Hi 🙂 I can successfully connect to a MSSQL DB and run adhoc SQL queries on it from within DB Connect, but when I try to schedule an Input "Tail" (or Dump) it fails with the following error in the dbx.log :- 2014-03-26 08:37:44.776 monsch26:ERROR:Scheduler - Error while reading stanza=[dbmon-tail://Foo_Bar/Foo_Bar_TblBets]: com.splunk.config.SplunkConfigurationException: Error instantiating output format kv: java.lang.IllegalArgumentException: Illegal pattern character 'N' I have tried using kv and csv for the Output Format but I still get the same error. Here are the settings in inputs.conf :- [dbmon-tail://Foo_Bar/Foo_Bar_TblBets] host = Foo index = test interval = 5m output.format = kv output.timestamp = 1 output.timestamp.column = BetDate query = select Top 100 BetDate, BetID, ExternalBetID, Settled, ExternalClientID, AmountToWIn from TblBets (NOLOCK) Where ExternalBetID Is Not Null And Channel = 200 {{And $rising_column$ > ?}}\r\n sourcetype = sqltest tail.rising.column = BetID table = Foo_Bar_TblBets output.timestamp.format = %s.%3N disabled = 0 Example output from dbquery: BetID BetDate ExternalBetID Settled ExternalClientID AmountToWIn 1 983738389 1341334616.453 67650588 true XYZ 4.0000 2 983915715 1341397843.650 67662499 true XYZ 10.0000 Thanks in advance, Luke 🙂 ... View more

Hi 🙂 I have a search that calculates the Bounce Rate for a web site: source="web" configuration.client.company=foo event.type=page_view | stats dc(event.id) as eid_dc, c(event.id) as eid_c by session.id | addcoltotals | eval BounceRate=eid_dc/eid_c | stats last(BounceRate) as BounceRate At a high level, it calculates the BounceRate by dividing the total number of distinct urls (ie. eid_dc) by the total number of urls (ie. eid_c) by Visit (ie. session.id) I would like the ability to plot the BounceRate over time, but I can't get timechart to do the needful... any help will be greatly appreciated 🙂 Luke. ... View more

Hi 🙂 I am trying to setup some exception reports for our capacity planners and I can construct a search that generates a table, eg. _time is_match count 1 25/10/2013 00:00:00.000 Breach 1 2 26/10/2013 00:00:00.000 Breach 1 3 27/10/2013 00:00:00.000 Breach 1 4 22/10/2013 00:00:00.000 Prediction 1 5 23/10/2013 00:00:00.000 Prediction 1 What I ultimately want is a count of "Breach" and the first time that "Prediction" occurred, eg. Count Time 3 22/10/2013 00:00:00.000 is this possible with just one stats command? Thanks in advance, Luke. ... View more

Hi 🙂 I have a chart with one line for Usage (span=1d) and another line for 95th_Percentile (span=30d) but I am using "append" with "makecontinuous _time" - there has gotta be a better way... Any help would be greatly appreciated 🙂 index=summary_blah report="CDN1" | addtotals *Octets* | fields + Total | timechart span=1d max(Total) as Usage | append [search index=summary_blah report="CDN1" | addtotals *Octets* | fields + Total | timechart span=30d perc95(Total) as 95th_Percentile] | eval Licence_Limit=96 | makecontinuous _time Thanks in advance, Luke 🙂 ... View more