Hi, I am new to splunk metrics search. I am AWS/EBS metrics to splunk. I want to calculate the average throughput and number of IOPS for my Amazon Elastic Block Store (Amazon EBS) volume. I found solutions the solution in AWS: https://repost.aws/knowledge-center/ebs-cloudwatch-metrics-throughput-iops, I don't know how to search it in Splunk.  This is the max I can do atm    | mpreview index=my-index | search namespace="AWS/EBS" metricName=VolumeReadOps    Really appreciate, if someone help me out,  ... View more

I have total 17 orders.  Box Estimates is wrong 6 out of 17 orders. What is the average wrong box estimate in total? This is my attempt who is wrong:   | spath path=data{}.actual_totes{}.finalBoxAmount output=actualBoxes | spath path=data{}.estimated_totes{}.box output=estimatedBoxes | eventstats count AS total | eval box_missing=if(actualBoxes != estimatedBoxes, "YES", "NO") | eval average= (actualBoxes - estimatedBoxes) / total * 100 | table actualBoxes estimatedBoxes total box_missing average     ... View more

Short description: When a consumer orders groceries online, I provide the picker—the individual who picked the foods based on the order—with an estimated box that will be needed for that order and that data is stored in a database. The functionality of the Estimated box generally works, although occasionally it fluctuates. It may be greater or lesser. Actual box use data will be stored in data if the picker adds more or fewer boxes than necessary for the order. Actual data box never store in database if approximated functionality works. Expected output:  1. I want find out how much Percentage/Average of actual values missing. I am not sure how to evaluate null/defined Actual boxes. This is my attempt not sure is it correct:       | spath path=data{}.actual_totes{}.finalBoxAmount output=finalBoxes | spath path=data{}.estimated_totes{}.box output=estimatedBox | stats sum(estimatedBox) as totalEstimatedBox, sum(finalBoxes) as totalFinalBoxes | eval diff =( totalFinalBoxes - totalEstimatedBox) * 100 / totalFinalBoxes | table diff       This is my data splunk data table image. As you can see in splunk table  some my actual boxes value is null/undefined/emptyObject(not sure).  In splunk JSON, this is how I get actual_totes: { } data: { actual_totes: { }, estimated_totes: { box: 4 } } PS: I'm a rookie with Splunk, thus my grasp of its syntax is limited. Please walk me through how to display the value in a PIE chart. Pie chat had the following value: Estimated Boxes, Real Boxes used, and missing actual numbers in Percentage %. Thank you. ... View more

One dashboard was made by me. I'm showing my colleagues my dashboard. Problem: When my coworkers or I access that Splunk dashboard link(clean the cookies), the edit dashboard mood screen immediately appears. I merely want to showcase mood; I don't want to edit mood. PS: I alone may provide permission; others cannot. ... View more

I have two two columns of data, One is Expected box and another is Actual box.  I would like to make Percentage/Average of how much actual Box values are missing compare with Expected box. Also some one my Actual boxes data there are no(which null/undefined)  value.  I would like to ignore those rows  where Actual boxes are  (null/undefined) which is compare with my Expected box.  PS: I am beginner level splunker ? Is there any way I can do this Average based on requirements? This my search query:   index::service sourcetype::service "order_tote_analytics" | spath "data.order_number" | search "data.order_number"=* | spath path=data{}.actual_totes{}.finalBoxAmount output=actualBox| spath path=data{}.estimated_totes{}.box output=estimatedBox | table estimatedBox actualBox       This my table looks like PS: I would love to display that  Percentage of actual values missing in single panel, It would nice to show me, how to do that? This is wrong search query 👇🏾👇🏾👇🏾     <panel> <single> <title>Percentage of actual values missing</title> <search> <query>index::service sourcetype::service "order_tote_analytics" | spath "data.order_number" | search "data.order_number"=$orderNumber$ | spath path=data{}.actual_totes{}.finalBoxAmount output=finalBox| spath path=data{}.estimated_totes{}.box output=estimatedBox | stats sum(estimatedBox) as totalBox, sum(finalBox) as finalbox</query> <earliest>$chosenTimePeriod.earliest$</earliest> <latest>$chosenTimePeriod.latest$</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0xf1813f","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> <panel>         ... View more