About DamianS

DamianS · ‎11-30-2012

Be aware that due to relativistic effects there are sync issues between Satellites and the surface of the Earth if you care about small time internals. This is a common issue with writing software for Satellites though, so well researched and documented.

DamianS · ‎11-23-2012

Another way I've found of doing it if you always have more than 1 login per hour during the day is: foo earliest=@w0 | transaction sesid keeporphans=true maxspan=13h | concurrency duration=duration | timechart max(concurrency) span=1h

DamianS · ‎11-22-2012

Right, I've been working on this again and I think I have something which works really well now: foo earliest=@w0 | transaction sesid | eval countlogin=1 | append [ search foo earliest=@w0 | transaction sesid | eval countlogin=-1 | eval _time=_time+duration ] | stats sum(countlogin) AS countlogin by _time | streamstats sum(countlogin) AS runningtotal | eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S") | fields _time, runningtotal It creates a 1 when a session starts, a -1 when a session ends and then cumulatively sums them over time. You still have to fairly confident that when the query starts there are no open sessions ( I can do that with my tool at the beginning of the week ). Please ignore all of the below, it was my previous attempt and there are several things wrong with it By the way, this is the closest I got: foo earliest=@w0 | transaction sesid keeporphans=true maxspan=13h | concurrency duration=duration | chart max(concurrency) by _time this produces a nice little graph, there are 2 problems with it, 1 is that it's only very accurate if the start point you know there are 0 open sessions and secondly is that the graph never actually shows there being 0 open sessions. Neither of these 2 problems were too much of an issue as I just needed to show off shiny graphs to management.

DamianS · ‎11-22-2012

Thanks, this helped a little, following through and I ended up finding several bugs in our application I'm getting the dev team to look over it, haha

DamianS · ‎10-16-2012

Hi all, I have login and logout events and I'm trying to plot a graph showing the number of open sessions each minute, my search looks something like this at the moment: msg="Login" OR msg="Logout" | transaction sesid maxevents=2 maxspan=25h | where duration > 0 Is there any way to timechart the number of transactions that span each minute, so I should see a graph showing how many sessions are open at a given time? At the moment I am having to export to excel with a list of each minute in the time span in one column and with an "Open Sessions" column adding 1 for each login and subtracting 1 for each logout, then graphing this against time.

DamianS · ‎10-16-2012

Perfect! Thanks for your help!

DamianS · ‎10-15-2012

Hi all, I have a search that looks something like this: foo | extract pairdelim="|;]}" kvdelim="=:" mv_add=true | eval legs=mvcount(Leg)+1 | stats count by id, legs The multi value field "Leg" has one of the 3 possible values "", "2", "2 3". I expected mvcount to work like count and when there are no values to display 0. Is there a way to display what I would I expect? Explicitly the mapping I wanted to do was from the multi value field "Leg": No Value -> 1, "2" -> 2, "2 3" -> 3 Any idea?

DamianS · ‎08-13-2012

Actually much quicker to get what I was looking for than I expected using this site to test my regex http://gskinner.com/RegExr/ Thanks again!

DamianS · ‎08-13-2012

Thanks, I'd tried this but I don't currently have the PERL refex skills to work this out, guess it's time to drastically improve these skills.

DamianS · ‎08-13-2012

Hi all, I have 2 different log file types, 1 of which I currently need to add fields in search time and the other already has them generated. I don't currently have permissions to change this. In my head the search looks something like: ( log_type="log1" | rex field=_raw "PERL FOO to create FIELD1" ) OR ( log_type="log2" ) FIELD1 exists in both log1 and log2 but uses different regex to produce this, in log2 splunk already extracts it. But Splunk doesn't let me put parenthesis around these pipe things. Any suggestions on how I just get the "rex" to apply to log1 but search on log1 and log2? Thanks in advance.

Posts	10
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎08-13-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Is there a way to timechat the number of open sess...

How do I get mvcount to display 0 when no field ex...

Adding rex to only part of search

Re: Can Index on Satellite stay In sync with Inde...

Re: Is there a way to timechat the number of open ...

Re: Is there a way to timechat the number of open ...

Re: Is there a way to timechat the number of open ...

Is there a way to timechat the number of open sess...

Re: How do I get mvcount to display 0 when no fiel...

How do I get mvcount to display 0 when no field ex...

Re: Adding rex to only part of search

Re: Adding rex to only part of search

Adding rex to only part of search