Below quite simple query to fill drop down list in my dashboard.    index=gwcc | eval file=lower(mvindex(split(source,"/"),-1)) | dedup file | table source, file | sort file The point is it takes 30-60 seconds to generate it.   Do you have an idea how to simplify it ? Or write in more efficient way ?   ... View more

In my case there is an index with field OP which has a duration TT . Of course there are a lot of records with different OPs and diffent TTs | stats perec25(TT) as Q1, median(TT) as Q2MEDIAN, perc75(TT) as Q3, perc98(TT) as P98 by OP Here is the way I count quartiles and 98percentile of my set. The result is four values between 2sek.(Q1 ) and 40sek.(P98) for every OP. Last time @ITWhisperer mestioned about command BIN. I like it! I wondered about creating 10 bins instead ( kind of every10 percentile). I did somethink like | bin TIMETAKEN bins=10 |stats count(TIMETAKEN) by TIMETAKEN and expected to see 10 bins but the result was : TIMETAKEN count(TIMETAKEN) 0-10 6393 10-20 389 20-30 15 40-50 2 so no 10 bins but only 4 😞 What am I doing wrong ? And how to create 10 bins for each OP ? Something like | bin TIMETAKEN bins=10 |stats count(TIMETAKEN) by OP   ???       ... View more

My target is not only show proper percentiles but also count elements in every precentile . So the first step I did is: index="oap" | stats perc25(tt) as P25, perc50(tt) as P50, perc75(tt) as P75 by oper It gives me expected values for each percentile - the first part is ready. Then I figured out something like | where tt>P75 | stats values(P75) count by oper It adds additional column but only with data from one (75th) percentile. But how to prepare a query which returns count for each Percentil ?   ... View more

index=db OR index=app | eval join=if(index="db",processId,pid) | stats sum(rows) sum(cputime) by join Above is simple example how to join two indexes. But how to join two indexes where the key value has two fields ? K.   ... View more

I have been trying to create some analyzes in splunk for  a few week now. Sometimes I succeed, sometimes I fail. I appreciate a lot of help from community users - it helps a lot. And the results sometimes are amazing. Anyway I still feel not comfortable and experience a lot of problems with syntax and rules of splunk language .  I am thinking about a page/tutorial/blog/youtube channel , something like Splunk for DBA - relational DBA! . To read about theory , rules and syntax commands with examples  like stats, join, append, timecharts and other who can manipulate with multiple table indexes their relations and aggregations. Of course this community is a mine of examples and recipes but maybe there is a place where such topics are described and explained in more affordable structured way.  any ideas , hints K.   ... View more

Still it find me difficult to understand logic of joining two indexes. Below the query which is almost suits my needs ... ALMOST index="odp" OR index="oap" txt2="ibum_p" | rename e as c_e | eval c_e = mvindex(split(c_e, ","), 0) | stats values(*) by c_e line 1 - two indexes joined and one of them filtered ( to create OneToOne relation). line 2&3 - rename and modification of key column in second index to make it identical as in the first index line 4 - show all columns Result contains 400 records - same as each index separately. But result shows only columns from second index . I supposed values(*) means all columns from all indexes. I tried to type each column separately but it does not change anything - still columns from first index are empty - WHY?? If I succeed this milestone 😉  I will start aggregations   Any hints ? ... View more