Thanks everyone. Finally this is the query I used bucket _time span=1h | stats first(Record) as Current, max(Input) as inp by _time, User_Name | streamstats max(inp) as Usage2 by User_Name current=f | eval delta=if(isnull(Usage2),0,Usage2 ) | eval usage=round((inp-delta)/1073741824,2) ... View more

I just realized that the rex field got screwed up in formatting. I fixed it above by adding a \ where appropriate. I don't know how the points work to be honest 😛 ... View more

| rex field=StreamId "0x(?<oct4>\S{2})(?<oct3>\S{2})(?<oct2>\S{2})(?<oct1>\S{2})(?<engine>\S{2})" | eval oct1=tonumber(oct1, 16) | eval oct2=tonumber(oct2, 16) | eval oct3=tonumber(oct3, 16) | eval oct4=tonumber(oct4, 16) | eval Engine=tonumber(engine, 16) | eval Machine=oct1.".".oct2.".".oct3.".".oct4 This worked for me, now I just need to | nslookup. Thanks for the input. ... View more

however what is the point in using a nanosecond timestamp for _time if I cant get the precision out of Splunk??? sourcetype=OrderGW-RJ | eval tm=_time | eval stm=strftime(_time, "%Y-%m-%d %H:%M:%S.%9N") | stats count by _time tm stm | head 1 | table _time tm stm _time tm stm 10/30/12 1:56:43.000 PM 1351623403.000225 2012-10-30 13:56:43.000225000 ... View more

in fact, if you set up email alerts, the ttl is set to 1 day. ... View more

Did you able to solve this issue. I am also facing issues while calculating the percentile. I have changed the method to interpolated. But still results are incorrect. For eg when calculating over two values i am getting response time higher than 90th percentile. ... View more

The second will work given a handful of locations, I guess I was trying to be too clever. ... View more