About SG

SG · ‎03-22-2022

HI, I applied the same and it is working fine. Thanks!!!

gcusello · ‎03-22-2022

Hi @SG, put table and collect commands at the end of your search index=*** | eval endpoint=coalesce(Address_operation) | eval endpoint_status = endpoint."-".status | search NOT endpoint_status IN ("GetPointsDetails-404") | convert num(status) | sistats count as Total_service_calls, count(eval(status >= 400)) as service_errors by service | table Total_service_calls service_errors service | collect index=your_summary_index Ciao. Giuseppe

PickleRick · ‎11-30-2021

@ITWhisperer Ahhh. You're right. I keep forgetting that and facepalm myself every so often 😄 Indeed, that's one of the cases where binning with time actually makes sense.

SG · ‎08-24-2021

Hi KV, This worked perfectly fine. Thanks for the help 🙂

gcusello · ‎08-15-2021

Hi @SG, good for you, see next time. Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated by all the Contributors 😉

SG · ‎07-29-2021

I updated the Triggered value from "For each result" to once. Now I am getting all the search results in one alert email. Thanks,

SG · ‎07-07-2021

HI, I have 3 searches that give results for errors and journey length. I wanted to add all these searches together and send an alert when it breaches the threshold values. Can you please help me with how to combine these three searches so that we get them in a single alert? Search queries I wanted to combine - Journey completion time index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest | timechart span=1h avg(duration) AS "Journey completion time" Errors index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest errorORstatuscode=500 OR errorORstatuscode=4* NOT url="*sentry*" | timechart span=1h count(step) by step Error status codes index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest errorORstatuscode=500 OR errorORstatuscode=4* NOT url="*sentry*" | table _time, step, url, errorORstatuscode Thanks, Swetha. G

SG · ‎07-07-2021

HI, I have 3 searches that give results for errors and journey length. I wanted to add all these searches together and send an alert when it breaches the threshold values. Can you please help me with how to combine these three searches so that we get them in a single alert. Search queries I wanted to combine - Journey completion time index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest | timechart span=1h avg(duration) AS "Journey completion time" Errors index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest errorORstatuscode=500 OR errorORstatuscode=4* NOT url="*sentry*" | timechart span=1h count(step) by step Error status codes index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest errorORstatuscode=500 OR errorORstatuscode=4* NOT url="*sentry*" | table _time, step, url, errorORstatuscode Thanks, Swetha. G

ITWhisperer · ‎06-24-2021

Assuming you are using a timepicker for selecting your time period, you can evaluate additional tokens in the change handler for the timepicker and use these tokens to set the earliest and latest times for your extra search <input type="time" token="timepicker" searchWhenChanged="true"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> <change> <eval token="daybefore20">relative_time(relative_time(now(),$timepicker.earliest$),"-1d@d+20h")</eval> <eval token="daybefore21">relative_time(relative_time(now(),$timepicker.latest$),"-1d@d+21h")</eval> </change> </input>

SG · ‎05-28-2021

Thanks to @aasabatini for the response, this is what i was looking for

isoutamo · ‎05-26-2021

Hi You could try the next: index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" url="*.bundle" | chart avg(objectSize) as average latest(objectSize) as latest by url r. Ismo

SG · ‎05-26-2021

Thanks for this idea, this helped me to resolve this issue soon.

SG · ‎05-24-2021

Yes, this helps. Thanks

SG · ‎05-17-2021

I could get data week wise using "timewrap" function in splunk. index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" earliest=-21d@d | timechart span=1h list(speedindex) as score | timewrap w Source - https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Timewrap

SG · ‎05-16-2021

With the below, I am able to color the bar charts based on the score field value. For the colors I edited XML. index=nextgen sourcetype=lighthouse_json datasource=LH step="https://www.google.com/" | stats values(speedindex) as speedindex, values(speedindex_score) as score by _time | eval green = if(score>=90 AND score<=100,speedindex,0) | eval yellow = if(score<=89 AND score>50,speedindex,0) | eval red = if(score<=49 AND score>0,speedindex,0) | fields - speedindex,score

Posts	43
Solutions	3
Karma Given	9
Karma Received	0
Member Since	‎05-10-2021

Online Status	Offline
Date Last Visited	‎03-23-2022 02:26 AM

How to roundoff the results to 2 decimal digits?

Unable to get the statistics in one line

How to get the status wise data

How to assign global time for the filter in a dash...

Trigger conditions to get the splunk alert if perc...

Mutilple alerts coming for each search results

How to combine multiple searches in same alert

How to combine multiple searches in same alert

Get the previous day 8-9PM data based on the date ...

Divide the results of a query based on a field in ...

Re: How to roundoff the results to 2 decimal digit...

Re: Unable to get the statistics in one line

Re: How to get the status wise data

Re: How to assign global time for the filter in a ...

Re: Trigger conditions to get the splunk alert if ...

Re: Mutilple alerts coming for each search results

How to combine multiple searches in same alert

How to combine multiple searches in same alert

Re: Get the previous day 8-9PM data based on the d...

Re: Divide the results of a query based on a field...

Re: How to print latest value and average value of...

Re: How to remove rows with Zero value?

Re: How to write subquery to run the sub query for...

Re: How create line chart showing the count for Cu...

Re: How to color the bar chart of a field based on...