About scottmkirkland

scottmkirkland · ‎03-19-2025

Thank you @VatsalJagani I took that and I'm trying to get the avg response time for each year. AvgAtScene is in seconds, so I'm trying to get that into the duration. Any suggestions there?

scottmkirkland · ‎03-14-2025

@ITWhisperer Are you suggesting I just drop the %N in my strptime? If I do that, my results don't change.

scottmkirkland · ‎03-13-2025

I'm having trouble getting my duration into the format I'd prefer... I'd like to see the duration to be MM:SS. However, despite a few different approaches, I keep getting milliseconds.

scottmkirkland · ‎01-29-2025

I'm trying to get a table or heatmap of a count of incidents that occur by day and hour....My results make sense, except I'm only getting hours 8 through 20. I know incidents occur round the clock. So, I should be seeing a count for each hour. Any suggestions? | eval date_hour=strftime(_time, "%H") | eval date_wday=strftime(_time, "%A") | chart dc(RMI_MastIncNumb) AS incidents over date_wday by date_hour useother=f | eval wd=lower(date_wday) | eval sort_field=case(wd=="monday",2, wd=="tuesday",3, wd=="wednesday",4, wd=="thursday",5, wd=="friday",6, wd=="saturday",7, wd="sunday", 1) | sort sort_field | fields - sort_field wd

scottmkirkland · ‎11-14-2024

Thank you @bowesmana . With the Time Selector set to Year to date, and not using the earliest command | timechart span=1mon count Results in 2024 as expected. Then using the following, I end up with a timeline of 2024, but the data claiming it's 2023. But is for sure 2024 data, labeled as 2023. | timechart span=1mon count | timewrap 1y series=exact time_format=%Y

scottmkirkland · ‎11-13-2024

I am on Splunk 8.2.12. I am trying to get a distinct count of incidents that have happened in each month, year to date. I'd like to compare that to the year prior. I feel like this should be pretty easy, but my results aren't showing the current year in comparison to the previous year. This shows the current year data (2024) (earliest=-1@y@y AND latest=now()) | eval date_month=strftime(_time, "%mon") | eval date_year = strftime(_time, "%Y") | timechart span=1mon dc(RMI_MastIncNumb) as "# of Incidents" When I add | timewrap 1year series=exact time_format=%Y it ends up just showing me 2023

scottmkirkland · ‎07-05-2024

I've got two servers providing me temperature data. Host A has Sensor1 and Sensor2. Host B has Sensor1 and Sensor2. My goal is a line graph of all four sensors named as their actual room name. As long as I use host=HostA in the base search, my timechart works great with 20min avg. index=tempmon sourcetype=tempdata host=HostA | timechart span=20min eval(round(avg(Sensor1),2)) as "Room12", eval(round(avg(Sensor2),2)) as "Room13" I'm struggling to understand if a subsearch or 'where' statement would help do something like this index=tempmon sourcetype=tempdata Where host=HostA | eval Room12=Sensor1 | eval Room13=Sensor2 Where host=HostB | eval Room14=Sensor1 | eval Room15=Sensor2 | timechart span=20min avg(Room12), avg(Room13), avg(Room14), avg(Room15)

scottmkirkland · ‎02-15-2023

Were you able to resolve this?

scottmkirkland · ‎01-24-2023

I have a dataset with incident numbers and their associated Jurisdiction. It is possible that a incident will be listed in multiple jurisdictions. I don't want to dedup(incident_number) globally. I need to count by jurisdiction, but the dedup or distinct count needs to be within each Jurisdiction. Any suggestions?

scottmkirkland · ‎05-03-2022

I've got a dashboard created with Maps+ plotting the events on the map. The next section is a table of events. I'd like to schedule this to be an automated report, send to some folks. However, the PDF reports just shows the table and "PDF Export does not support custom visualizations. Anyone have any ideas how I could still accomplish what I'm hoping for?

Posts	10
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎04-04-2022

Online Status	Offline
Date Last Visited	‎08-12-2025 04:28 PM

Finding Duration and formatting output

Count number of incidents per hour\day

Timechart and Timewrap

Field exists with multiple hosts

How to calculate the number of distinct incidents ...

Maps+ Reports doesn't support visualization, what ...

Re: Finding Duration and formatting output