About Freddler

Freddler · ‎05-28-2021

I am indeed getting something to plot with this, thank you! However, the values (x-y-pairs) seem to have been scrambled somewhere along the line. I inserted your code between my last delim command and the chart command. Was that how it was intended?

Freddler · ‎05-28-2021

I'm trying to visualize some numerical data with chart but I'm not getting any results. No errors or anything but no plots either. the target event looks something like: Log":[{"pressure":[0,45,976,1710,2412,3168,4207,..]},{"speed":[0,2432,3695,3611,3539,3435,3518,..]}, ... Where the equal length vectors are what I want to visualize, either as parallel lines or as a scatterplot against each other or whatever. Using the code below, I've managed to extract the numbers using regular expressions and split them at the comma. Inspecting the result in the statistics tab, the values appear neatly next to eachother in what I consider to look like x- and y-vectors: | rex "pressure\":\[(?P<pressure>[^]]{1,})" | makemv delim="," pressure | rex "speed\":\[(?P<speed>[^]]{1,})" | makemv delim="," speed | chart list(pressure), list(speed) (I tried using values instead of list first, but there were some identical numbers in one of the vectors which resluted in them being of different length) In my world, I should be able to just plot these against eachother since they are the same length, but I can't find a way of doing it. Changing the last line to this: "| chart list(OPVPresVec) by OPVPumpSpeedVec", the entire pressure vector is mapped to every element of the speed vector, which ofcourse is nonsense. I've tried using mvexpand after the delims but I get a similar result, with one entire vector being mapped to every element of the other. I am at a loss and have no idea what I'm doing. Does anybody know how to solve this? Thanks in advance.

Freddler · ‎09-28-2020

Thank you very much for your help! I feel like my understanding has deepened a bit.

Freddler · ‎09-28-2020

Aah, that helped alot! Just by removing the "stats count" at the end I can actually see what you are describing. Each resulting stat has a source and the System GHI, and anything from 0 to multiple programs, like this: srcA GHI srcB GHI progA srcC GHI progA progB progC That does indeed look like what I am after, assuming 'stats count by program' will return progA=2 progB=1 progC=1 Does this seem right to you? If so case closed, I guess!

Freddler · ‎09-28-2020

Both my searches return not-unreasonable values larger than 1, but the search using transaction does indeed give lower values for some of the programs, so that may be as you describe it. Your search finds many events but does not yield any stats. The way I understand my search is this: sourcetype=Log "Starting program:" OR "System:" .. yields two separate sets of events. One set where the events contain "Starting program" and another set where the events contain "System". | stats values(Program) as Program values(System) as System by source | where System="GHI" .. somehow, the union of the two sets are calculated. If these two lines change place with eachother, no stats are found. If "by source" is removed and nothing else changed, I do find a bunch of irrelevant programs all with the count of 1. My intuition is that "by source" connects the programs to the systems, and thus when we filter the systems using "where", the programs also get filtered along with them. I have no idea if this is actually the case though. | stats count by Program | sort count by Program desc .. the result here looks like: progA 33 progB 27 progC 21 which is the desired format but I don't know if the numbers are correct. If I change the line to "stats count by Program, source" the results will instead look like this: progA srcA 1 progA srcB 1 progA srcC 1 progB srcD 1

Freddler · ‎09-27-2020

Yes, except there is no need to declare sysA twice in srcA - the first one remains valid throughout the entire log. Other than that it looks accurate. Yes, a system can start the same prog multiple times in a run. I think both cases would be interesting: counting only unique runs or counting every run. source System Starting program srcA sysA progA progB progC progD progE srcB sysA progA progA progD srcC sysB progA progB progE Example results: Total count: progA: 3 progB: 1 progC: 1 progD: 2 progE: 1 Unique count: progA: 2 progB: 1 progC: 1 progD: 2 progE: 1 Thank you for your patience 🙂

Freddler · ‎09-25-2020

You're right, it doesn't sound like what I'm after. What I want is the count of all programs (progA .. progN) that ran on, for instance, sysA across all sources (srcA .. srcN). In any given source sys can be either A or B (or C or D..) but several cannot occur. The total count of the red progs in your table is what I'm after. How would I achieve that? Source System Program srcA sysA progA progB progC sysB cannot occur in same log as sysA progD progE srcB sysA progA progB progC

Freddler · ‎09-25-2020

Hi! This is my first post here so I apologise if the format is flawed. I am a Splunk novice and have been tinkering with different searches to try and achieve my goal. I have two searches which both yield something. The results are similar but not identical and I'd like to understand what the difference is. I'll begin describing the logfiles: Among loads of other data, there is information about different systems and different programs being run. It is structured somthing like this: Lorem ipsum .. System: ABC (occurs only once) Lorem ipsum .. Starting program: Name (can occur multiple times) Lorem ipsum .. The objective is to find and count all programs that have been run in the same session as a certain system is present. For example, if the system can be either ABC, DEF or GHI, I want all the program names from the logs where the system was GHI but NOT if it was DEF or ABC. There are field extractions for both the system name and the program name. My searches: sourcetype=Log "Starting program:" OR "System:" | stats values(Program) as Program values(System) as System by source | where System="GHI" | mvexpand Program | stats count by Program | sort count by Program desc | head 50 sourcetype=Log "Starting program" OR "System:" | transaction source startswith="System: GHI" endswith="Starting program:" | stats values(Program) as Program values(System) as System by source | mvexpand Program | stats count by Program | sort count by Program desc | head 50 As I've stated, these searches seem to yield same-ish results. What is actually happening under the hood here? Also, the number of occurrences of "Starting program" is vastly superior to the "System", so I imagine that the speed could be increased by first finding the logs where the system is "GHI" and then only in those logs perform the program search. Would that be possible? Thanks in advance!

Posts	8
Solutions	0
Karma Given	5
Karma Received	2
Member Since	‎09-24-2020

Online Status	Offline
Date Last Visited	‎05-28-2021 10:13 AM

Plot vectors against each other?

What are my searches finding?

Re: Plot vectors against each other?

Plot vectors against each other?

Re: What are my searches finding?

Re: What are my searches finding?

Re: What are my searches finding?

Re: What are my searches finding?

Re: What are my searches finding?

What are my searches finding?