OK, I know you didn't want to show the search itself but I think we'll need to see it. The thing is, you can probably do something with binning by _time in one hour chunks to get around your odd time limits. But we can't tell until we see the SPL (and possibly a few lines of the data). Also, what exactly is the importance of 3 minutes and 1 hour? That seems arbitrary, and it feels like an answer that's super-specifically not really what's needed, only what's thought is needed. What actually are you trying to report on? If it's historical, why do you care if it's "reported on once every three minutes". It's also possible (not sure because we don't have the SPL) that you can just do this "continuously" and not worry about not paying attention for 2 minutes 59 seconds at a time. And make the search faster and easier also. Anyway, happy splunking! -Rich ... View more

You are on the correct path, you should avoid using empty sets in any fields unless some very specific use cases. Your evals should be this EVAL-sensor_01 = if(valueName="raw_sensor_01", value, null()) The null() command makes it a null value instead of an empty set. ... View more

Hi again, i pulled the search template from the pivot page and followed the steps of field identification and noticed that i missed a crucial field alias for event identification. Not exactly what i thought would happen, but thanks again for giving the hint. ... View more

Okay, I will report this. I tested this on a different machine, running Splunk 7.1 - same issue. It kind of feels like I'm the first one to ever use the french translation, though... ... View more

thx, worked for me ... View more

You need to modify $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/bin/algos/DBSCAN.py file. In __init__ function replace string out_params = convert_params(options.get('params', {}), floats=['eps']) with this one: out_params = convert_params(options.get('params', {}), floats=['eps', 'min_samples']) After this you can write something like fit DBSCAN eps=0.1 min_samples=2 * in your SPL queries. ... View more

Hi, maybe it's too late, but with ChartView.extend and formatData() you can transform your search result ... View more

Oh, here's another useful item: mvrange(A,B,C) where A, B, and C are numbers or variables that equate to numbers, creates an mv field that starts at A and proceeds by step C until it is greater than or equal to B. C(defaults to 1. For example, mvrange(1,11,2) is equivalent to mvappend(1,3,5,7,9) So, for example, assuming that PowerCurveReal and PowerCurveLimit always have the same number of readings, you could say... | eval readings=mvrange(1,mvcount (PowerCurveReal)) | eval readings=mvzip(readings,mvzip(PowerCurveReal,PowerCurveLimit,"!!!!"),"!!!!") ...and then you would have them all zipped together with a delimiter that won't ever appear in the data, in a way you can turn each composite reading into a single record. ... View more