About avadhutha

avadhutha · ‎01-18-2024

Thank you mate for the help, Below corrected one helped with faster results. |chart latest(Count) as Count by ProcessDate,Name |sort 0 - ProcessDate | transpose 0 column_name=Name header_field=ProcDate

avadhutha · ‎01-18-2024

No, it is not working

avadhutha · ‎01-18-2024

I have a chart formed like below and it's dynamic columns are created based on processes date. By default now the column header sort is happing from lower to higher value but I am looking in a format where headers of processDates are higher to lower. Query: |chart latest(Count) as Count by Name ,ProcessDate Current Output: Name 20240101 20240102 20240103 xyz NA NA NA 123 NA NANA NA Expecting output: Name 20240103 20240102 20240101 xyz NA NA NA 123 NA NANA NA

avadhutha · ‎01-18-2024

@avitallangedo you have any solution to sort from higher to lower for a dynamic columns in a chart?

avadhutha · ‎03-21-2023

Thank you so much.., I was trying a lot of thing like field extraction and regex and you helped it well with ?.

avadhutha · ‎03-21-2023

I have a string like below and unable to extract accuratly with rex command please suggest any alternative way. _raw---------------- {lable:harish,message: Say something, location:India, state:TS,qual:xyz} {message: say nothing,lable:harish, location:India, state:TS,qual:xyz} {lable:harish, location:India, state:TS,qual:xyz,message: say splunk splunk answers} The message value is randomized location and I need to pick the message value. When I try with below command it is not considering the proper end position. Please suggest |rex "message:(?<Message_value>.*)[,|}]" |table Message_Value

avadhutha · ‎12-23-2022

Thank you @yuanliu for feedback. I have created a new conversation based on your suggestions. https://community.splunk.com/t5/Splunk-Search/how-to-get-90-of-max-execution-time/m-p/625167#M217321

avadhutha · ‎12-23-2022

I have a requirement to pull 90% of max execution time. Ex: I have 10 requests for an hour and it's execution times as below. Out of which if I take max(Executation_time) I will get 10 sec but I want to give 10% leverage and consider max Time from 90% of ExecutionTimes. I will be getting total number of executation details(10 in this ex) through a seach like `stats count(_raw) by Hour'. Now I have to take 10% record counts and neglect those number of records to get 90% of max Time Tra. Executation_Time 1. 10 Sec 2. 9 Sec 3. 8 sec 4. 7 sec 5. 6 sec 6. 5sec 7. 4 sec 8. 3 sec 9. 2 sec 10. 1 sec

avadhutha · ‎12-22-2022

mainsearch| stats count(_raw) as Cou by hour |join hour [ subsearch| head -$Cou$ ] Above mentioned command is not working, as main search values can be used as values in subsearch but unable to use it under a command. Any suggestions?

Posts	9
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-22-2022

Online Status	Offline
Date Last Visited	‎01-19-2024 01:20 AM

Splunk Chart dynamic column header sorting

How to extract a string from _raw?

how to get 90% of max execution time

Can we pass main search result value into subsearc...

Re: Splunk Chart dynamic column header sorting

Re: Splunk Chart dynamic column header sorting

Splunk Chart dynamic column header sorting

Re: How to sort dynamic column names?

Re: Extract a string from _raw

How to extract a string from _raw?

Re: Can we pass main search result value into subs...

how to get 90% of max execution time

Can we pass main search result value into subsearc...