": "> majorValue | rangeValue(majorColorEditorConfig)", "trendColor": "> trendValue | rangeValue(trendColorEditorConfig)", "majorFontSize": 100, "trendFontSize": 20 Classic "type": "splunk.singlevalue", "options": { "colorMode": "block", "drilldown": "none", "numberPrecision": 0, "sparklineDisplay": "off", "trendDisplay": "percent", "trellis.enabled": 0, "trellis.scales.shared": 1, "trellis.size": "medium", "trendInterval": "-24h", "unitPosition": "after", "shouldUseThousandSeparators": true, "majorFontSize": 100, "majorColor": "> majorValue | rangeValue(majorColorEditorConfig)", "trendColor": "> trendValue | rangeValue(trendColorEditorConfig)", "trendFontSize": 20

smahoney · ‎03-15-2023

Lets say the average over that same time window over the last week is 150, it should show 100 in the panel with a down arrow of 40%

smahoney · ‎03-15-2023

If I am running a search at 6pm, I want to snap to the 3, 4, and 5 pm window (so we arent getting partial counts within the hour 6). Lets say that count is 100. Now I want to compare that 100 to the average of the same time window over the last 7 days

smahoney · ‎03-15-2023

Not sure if you are still monitoring these, but I wanted to use this solution and compare the current count against the output of this query in a dashboard panel and its driving me nuts. So if the current hourly count is 5 at 6pm, compare it to the output of the 6PM average from this solution.

smahoney · ‎03-15-2023

Still working on this. I want to create a single pane dashboard panel with trend indicator. This value is going to display: The current count of events over the last 3 hours and the trendline will display the deviation from the average count over the same 3 hour timespan over the last week.

smahoney · ‎07-29-2022

That just returns the current value as the window is 1 and current is false. I could never get streamstats to work so ended up using a join so set the monitor cap. Its not optimal, but can't figure out why streamstats cant compare 2 numeric values in a window of 2.

smahoney · ‎07-28-2022

I have metrics that are basically _time host1 monitor_count=2 _time host1 monitor_count=1 This is over different hosts and dynamic monitor_count values. What I want to do is make a query that counts the amount of times the monitor_count depreciated over a given time range. So if host 1 throttles back and forth between 2 and 1, how many times did that happen? I'm trying many options of streamstats with window=2 earliest(monitor_count) as prev_count by host, but that doesn't seem to be working. When it drops from 2 to 1, a 1 is recorded for previous and current to that time range.

smahoney · ‎12-16-2020

Basically data looks like this. I want to calculate the average time to complete an order across many orders each with different amounts of items. _time,orderId,"receivedOrder" _time,itemId,orderId,"completedItemProcessing" _time,itemId,orderId,"completedItemProcessing" _time,itemId,orderId,"completedItemProcessing" I have a query that works, but its hugely inefficient and throws errors due to hitting the stats limit. There has to be a better way to do this, streamstats or delta just gave me the duration from the previous event in the chain and I need to have that evaluate against the order time for all items in an order, not the previous item. index=index "@mt"="itemComplete" OR @mt="orderReceived" | fillnull value=orderReceived itemComplete | stats earliest(_time) as orderReceived list(itemId) as itemId,list(_time) as prepTime by orderId | mvexpand prepTime | eval timeToPrep=prepTime-orderReceived | stats avg(timeToPrep) as avgItemCompletedDuration | where startOfPreperation>0

smahoney · ‎08-05-2020

Ok, I figured this out, but its odd as hadn't seen the impact anywhere until recently. There was a field alias that renamed an extracted correlationId to Properties.CorrelationId and the checkbox somehow got marked to overwrite field value, which was not the case earlier. that field is now available.

smahoney · ‎08-05-2020

Recently I noticed that an important field is not being auto extracted with the _json sourcetype while all other attributes are still being extracted as fields just fine. In the example below, the Properties.CorrelationId is not available and attempting to run stats on it produces no results. This has always worked, what would cause this? { "Level":"Error", "MessageTemplate":"SPC Fulfillment controller has reported an error with message: [{httpResponseMessage}], code: [{httpResponseCode}] and status code [{httpResponseStatusCode}]", "RenderedMessage":"SPC Fulfillment controller has reported an error with message: [\"Server will not process, error in request. SKU not found [1105716399999].\"], code: [\"015-002-017\"] and status code [400]", "Properties":{ "httpResponseMessage":"Server will not process, error in request. SKU not found [1105716399999].", "httpResponseCode":"015-002-017", "httpResponseStatusCode":400, "EndpointVersion":"v2", "SourceContext":"SPC.Services.Fulfillment.API.Controllers.OrdersController", "ApplicationName":"fabric:/spc/fulfillment", "ApplicationTypeName":"SPC.Services.Fulfillment", "CodePackageVersion":"2.81.0.2020072462946-08d393d6", "ServiceName":"fabric:/spc/fulfillment/API", "ServiceTypeName":"SPC.Services.Fulfillment.APIType", "InstanceId":132406486505333708, "PartitionId":"898c1f6a-ab4e-4c96-81f4-da999f2eb0f1", "ServiceManifestVersion":"2.81.0.2020072462946-08d393d6", "NodeName":"_sbp01-1FE_3", "CorrelationId":"abb55590-1527-f9c2-d919-8ea586f1083a", "Environment":"p01-1" } }

smahoney · ‎06-11-2020

For some reason there are invisible bullet points being extracted from the windows event message and I cant seem to be able to remove them to use it as a time. The date gets extracted as the image below and prevents me from using it as a dateTime. How do you strip those out? The previous system shutdown at 10:48:10 AM on ‎6/‎11/‎2020 was unexpected. | rex field=Message "(?i)at\s(?P<shutdown_time>[^\s].+)\son\s(?P<shutdown_date>[^\s]+)" | eval shutdownAt=shutdown_date+" "+shutdown_time | eval shutdownepoch=strptime(shutdownAt,"%e/%d/%Y %I:%M:%S %p") This is unable to to assign shutdownepoch

Posts	22
Solutions	2
Karma Given	1
Karma Received	0
Member Since	‎06-11-2020

Online Status	Offline
Date Last Visited	‎11-18-2024 03:06 PM

Unable to use conditions against datamodel

Sankey diagram for order paths based on message fi...

Unable to do simple calculation of aggregate durat...

Calculate duration sum of consecutive events with ...

What is the recommended way to whitelist hosts to ...

Why is Dashboard Studio trendInterval in single pa...

Average of current time window over last week?

How to create query for count over time of a field...

Calculate cumulative time from first event in grou...

What would cause a single json attribute to not be...

Re: Unable to use conditions against datamodel

Unable to use conditions against datamodel

Sankey diagram for order paths based on message fi...

Unable to do simple calculation of aggregate durat...

Re: Calculate duration sum of consecutive events w...

Re: Calculate duration sum of consecutive events w...

Re: Calculate duration sum of consecutive events w...

Calculate duration sum of consecutive events with ...

Re: What is the recommended way to whitelist hosts...

What is the recommended way to whitelist hosts to ...

Why is Dashboard Studio trendInterval in single pa...

Re: Average of current time window over last week

Re: Average of current time window over last week

Re: Chart average event occurrence per hour of the...

Average of current time window over last week?

Re: Query for count over time of a field value dec...

How to create query for count over time of a field...

Calculate cumulative time from first event in grou...

Re: What would cause a single json attribute to no...

What would cause a single json attribute to not be...

bullet points in date value and can't strptime()