About teegarden7070

teegarden7070 · ‎07-01-2021

This is great! Thank you so much for all of your help!

teegarden7070 · ‎06-30-2021

Sure, I can try, but I would like to stay as generic as possible: index=tool1 OR index=tool2 OR index=too3 So I would like to index the 3 of these tools, but search for specific fields with each tool. Lets say, tool1 field I want is called field 1, tool 2 is called field 2, and tool 3 is called field 3. I hate to be so vague, and I really do appreciate the help. I can do a: |stats count by field 1, but not sure how to get the counts and display all 3 fields.

teegarden7070 · ‎06-30-2021

For example, if I use the index= all tools, and then add a field where it doesnt count all the events, only a few

teegarden7070 · ‎06-30-2021

Awesome thanks for the help! I guess the timeframe isn't such a huge deal because I can adjust the parameters of the search, the problem I'm having is the search itself. Each one of the tools has a separate event that I want to use to find the total count of event. All the other fields do not necessarily help with a total count. So all in all I want to index a tool, then get a total count by event in that tool, then be able to display it. If I'm not making sense feel free to critique my thinking.

teegarden7070 · ‎06-30-2021

So far I think I have the syntax built out like this index=tool OR index=tool2 OR index=tool3 | eval parta=(index=tool information, information | stats count) | eval partb=(index=tool2 information, information | stats count) | eval partc=(index=tool3 information, | stats count) | table parta partb partc Thinking this will get me totals for the separate tools, but I'm looking to get just 1 total, per week if possible. I was thinking addtotals would help, but not sure. Any and all help would be very appreciated.

teegarden7070 · ‎06-22-2021

Thank you!

teegarden7070 · ‎06-22-2021

index=phantom_container AND owner!=null AND close_time!=null | eval st=strptime(create_time, "%Y-%m-%dT%H:%M:%S") | eval et=strptime(close_time, "%Y-%m-%dT%H:%M:%S") | eval Dur=(et-st)/60 |table create_time close_time Dur id container_label owner_name Here is the basic search, now I would like to find the average amount of time between create_time and close_time per owner_name.

Posts	7
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎06-22-2021

Online Status	Offline
Date Last Visited	‎10-06-2021 09:40 AM

New to splunk, looking for total calculator by wee...

Trying to find average between two columns time

Re: New to splunk, looking for total calculator by...

Re: New to splunk, looking for total calculator by...

Re: New to splunk, looking for total calculator by...

Re: New to splunk, looking for total calculator by...

New to splunk, looking for total calculator by wee...

Re: Trying to find average between two columns tim...

Trying to find average between two columns time