About dmoberg

dmoberg · ‎05-25-2023

that worked! Not sure how I missed this. Thx!

dmoberg · ‎05-25-2023

We have a log file that is split into multiple events. In these events we need to count the number of occurrences where Event XXX > 0 and Event YYY > 0 for each Source file. So finding 1 match of XXX and YYY in one particular Source file would be counted as 1 for this purpose. Splunk search: SEARCH (patterns matching Events of type A) OR (patterns matching Events of type B) | eval isDEP=if(match(NAME, "(?i).*(XXX).*"), 1, 0) | eval isPERF=if(match(NAME, ".*(YYY).*"), 1, 0) | stats list(NAME),list(isDEP),list(isPERF),count by source In the Search part of the query I find the type of Events of interest, then determine the count of matches for XXX and YYY. This works fine, the problem is that I do not know how to tell Splunk to give me: If XXX > 0 AND YYY > 0 for a particular Source file (aggregate by Source), then count this as 1. This is an example output for the above query: The issue seems to be that Splunk works on an "per Event" basis so each result is tied with the Event and not the Source file. Any ideas on how to do this?

dmoberg · ‎02-01-2023

I am struggling to figure out how to get the Visualization that I want, if even possible.... Timechart works great for this purpose but only when having 1 By clause (aggregated on one value), so if I have understood it properly, I should use the Stats command which supports multiple aggregations. The end goal is to have one graph showing the following: Y-axle: Count of the events X-axle: Time Graph lines: One Graph line shows the Count for a unique combination of responseCode and Location OR possibly using Trellis (probably better) split By Location, so that each Location is a separate graph with one graph line showing the count for the responseCode. The Search as it is now: <<SEARCH>> | bin _time as time span=15m | stats count by _time,body.records.properties.responseCode,body.records.location If using Trellis split by Location, this results in two graphs, one per Location where each has one graph line for Count (no matter the response code) and one more graph line for the response code itself (i.e. response code 200 becomes a line on 200 of the Y-axle). But I want 1 single graph line showing the count per unique responseCode (the legend should display the responseCode (i.e. 200). Any ideas?

dmoberg · ‎09-27-2022

I have a need for approximate statistics/metrics and am currently using Event Sampling, which drastically speeds up the queries. For queries that calculate averages this works great, but I also have a need to do counts. If you set the Event Sampling to for example 1:100, then Splunk seems to look at every 100 Events, which is also reflected in how many Events that are matched when doing 1:100 vs 1:1. Example count with and without sampling: 1:100 = 26311 1:1 = 2623658 1:100 scaled up to 1:1 = 2631100 Diff = 7442, which is 0.3% The Time Period was a previous hour (not the latest hour) as not to have incoming Events affect the Count. 0.3% difference is perfectly ok for my purpose. Am I thinking of this correctly, or is there any risk of much bigger differences in Count (after upscaling the count)?

dmoberg · ‎09-27-2022

Problem solved. I had the Dashboard pane search settings for the Time Picker set to Global, instead of Shared Time Picker. BUT, I earlier checked the Source of the Dashboard and the Earliest was set to "-24h" and still the search took forever, but directly in Splunk search the same search for 24 hrs was really quick. Maybe when Global is selected as the Time Picker, the Earliest setting is ignored and instead All Time is selected (picked up from elsewhere)? Anyways, thanks allot now it works great!!

dmoberg · ‎09-27-2022

Thanks. I tried it but it seems when this setting is used in the Dashboard there is no performance improvement at all. Running the exact same query directly in SPL with the same Event Sampling is much quicker. Maybe this is a bug in the implementation?

dmoberg · ‎09-27-2022

For the type of data I am trying to extract, Event Sampling really speeds up the query. This works fine when executing SPL queries, but I have not been able to figure out how to do this in a dashboard. Found some older posts where "rand" was used, but apparently that did not speed up the query. Is it possible to specify Event Sampling directly in a Search Query or in the Dashboard in some way?

dmoberg · ‎09-27-2022

Thanks! The EventStats did the trick

dmoberg · ‎09-26-2022

I have a need to compare the average time for certain events with the 5 min bucket/bins of the same events. The idea is to find 5 min intervals that deviate more than a certain percentage from the average response times and then in some way display those intervals. I am however struggling to figure out how to output the Average for the entire time period but also calculate the 5 minute intervals. The following query, returns nothing (can you even do 2 Stats in the same query?): search | stats avg(Value) as AvgEntirePeriod | bin _time span=5m | stats avg(Value) by _time Any ideas on how to write this?

