Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About anooshac
anooshac
Communicator
Member since:
11-26-2019
Thursday
Community Statistics
| Posts | 202 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 1 |
| Member Since | 11-26-2019 |
Activity Feed
- Posted Re: group data by a field and write the output counts in a table on Dashboards & Visualizations. Thursday
- Posted Re: group data by a field and write the output counts in a table on Dashboards & Visualizations. Thursday
- Posted How do I group data by a field and write the output counts in a table? on Dashboards & Visualizations. Wednesday
- Posted Re: if condition does not work with stats values() on Dashboards & Visualizations. a week ago
- Posted Why does if condition not work with stats values()? on Dashboards & Visualizations. a week ago
- Tagged Why does if condition not work with stats values()? on Dashboards & Visualizations. a week ago
- Tagged Why does if condition not work with stats values()? on Dashboards & Visualizations. a week ago
- Posted Re: Extract key value pairs from json file using regex on Splunk Search. a week ago
- Karma Re: Extract key value pairs from json file using regex for ITWhisperer. a week ago
- Posted Re: Extract key value pairs from json file using regex on Splunk Search. a week ago
- Posted Re: Extract key value pairs from json file using regex on Splunk Search. 2 weeks ago
- Posted How do I extract key value pairs from json file using regex? on Splunk Search. 2 weeks ago
- Tagged How do I extract key value pairs from json file using regex? on Splunk Search. 2 weeks ago
- Posted Re: stats(max) is not giving correct results. on Splunk Search. 2 weeks ago
- Posted Re: stats(max) is not giving correct results. on Splunk Search. 3 weeks ago
- Posted Re: stats(max) is not giving correct results. on Splunk Search. 3 weeks ago
- Posted Re: stats(max) is not giving correct results. on Splunk Search. a month ago
- Posted Re: stats(max) is not giving correct results. on Splunk Search. a month ago
- Posted Re: stats(max) is not giving correct results. on Splunk Search. a month ago
- Posted Re: stats(max) is not giving correct results. on Splunk Search. a month ago
Thursday
I tried like this too.. But in the when "SUCCESS" or "FAILURE" is zero the Total_Tasks column and the respective column which has zero value is shown empty. Zero is not considered and shown as empty. While doing the same for all groups they are coming proper. I want this to be for particular group.
... View more
Wednesday
I have data in json format like this.
"Task_no":"5",
"Group": "G1",
"EXECUTION_DATE":1648081994535,
"STATUS":"FAILURE",
"DURATION":1951628
I want to produce a table which has Group Total_tasks SUCCESS FAILURE as fields. I tried the query like this.
index..... Group=G1| chart count(Task_No) by STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks SUCCESS FAILURE
Its showing as no results found. But when i run the same query for all the group that is,
index..... | chart count(Task_No) by Group STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks SUCCESS FAILURE
this query gives the required fields, but i want the table to be created for particular Group. Can anyone please help me to achieve this?
... View more
a week ago
Hi, @somesoni2 , the data is in json format. Here is one example. "Task_no":"5",
"Group": "G1",
"EXECUTION_DATE":1648081994535,
"STATUS":"FAILURE",
"DURATION":1951628 and the data im calculating is MTTR. .........[| streamstats count as start reset_on_change=true by STATUS
| where start=1
| streamstats count(eval(STATUS=="FAILURE")) as fails by STATUS
| eval fails=if(fails=0,null(),fails)
| filldown fails
| stats list(*) as * by fails| where mvcount(STATUS) = 2|eval MTTR=....]
|append[.....| chart count(Task_no) by Group STATUS
| table Group SUCCESS FAILURE]
| stats values(eval(if('FAILURE'=="0",0,MTTR))) as MTTR Whenever there is no failures i want to make the MTTR as 0, if there are failures MTTR will be calculated by the query and i want to keep that result as it is. While using stats i am not able to achieve this condition. Where i went wrong in the query? Can you please help me.
