I'm a novice working in fraud prevention; appreciate your help.  When running the following, I'm getting a failure error and job inspector shows excessive time (106.46) on dispatch.evaluate.join.  Can you help identify what needs to change to output chart of Condition_Attrib_17 by Treatment Group.  I'm a novice working in fraud prevention; appreciate your help.   index=TEST sourcetype="TEST:user_activity" application_id=ABC123 policy_id=" UPDATE" "*"  | dedup data.condition_attrib_22  | rename data. condition_attrib_22 AS data.params.policy  | fields data.params.policy | eval join_key=data.params.policy | fields join_key, data.treatment_group | join type=inner join_key  [search index=TEST sourcetype="TEST:user_activity" application_id=ABC123 policy_id="UPDATE" "*"]     | stats latest(data.request.condition_attrib_17) as Condition_Attrib_17 by data. request.condition_attrib_22     | rename data.request.condition_attrib_22 as join_key     | fields join_key, Condition_Attrib_17     | chart count by Condition_Attrib_17 by data.treatment_group ... View more

Error in my results query:  Unable to distribute to peer named 10.245.11.153 at uri=10.245.11.153:8089 using the uri-scheme=https because peer has status=Down.    My query doesn't request anything for URI to be checked or returned so I don't know the root cause.   I need to get a clean output with an error.  Any suggestions how to fix this? ... View more

This is my query that isn't working as expected.   index=julie sourcetype!="julie:uat:user_activity" host!="julie-uat.home.location.net:8152" application_id=julie1 policy_id=framework action=session_end "error_code"=9999 "*" | table julie_date_time, event_name, proxy_id, error_code, session_id, device_session_id, result |rename session_id as JulieSessionId |join type=left device_session_id [search index=julie sourcetype!="julie:uat:user_activity" host!="julie-uat.home.location.net:8152" application_id=julie1 policy_id="FETCH-DAVESESSION-ID" action=create_ticket |table timeDave, device_session_id, session_id |rename session_id as DAVESessionID] Assume Primary Query returns data like following: julie_date_time event_name proxy _id error_code Juliesession_id device_session_id result 2024-09-20T23:53:53 Login 199877 9999 1a890963 f5318902 pass 2024-09-19T08:20:00 View Profile 734023 9999 92xy9125 81b3e713 pass 2024-09-17T11:23:45 Change Profile 089234 9999 852rs814 142z7x81 pass   Requirement:  I want to add the DAVEsession_ID to the above table when the following query returns something like: timeDave event_name DAVEsession_id device_session_id 2024-09-20T23:53:50 Login 1a890963 f5318902 2024-09-19T08:19:58 View Profile 92xy9125 81b3e713 2024-09-17T11:23:40 Change Profile 852rs814 142z7x81   Expected Outcome: julie_date_time event_name proxy _id error_code Juliesession_id device_session_id result timeDave DAVEsession_id 2024-09-20T23:53:50 Login 199877 9999 1a890963 f5318902 pass 2024-09-20T23:53:50 1a890963 2024-09-19T08:19:58 View Profile 734023 9999 92xy9125 81b3e713 pass 2024-09-19T08:19:58 92xy9125 2024-09-20T23:53:53 Change Profile 089234 9999 852rs814 142z7x81 pass 2024-09-17T11:23:40 852rs814 ... View more

Hi. I'm brand new to splunk.  I've created a table report that shows counts of columns: Time (Hour) Result: Good Result: Bad Result: Ugly After the Index and source type, my query has     |chart count over _time span=hour by data.result What do I need to add to query to calculate the Total of Good, Bad, Ugly and then use that to add a column with the percentage of Total Result to the table.  Appreciate your help. ... View more