About Oren

Oren · ‎10-12-2010

I've setup a summary index that works great. I usually use it like this: index=summary search_name="Z - Top Domain - 15 minutes" | top 50 http_domain When I run this query, it gives me three fields - the http_domain, the "count" which is the # of hits of that domain, and the percent of total. I'd like to graph the sum(count) by http_domain. I naively tried this, and of course failed hard. Attempts to use bucket have met with blank stares from the search engine as well. It's clear the data is in there - if I run the query for 1 hour, I get 1 hour of results. Ideally then I could bucket the results each hour or equivalent.

Oren · ‎09-28-2010

I have a simple query: eventtype=request | stats sum(http_bytes) as transfer by http_domain | head 50 | sort -transfer I'd like to summarize this, and pull out transfer apps over time. When I tried with: eventtype=request | sistats sum(http_bytes) as transfer by http_domain | sort -transfer | head 100 This query gives me questionable results: index="summary" search_name="Z - Top App Transfer - 15 minutes" | stats sum(http_bytes) as bytes by http_domain | sort -bytes | eval bytes = tostring(bytes, "commas") | head 50 The reason I'm summing http_bytes in the query is the sistats didn't seem to store the field "transfer". Any obvious things I'm doing wrong?

Oren · ‎09-24-2010

How do I format the output to have comma separators - I want 1,234,567, not 1234567. Any easy way? Given a query like: eventtype=request | sistats sum(http_bytes) as bytes by http_domain | sort -bytes | head 100 I'd like bytes to be more human readable.

Oren · ‎09-07-2010

ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here.

Oren · ‎09-07-2010

From our weblogs, I have extracted fields including http_bytes and http_domain. I would like to get a stacked chart of bandwidth consumed (accum http_bytes) by http_domain. My naive attempts have ended comically. Related, I'd like to see for a given http_domain, I'm looking for two queries: how much bandwidth it used both for the search period, and a timechart for just that app.

Oren · ‎07-14-2010

We have a log line that looks like: Jul 14 15:47:34 127.0.0.1 1 [000004ff000216970000489c] Serv foo.com 158578_40df389_527b/127.0.0.1:10465 2/10 ql=0 rt=49us wait=0ms sok=2ms tot=2ms sv=175ms ut=7us xfr=1093944 I'd like to be able to run a query where I find all entries where the wait is greater than 200ms for example. Splunk is parsing it as a text field right now though. Suggestions on how to get this numeric? I don't care about the units really - the fact that some numbers are milliseconds and some are microseconds doesn't matter in splunk if that helps.

Oren · ‎05-16-2010

I've got weblogs going into splunk. We have a bunch of different domain names (extracted as http_domain) in the logs. Our traffic is variable, and I'd like to find out what the top 10 domains are for each period, ideally with the count of lines for those top 10 as well. the trivial query: nginx | timechart count by http_domain provides what I want for a specified period. I'd like to be able to run this for every day, week, whatever and get the top 10 results for that period, not for the entire run time. Thanks! Oren

Posts	7
Solutions	0
Karma Given	1
Karma Received	3
Member Since	‎05-16-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Graphing or bucketing a summary indexed query

Summary Indexing a stats query

Format results with comma thousands separator

Accum timeseries and grouping

Parsing us and ms times (e.g. q=15ms)

Daily/Weekly/Monthly top traffic report?