... View more
a week ago
Hi all, I have been trying to use if condition in stats values(). It is not working properly. I have used if conditions before and got results perfectly.
stats values(eval(if('FAILS'=="0",0,DATA))) as DATA
The fields "DATA" is calculated in the beginning. My requirement is that when there are no FAILS the DATA should be zero otherwise it should be the value which is calculated. I am doing anything wrong here? Because even if the FAILS are there it is giving me result as 0. Please help me.
... View more
a week ago
Okay.. Thanks alot for the information. There are some values like below. "x,y":"32.064453125 this will be extracted as x and y as key and values. How can i extract "x,y" as a key?
... View more
2 weeks ago
Thank you so much it is working.. Is it mandatory to use spath while using regex? Also some of the keys have comma because of key is splitting, how can i avoid this? How to escape comma present in key?
... View more
2 weeks ago
Hi all, I have a sample json file like this.
{
"Project Name" : "abc",
"Project Group":"A",
"Unit":"B",
"groups_data":[{
"a":"32.064453125",
"b":"5.451171875",
"c":"0.3349609375",
"d":"0.181640625",
"e":"4.58203125",
"f":"81.1611328125"}]
}
I want to plot a pie chart for the key value pairs present in the groups_data. I tried extracting the data using this query.
myindex sourcetype="_json"| rex field=_raw "\"group_data\":\[\{\"(?<component>[^/]*)\":"\"(?<Value>\d+)\"\}\]| eval tmp = mvzip(component,Value) |mvexpand tmp |eval component=mvindex(split(tmp,","),0) |eval Value=mvindex(split(tmp,","),1)|chart values(Value) by component
I am not able to pie chart. It says tmp does not exist.Can anyone tell me is there anything wrong in the regex part? Something i missed anywhere?
... View more
2 weeks ago
I have a big query where i calculate different data and join them into a table. When i changed the sort commands position i was able to get the required results. I am not sure how was this possible and how a sort command can impact the result.
... View more
3 weeks ago
Hi @PickleRick , Thanks for the help. I was able to solve the problem. This was becuase of the sort command. The | sort Group command was in the beginning of the query , i placed it at the end and the stats max() was giving correct values. I don't know how the sort was affecting the values.
... View more
3 weeks ago
Hi @ITWhisperer , Thanks for the help. I was able to solve the problem. This was becuase of the sort command. The | sort Group command was in the beginning of the query , i placed it at the end and the stats max() was giving correct values. I don't know how the sort was affecting the values.
... View more
a month ago
This is the result in which i have printed group and Task_no. Yes, it is treated as string. Is there any solution apart from tostring(Task_no)?
... View more
a month ago
This is returned as max This should have been the max. 5 is returned as max but the correct value should be 23.
... View more
a month ago
myindex| eval Task_no=tonumber(Task_no)|eventstats max(Task_no) as max_task by Group|where Task_no=max_task|table Group,max_task,EXECUTION_DATE,STATUS|sort Group This is the query i am using. For some of the Groups max values comes properly. But for some it is not considering the maximum number.
... View more
a month ago
{ "Task_no":"5", "Group": "G1", "EXECUTION_DATE": 1648081994535 , "STATUS":"FAILURE", "DURATION": 1951628 , "PARTS":[ { "NAME":"abc", "PART_NO":[ "2634702", "2634456","2634890",] }, { "NAME":"xyz", "PART_NO":[ "2634702", ] }, ] } My events are in json format like this.
... View more
a month ago
Hi all,
I have a set of data and i used stats(max) to get the maximum task number of every group. But the maximum number are not proper for most of the groups. I used the following query,
| stats max(task_no) as "Latest Task " by group
Can anyone tell is there anything should i add to get the maximum value?
... View more
07-06-2022
06:23 AM
I want to get the chart for 2 data . If i use count by will i be able to get the data for 2 charts? I used | timechart span=1d distinct_count(NUM), count(NAME{}.PART_NO{}) I used the solution you provided but the count is still not matching with the data i uploaded. The reeating values are not being considered. How to consider the repeating values for the count?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
