Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Felix82
Felix82
Explorer
Member since:
07-12-2021
08-27-2021
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-12-2021 |
Activity Feed
- Posted Re: Why doesn't the the eval- subtraction generates results from two extracted values? on Splunk Search. 08-27-2021 03:42 AM
- Posted Why doesn't the the eval- subtraction generates results from two extracted values? on Splunk Search. 08-27-2021 03:21 AM
- Posted Re: How could I create a timespan for alternating events? on Splunk Search. 08-11-2021 01:48 AM
- Posted Re: How could I create a timespan for alternating events? on Splunk Search. 08-11-2021 01:09 AM
- Posted How could I create a timespan for alternating events? on Splunk Search. 08-11-2021 12:10 AM
- Posted Re: How could I look only at a defined time span in real-time-search? on Splunk Search. 07-12-2021 11:09 PM
- Posted How could I look only at a defined time span in real-time-search? on Splunk Search. 07-12-2021 06:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-27-2021
03:42 AM
The problem is already solved! The calculation needs all results in one row... ... | multireport [ stats first(Arbeitsbeginn_unix) AS Arbeitsbeginn_unix] [ stats sum(duration) AS "Stördauer_gesamt"] [ search Störung="Schichtende" OR Störung="Pause" | stats sum(duration) AS "Pausendauer"] | filldown | reverse | filldown | eval Stördauer=Stördauer_gesamt-Pausendauer | eval Arbeitszeit=now()-Arbeitsbeginn_unix-Pausendauer | eval Verfügbarkeit=round((Arbeitszeit-Stördauer)/(Arbeitszeit)*100 , 1) | table Stördauer_gesamt Pausendauer Arbeitsbeginn_unix Arbeitszeit Verfügbarkeit Stördauer | head 1 | fields Verfügbarkeit Wish a nice weekend, Felix
... View more
08-27-2021
03:21 AM
Hey Splunk- community, theres another problem which must solved again. The following query.... index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" earliest=@d latest=now | where Arbeitsplatz="Arbeitsplatz Pulveranlagen" OR Arbeitsplatz="Arbeitsplatz Einhängen" OR Arbeitsplatz="Arbeitsplatz Aushängen" | transaction startswith="kommend" endswith="gehend" | eval Arbeitsbeginn="5:30:00" | eval Arbeitsbeginn_unix=strptime(Arbeitsbeginn, "%H:%M:%S") | eval Störzahl=mvcount(Störung) | search Störzahl!=2 | multireport [ stats first(Arbeitsbeginn_unix) AS Arbeitsbeginn_unix] [ stats sum(duration) AS "Stördauer_gesamt"] [ search Störung="Schichtende" OR Störung="Pause" | stats sum(duration) AS "Pausendauer"] | eval Stördauer=Stördauer_gesamt-Pausendauer | eval Arbeitszeit=now()-Arbeitsbeginn_unix-Pausendauer | eval Verfügbarkeit=round((Arbeitszeit-Stördauer)/(Arbeitszeit)*100 , 1) | table Stördauer_gesamt Pausendauer Arbeitsbeginn_unix Arbeitszeit Verfügbarkeit Stördauer ...doesn't want to calculate any fields after "| multireport ... ]". I tested Stördauer="Stördauer_gesamt"-"Pausendauer"; Stördauer='Stördauer_gesamt'-'Pausendauer'; Stördauer=tonumber(Stördauer_gesamt)-tonumber(Pausendauer).... Nothing works. I wonder because all previous and used fields have values: Does sombody have an idea where's the problem? Thanks in advance and kind regards Felix
... View more
Labels
- Labels:
-
eval
-
field extraction
-
subsearch
08-11-2021
01:48 AM
Ops - excuse me, please, I just work with splunk since effectively two weeks. Actual it's more experimenting than knowledge. Your last suggestion works nearly great - it only left a few gaps in visualization. I hope I could solve the last problems and fill the gaps myself now. Thank you very much! Felix
... View more
08-11-2021
01:09 AM
Hi @ITWhisperer, thank you for your anwser! I've tested different syntaxes, different comands, research comands at "Splunk Search Reference" and changed fields... The search now creates the desired time- list but doesn't fill the gaps. index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | makecontinuous span=10s _time | filldown action index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | makecontinuous span=10s _time | filldown action | chart list(action) OVER _time index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | chart list(action) OVER _time | makecontinuous span=10s _time | filldown action index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | chart list(action) OVER _time | makecontinuous span=10s action index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | chart list(action) OVER _time | makecontinuous span=10s _time index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | timechart list(action) | makecontinuous span=10s _time index=machinedata_w05_sum app=StörungenPulveranlagen "Linie 1" | replace "gehend" WITH "1" IN "action" | replace "kommend" WITH "0" in "action" | timechart list(action) | makecontinuous span=10s _time | filldown action The results always looks like following or similar: Kind regards, Felix
... View more
08-11-2021
12:10 AM
Hey Splunk- community, I need your help again. My data are events which reports disturbments. "action=kommend" marks the start of disturbment, "action=gehend" the end of disturbment (action=0 => disturbment; action=1 => no disturbment). I have to consider one important condition: the reason of both events schould be same (Störung=X (action=kommend) => Störung=X (action=gehend)). Alternatively there is the possibility to use "transaction" but there excists same problem: How could I command the search to produce time- connected events which hold the status? The actual result looks like first picture following but it should looks like second to compare them in one line chart (compare human reported disturbments with machine reported disturbments). Thank you very much and kind regards from Germany, Felix Actual result How it should looks like
... View more
Labels
- Labels:
-
chart
-
table
-
timechart
-
transaction
07-12-2021
11:09 PM
Hi Michel, thank you for sharing your experiences! It's so difficult and extensive to get an overview around all commands and functions... I will test your parameters then give you feedback. Greetings, Felix
... View more
07-12-2021
06:38 AM
Hi, I'm new in working with Splunk - I began to explore the program last monday... I have the task to create a dashboard for visualizing the availibility of a machine. My working base: The machine data, additional disorder reports by workers (implemented by tablets) and the knowledge about the working times (monday till friday, 5.30am till 10.30pm). Now I want to use the daily data in timerange from 5.30am till 10.30pm because the availibility should only represents the disorder times in relation to real working time. How could I do that without a specified date? Many Thanks and Greetings from Germany, Felix
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-27-2021
11:08 AM
|
