Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About rpecka
rpecka
Explorer
Member since:
04-25-2022
09-12-2024
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 04-25-2022 |
Activity Feed
- Posted How to sample first N minutes of span in timechart, with huge numbers of events? on Splunk Search. 08-15-2022 04:10 PM
- Posted How to Count multiple fields in histogram? on Splunk Search. 06-27-2022 12:13 PM
- Posted Re: How can I aggregate information into rows based on a transaction ID? on Splunk Search. 05-27-2022 02:52 PM
- Posted Re: How can I aggregate information into rows based on a transaction ID? on Splunk Search. 05-25-2022 04:36 PM
- Posted How can I aggregate information into rows based on a transaction ID? on Splunk Search. 05-18-2022 12:51 PM
- Posted Re: Search, use the same results for two different sub searches, then merge the results and chart them on Splunk Search. 05-03-2022 11:18 AM
- Posted Search, use the same results for two different sub searches, then merge the results and chart them on Splunk Search. 04-27-2022 12:41 PM
- Karma Re: Conditionally Omit Bin from Chart for bowesmana. 04-26-2022 09:39 AM
- Posted Conditionally Omit Bin from Chart on Splunk Search. 04-25-2022 02:45 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-15-2022
04:10 PM
I would like to run a timechart query that ends with `| timechart span=1h distinct_count(thing) by other_thing`
The problem is that there are a huge number of events being counted so the query takes a long time. Is there a way that I can run the same query but sample only the first 5 minutes of every hour so that I can speed up the query?
... View more
Labels
- Labels:
-
timechart
06-27-2022
12:13 PM
I have rows in the form:
ID
Field1
Field2
Field3
And I would like to create a histogram that shows the values of all three fields.
I can make one for Field1 by doing stats count by Field1 span=1000 but I can't seem to figure out how I would get the other values into the same table. Do I need to do multiple searches and join them? How would I go about doing that?
... View more
Labels
- Labels:
-
chart
05-27-2022
02:52 PM
I have events with stageIDs and IDs. I want to create one row for each ID which includes a column for each stageID to indicate whether it has or does not have a corresponding event for that stageID. Then I want to filter for only the rows (IDs) that have stageID=foo present, and then create a pie chart to count the occurrences of each stageID in the rows that remain
... View more
05-25-2022
04:36 PM
This isn't quite it. When I run the chart command I get this table: sessionID stageID1 stageID2 stageID... id1 99 86 34 id2 33 45 22 I want the same thing except without the chart and with additional columns populated depending on what the stages are
... View more
05-18-2022
12:51 PM
I have events which will all have an ID, stageID, stageDuration, as well as other information. In the past I've used `chart sum(stageDuration) over ID by stageID` to create stacked bar charts, but now I’m more interested in the table produced by that command. It has a column for ID, then columns for the durations of each of the stageIDs that had the same ID. I would like to create a similar table except I would like to include additional columns. For example, I would like to conditionally populate a column with event.startTime from the stage foo if the stageID foo exists for an ID. I don't need to visualization, just the way of forming the table. It seems like there might be a way to do this with transactions but I haven't been able to figure it out.
... View more
Labels
- Labels:
-
chart
-
table
-
transaction
05-03-2022
11:18 AM
You're right. What I’m trying to do is not as complicated as I thought it was. I only need to duplicate the case statement once to get what I need. Thank you!
... View more
04-27-2022
12:41 PM
I would like to narrow down my results and rename a few fields using an initial search, let's call these results A. Then I want to take A and search on `event_type=event1` and massage the results to get B Then take A and search on `event_type=event2` and massage the results to get C Then I want to combine the results B and C and use chart to dedup and display the combined result. With my current query, the column for stage1 in my table is all null, but if I do the search with the contents of the append at the root and remove the second search, I get populated results My current query is the following: index=... ... | rename some_field as taskID
| append [search "event.event_type"=event1 | eval stageDuration='event.payload.total_duration'-'event.payload.provisioning_duration' | eval stageID="stage1"]
| search "event.event_type"=event2 | rename event.payload.total_duration as stageDuration event.payload.stageID as stageID
| chart sum(stageDuration) over taskID by stageID | table taskID, stage1, * | where isnull(stage4) | fillnull value=0
... View more
Labels
- Labels:
-
subsearch
04-25-2022
02:45 PM
Hi, I’m trying to make a stacked bar chart visualization where my y axis is milliseconds, my x axis is a task ID, and I’m splitting by a stage ID. My query is: | chart max("duration") over task_id by "stage_id" | table task_id, stage_1, stage_2, stage_3, * In my results, tasks where stage 1 occurred are so long that they make all the other bars look really tiny. Is there a way that I could add to my query to filter out the task_ids where stage_1 occurred?
... View more
Labels
- Labels:
-
chart
