Hi Team, I have 2 splunks as below (index=xxxx) orgName=xxx sourcetype=CASE(SourceA) earliest=-15d uniqueIdentifier="Class.ClassName.MethodName*" | dedup SourceASqlId | tableSourceASqlId (index=xxxx) orgName=xxx sourcetype=CASE(SourceB) earliest=-15d SourceBSqlId=xxxx | table SourceBSqlText I want to form a single splunk to get ALL the distinct "SourceASqlId" [splunk # 1], get them as input to "SourceBSqlId" [splunk #2] and generate FINAL output as "SourceBSqlText How can we achieve it.Iam even ok if the date range can be reduce to say 2d to make the splunk optimised as I feel my requirement is very heavy compute intensive Thanks. ... View more

I have a splunk where one of the eval method as part of main splunk query is as below.Iam not sure why SnapshotTimestamp is divided by 1000 but I presume it could be done to convert it to seconds.Sorry am a newbie | eval snapshot_processed = strftime(SnapshotTimestamp/1000, "%Y-%m-%d %H:%M:%S") Iam trying to find the # of days clasped between "snapshot_processed" and today. I tried to modify the splunk as below and then try to view the table for "latencyInDays".However it does not return any value. | eval nowstring=now() | eval latencyInDays=(nowstring-snapshot_processed)/86400    What am I missing? ... View more

Iam using splunk to generate as below.It is run for 2 days date range where am trying to compare the count ClassName 16-Oct-24 17-Oct-24 ClassA 544 489 ClassB 39 47 ClassC 1937 2100   My splunk query is as under index=myindex RecordType=abc ClassName IN ( "ClassA", "ClassB", "ClassC") | bucket _time span=1d | stats avg(cpuTime) as avgCpuTime by ClassName _time | xyseries ClassName _time avgCpuTime I need below output which has an extra column that gives the comparision.How can we tweak this query?Is there another way to achieve this in more visually appealing manner ClassName 16-Oct-24 17-Oct-24 %Reduction ClassA 544 489 10% ClassB 39 47 -21% ClassC 1937 2100 -8% ... View more

I have below splunk which gives result of top 10 only for a particular day and I know the reason why too. How can I tweak it to get top 10 for each date i.e. If I run the splunk on 14-Oct, the output must include 10-Oct, 11-Oct, 12.-Oct and 13-Oct each with top 10  table names with highest insert sum       index=myindex RecordType=abc DML_Action=INSERT earliest=-4d | bin _time span=1d | stats sum(numRows) as count by _time,table_Name | sort limit=10 +_time -count         Thanks in advance ... View more

Iam using 👇 splunk with delta command             index=xxxx source=xxxx rcrdType=xxx | timechart span=1h avg(requestSize) avg(responseSize)|delta avg(requestSize) |delta avg(responseSize)           I need to modify the query to ONLY include those events where either delta avg(requestSize)  OR delta avg(responseSize) OR both are positive ... View more