Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cglowjr
cglowjr
New Member
Member since:
02-20-2020
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-20-2020 |
Activity Feed
- Posted Re: Chart by hour using multiple fields on Splunk Search. 05-12-2020 12:56 PM
- Posted Re: Chart by hour using multiple fields on Splunk Search. 05-12-2020 08:22 AM
- Posted Re: Chart by hour using multiple fields on Splunk Search. 05-11-2020 12:47 PM
- Posted Chart by hour using multiple fields on Splunk Search. 05-11-2020 09:55 AM
- Tagged Chart by hour using multiple fields on Splunk Search. 05-11-2020 09:55 AM
- Tagged Chart by hour using multiple fields on Splunk Search. 05-11-2020 09:55 AM
- Posted Re: Eval Time_Diff on Splunk Search. 02-24-2020 02:58 PM
- Posted Re: Eval Time_Diff on Splunk Search. 02-24-2020 01:23 PM
- Posted Eval Time_Diff on Splunk Search. 02-24-2020 10:01 AM
- Tagged Eval Time_Diff on Splunk Search. 02-24-2020 10:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-12-2020
08:22 AM
Thank you for the help. I am receiving an error message of
Error in 'eval' command: The 'mvexpand' function is unsupported or undefined.
... View more
05-11-2020
12:47 PM
I am trying to use the same query, but use the chart function to show the data by hour and consoleID (consoleID consists of AUTO and MANUAL)
This is what it looks like now.
pedestalName AUTO MANUAL total autogate%
21 256 31 287 89.20
22 270 29 299 90.30
23 242 37 279 86.74
24 231 34 265 87.17
25 281 26 307 91.53
26 269 19 288 93.40
I want it to look like this, with the hour extending throughout the day... 0700, 0800, 0900 etc
0700 0800
pedestalName AUTO MANUAL AUTO MANUAL total autogate%
21 256 31 256 52 287 89.20
22 270 29 300 24 299 90.30
23 242 37 301 13 279 86.74
24 231 34 320 26 265 87.17
25 281 26 187 27 307 91.53
26 269 19 186 28 288 93.40
... View more
05-11-2020
09:55 AM
I am having trouble charting some data by hour and consoleID. Below is the search I used. I can use the stats function to count by hour, but it doesn't show well in my dashboard. I am looking to have this same format, but use the field date_hour in the chart count function.
| chart count over pedestalName by date_hour, consoleID ? I know this doesn't work, but in my head this is what should work.
index="sg_log" host=PACSTAPP1 "" "OUTGATE" "COMPLETE" "SMT" NOT "TROUBLE_LANE"
| xmlkv
| eval consoleID=if(consoleID="AUTO","AUTO","MANUAL")
| chart count over pedestalName by consoleID
| eval total=round(AUTO+MANUAL)
| WHERE pedestalName IN ("21","22","23","24","25","26")
| eval autogate%=round(AUTO/(AUTO+MANUAL)*100,2)
... View more
02-24-2020
10:01 AM
I am having trouble getting a result to appear for the below query. I am trying to produce a column showing time_diff of the lastest timestamp result for lane_RFID subtracted from the time now. The table doesn't show a result for time_diff, but everything else shows properly. Hopefully it is something easy. Thank you.
index=*"RFID Message received for:" | stats latest(date_time) by LANE_RFID | eval time_now=now() | eval time_now=strftime(time_now,"%Y/%m/%d %H:%M:%S") | eval time_diff=strftime(time_diff,"%M:%S") | eval time_diff=time_now-date_time| table LANE_RFID time_now latest(date_time) time_diff
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