dmoberg · ‎08-15-2022

Thanks! That was a bit disappointing though. Seems like Splunk improved the GUI and usability with the Dashboard Studio but at the same time made it contain less possibilities and features. We might have to switch back to the Classic dashboards.....

dmoberg · ‎08-15-2022

I have created a Dashboard using the Dashboard Studio and am trying to find out how to adjust the width of an input field. By googling I was able to find instructions for how to add CSS to the Form in the Classic Dashboard, but have not been able to find out how to do the same using Dashboard Studio. Anyone knows how to achieve this? Also, is there any way to add a Chart, Image or similar to the Right of the Input fields?

dmoberg · ‎08-07-2022

Thanks for the suggestions, but I was unfortunately not able to get the results properly formatted with those. I was lucky to find a Splunk expert internally at our company that helped me to create the following query that seems to work 🙂 | rex field=_raw max_match=0 " (?<TRANSNAME>.*) - RespTimeAvg: (?<TRANSPERSEC>.*).*" | eval TRANSACTION=mvzip(TRANSNAME,TRANSPERSEC,"|")|mvexpand TRANSACTION|search TRANSACTION!="*N/A*"|eval TRANSNAME2=mvindex(split(TRANSACTION,"|"),0),TRANSPERSEC2=mvindex(split(TRANSACTION,"|"),1)|chart useother=f limit=0 list(TRANSPERSEC2) over _time by TRANSNAME2 Seems like this query got complex due to the multivalues and multiple key value pairs for each name in the event.

dmoberg · ‎08-03-2022

If I do this then all of the values are averaged out instead of displaying the individual values for each Transaction. See below: But the look of the graph is better......

dmoberg · ‎08-03-2022

Each Event contains 1-many Transaction Names with associated metrics as per the below example: 2022-08-03T08:47:49.4554569Z TransNames: DavidTrans_2 DavidTrans_1 Total DavidTrans_3 2022-08-03T08:47:49.4633642Z Name: DavidTrans_2 2022-08-03T08:47:49.4995979Z DavidTrans_2 - TransactionsPerSec: 0.92 2022-08-03T08:47:49.5180222Z Name: DavidTrans_1 2022-08-03T08:47:49.5245825Z DavidTrans_1 - TransactionsPerSec: 0.96 2022-08-03T08:47:49.5339575Z Name: DavidTrans_3 2022-08-03T08:47:49.5405933Z DavidTrans_3 - TransactionsPerSec: 0.97 From this Event I want to create a multi-series Timechart, where X is _Time, (Event time), Y is the value for Transactions Per Second and where each graph line represents one of the Transactions (DavidTrans_1, DavidTrans_2, DavidTrans_3. This is just an example and the Transaction name and number of transactions will differ. I have tried many different ways of doing this, but will paste what I just tried, which does not display any metrics and where the format is completely screwed up. SEARCH XXXXXXXXX | rex field=_raw max_match=0 " (?<TRANSNAME>.*) - TransactionsPerSec: (?<TRANSPERSEC>.*).*" | timechart list(TRANSNAME),list(TRANSPERSEC) by TRANSNAME I can add that using the stats command I can at least get the values in a nice table: SEARCH XXXXXXXXX | rex field=_raw max_match=0 " (?<TRANSNAME>.*) - TransactionsPerSec: (?<TRANSPERSEC>.*).*" | stats list(TRANSNAME),list(TRANSPERSEC) I feel I have done similar things before but for some reason getting the values displayed in a Timechart was tricky this time.

Posts	14
Solutions	0
Karma Given	8
Karma Received	1
Member Since	‎08-03-2022

Online Status	Offline
Date Last Visited	‎02-05-2024 06:49 AM

How to match at least one field from separate even...

What is an alternative to timechart when needing a...

Event sampling and Count - accuracy?

Is it possible to specify Event Sampling in a quer...

Stats with different bins (full time period AND 5 ...

Dashboard studio - How do I modify width of Input ...

Struggling with Multi-series timechart- How to wri...

Re: How to match at least one field from separate ...

How to match at least one field from separate even...

What is an alternative to timechart when needing a...

Event sampling and Count - accuracy?

Re: Specify Event Sampling in a query for use in a...

Re: Specify Event Sampling in a query for use in a...

Is it possible to specify Event Sampling in a quer...

Re: Stats with different bins (full time period AN...

Stats with different bins (full time period AND 5 ...

Re: Dashboard studio - modify width of Input field...

Dashboard studio - How do I modify width of Input ...

Re: Multi-series timechart - struggling to get it ...

Re: Multi-series timechart - struggling to get it ...

Struggling with Multi-series timechart- How to wri...