About Goldenfit

Goldenfit · ‎06-28-2023

So I have this query that creates and incident if there is 7 outlier in the last 15 minutes: | streamstats time_window=15m current=true reset_after=(propOutlier=7) sum(isOutlier) as propOutlier by InterfaceName | eval isIncident = if(propOutlier=7, 1, 0 ) | eventstats max(isIncident) as hasIncident by InterfaceName | where hasIncident=1 Now i would like the add to "isIncident" the situation where there has been 5 outliers, repeteadly, in the last 3 time window of 15 minutes. If there has been 5 outliers in the last 15min window, I do not care. But if this happens 3 times in a row, it is a problem for me. Can anyone help? Thank you

Goldenfit · ‎06-02-2023

I have a problem using the timechart command with this query. if i use "table" it works, but with timechart it doesn't... anybody can help? |host..., source..., etc | table AREA, SUBID, CURRENT_TIMESTAMP | join AREA, SUBID, CURRENT_TIMESTAMP [|search source... EVENT_TYPE... | table AREA, SUBID, TXT, CURRENT_TIMESTAMP ] | eval message_id=AREA.SUBID." ".TXT | timechart count(message_id) as "No. of message" by message_id

Goldenfit · ‎05-30-2023

so I created a field like so: |eval message_id=AREA.SUBID | stats count as "Number of message_id" by message_id | sort 10 - "Number of message_id" This gives me a column chart with the message_id on the X axis and count on Y axis. With the drilldown setting shown in the pictures below, i'm trying to make that the following query indicate details only for the specific message_id I am cliking on the column chart |eval message_id=AREA.SUBID | rename TEXT as Text, ICON as Priority, USER as User | stats count by User, Text, Priority |where message_id="$mess_id2$" |sort - count Yet I get the "no results found" message. I know this is related to the fact that the field is "artificial" but I can't find a way to fix it

Goldenfit · ‎05-17-2023

So basically i have another panel my goal is that when I click on one of the message_id displayed in the chart above, my first query in the original post udates it to display TEXT and USER with this particular message_id

Goldenfit · ‎05-16-2023

So i am trying to link this to a token from another panel but since "message_id" is a created field, it doesn't work. Is there anyway I can make this work? <index> <host> | eval message_id=AREA.SUBID | stats count by USER, TEXT | search message_id="$messid1$" | sort - count

Posts	5
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎05-16-2023

Online Status	Offline
Date Last Visited	‎06-28-2023 05:20 PM

Finding a number of outliers that repeteadly occur...

How to timechart with join>

How to fix token with a field created using "eval"...

How to use token with a field created with "eval"?

Finding a number of outliers that repeteadly occur...

How to timechart with join>

How to fix token with a field created using "eval"...

Re: Using token with a field created with "eval"?

How to use token with a field created with "eval"?

Are you a member of the Splunk Community?