I am getting the data extracted and published to a dashboard, but the problem is that the "Count" is published on separate rows, not merged in with the other rows. I want the count (from which the percentage is calculated) to end up as an additional column together with the Percentage, Route and Method. This is the Signalflow I currently use: B = data('http_requests_total', filter=filter('k8s.namespace.name', 'customer-service-pages-prd')).count() A = data('http_requests_total', filter=filter('k8s.namespace.name', 'customer-service-pages-prd')).count(by=['route', 'method']) Percentage=(A/B * 100) Percentage.publish(label='Percentage') A.publish('Count') And this is how it looks: Any ideas on how to merge the data so that also Count is on the same rows as the Percentage? ... View more

In my dashboard, when one of the dropdowns are changed I need to reset the value in the other dropdowns to the default value (*); this can easily be done using the <change> function so no issues there. The problem arises when the user clicks a link to the dashboard with pre-populated parameters for the dropdowns (user is taken to a specific state of the dropdowns). The loading of the dashboard with the incoming HTTP parameters for the dropdowns also trigger the <change> to happen and thus resetting all of the selected dropdowns. My questions is, how can I prevent the <change> to trigger on the Initial Load of the Dashboard? Once the Dashboard has been loaded I want the <change> to trigger when the user changes certain dropdowns. I tried the following approach. In the dropdown for which I want to prevent the <change> to trigger a condition was added to check that the Token $FirstLoad$ is set to "Done". <change> <condition match="tostring($FirstLoad$) == &quot;Done&quot;"> <set token="form.PipelineName">*</set> <set token="form.LabelName">*</set> </condition> In the heaviest Search I set a Token when completed (Done): <done> <set token="FirstLoad">Done</set> </done>   The thinking for the above was that since on Initial Load the $FirstLoad$ Token will not initially be set which should prevent the <change> to trigger, but as soon as the $FirstLoad$ Token is updated to "Done", the <change> is triggered. Very frustrating. Anyways, maybe I am missing something simple? Any ideas are appreciated. ... View more

I have a need for approximate statistics/metrics and am currently using Event Sampling, which drastically speeds up the queries. For queries that calculate averages this works great, but I also have a need to do counts. If you set the Event Sampling to for example 1:100, then Splunk seems to look at every 100 Events, which is also reflected in how many Events that are matched when doing 1:100 vs 1:1. Example count with and without sampling: 1:100 = 26311 1:1 = 2623658 1:100 scaled up to 1:1 = 2631100 Diff = 7442, which is 0.3% The Time Period was a previous hour (not the latest hour) as not to have incoming Events affect the Count. 0.3% difference is perfectly ok for my purpose.   Am I thinking of this correctly, or is there any risk of much bigger differences in Count (after upscaling the count)? ... View more

Each Event contains 1-many Transaction Names with associated metrics as per the below example: 2022-08-03T08:47:49.4554569Z TransNames: DavidTrans_2 DavidTrans_1 Total DavidTrans_3 2022-08-03T08:47:49.4633642Z Name: DavidTrans_2 2022-08-03T08:47:49.4995979Z DavidTrans_2 - TransactionsPerSec: 0.92 2022-08-03T08:47:49.5180222Z Name: DavidTrans_1 2022-08-03T08:47:49.5245825Z DavidTrans_1 - TransactionsPerSec: 0.96 2022-08-03T08:47:49.5339575Z Name: DavidTrans_3 2022-08-03T08:47:49.5405933Z DavidTrans_3 - TransactionsPerSec: 0.97 From this Event I want to create a multi-series Timechart, where X is _Time, (Event time), Y is the value for Transactions Per Second and where each graph line represents one of the Transactions (DavidTrans_1, DavidTrans_2, DavidTrans_3. This is just an example and the Transaction name and number of transactions will differ. I have tried many different ways of doing this, but will paste what I just tried, which does not display any metrics and where the format is completely screwed up. SEARCH XXXXXXXXX | rex field=_raw max_match=0 " (?<TRANSNAME>.*) - TransactionsPerSec: (?<TRANSPERSEC>.*).*" | timechart list(TRANSNAME),list(TRANSPERSEC) by TRANSNAME I can add that using the stats command I can at least get the values in a nice table: SEARCH XXXXXXXXX | rex field=_raw max_match=0 " (?<TRANSNAME>.*) - TransactionsPerSec: (?<TRANSPERSEC>.*).*" | stats list(TRANSNAME),list(TRANSPERSEC)   I feel I have done similar things before but for some reason getting the values displayed in a Timechart was tricky this time. ... View more