About dominhthe110

dominhthe110 · ‎08-01-2020

Hi everyone, I have a column chart visualized by this SPL search: index="orders" | eval TimeOfTheDay=case(date_hour>=0 AND date_hour<=6,"Dawn", date_hour>6 AND date_hour<=12,"Morning", date_hour>12 AND date_hour<=18,"Afternoon", date_hour>18 AND date_hour<=23,"Evening") | eval orderedTimeOfTheDay=case(TimeOfTheDay=="Dawn",1,TimeOfTheDay=="Morning",2,TimeOfTheDay=="Afternoon",3,TimeOfTheDay=="Evening",4) | stats count(order_id) as Orders by orderedTimeOfTheDay, TimeOfTheDay | table TimeOfTheDay, Orders And here is the chart visualized: How I can set different colors for each column in the above visualization? Thank you in advance.

dominhthe110 · ‎07-27-2020

Thank @isoutamo , Your answer helped me. It worked. But in a case that I want the result is a negative number between the start and the end day. For example, the duration as days between the "estimated delivered date" and the "actual delivered date" of a shipping package: If the actual date is "2018-04-13 00:00:00" and the estimated one is "2018-04-15 00:00:00", the result will be -2 days. What is the SPL to calculate the outcome for this case?

dominhthe110 · ‎07-27-2020

Hi everyone, I want to calculate the number of days (exclude weekends) between 2 days with the same format of datetime (Ex: 2018-07-21 09:55:51). I followed the solution in the post right here: How do I calculate the date difference for two timestamps other than _time and exclude weekends? and adjusted the answer to fit my data but there was no results returned. So I removed a few lines of code in the solution above to understand the problem: index="orders_csv_local" |eval start=strptime(start_date,"%Y-%m-%d") |eval end= strptime(end_date,"%Y-%m-%d") |eval dates= mvrange(end,start,86400) |table start end dates At this stage, there was no value returned for the third column "dates"? I'm wondering why the 4th line didn't return anything. Please advice me on how to resolve this problem in order to get the final result. Thank you so much in advance.

dominhthe110 · ‎07-25-2020

Thank you a lot. It worked. But I just wonder is there any other ways that I can calculate it step by step not using the avg() function? Assump that the data is indexed so that we don't need the "eval _raw="..." line.

dominhthe110 · ‎07-25-2020

Hi everyone, This is the first time, I've used Splunk. I have the data like this: ORDER_ID PRICE GROUP 00001 10 A 00002 20 B 00003 20 A 00004 15 B 00005 23.3 C And I want to calculate the average price for each group, which returns the result like this: GROUP AVERAGE_PRICE A 15 B 17.5 C 23.3 In order to do this average calculation, I know that I have to calculate the total number of ORDER_ID and the sum of PRICE for each GROUP. But I don't know how to perform this calculation in SPL. Please kindly guild me through this. Regard.

dominhthe110 · ‎03-01-2020

I edited the frozenTimePeriodInSecs and it worked. Thank you.

dominhthe110 · ‎03-01-2020

It worked. Because the data is dated 20 years ago, so to make sure I edited the frozenTimePeriodInSecs attribute in indexes.conf to 662,256,000 (which is 21 years). Thank you very much, nickhillscpl.

dominhthe110 · ‎03-01-2020

Hi nickhillspcl, Thanks for your response. I just checked my index's storage optimization section. The current Tsidx Retention Policy is "Disable Reduction" so I don't think this is the reason causing the problem.

dominhthe110 · ‎02-29-2020

Here is an event: I also defined a sourcetype so Splunk could parse timestamps: [FlightData.csv] BREAK_ONLY_BEFORE_DATE = CHECK_FOR_HEADER = true DATETIME_CONFIG = INDEXED_EXTRACTIONS = csv KV_MODE = none LINE_BREAKER = ([\r\n]+) MAX_DAYS_AGO = -1 NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = FlightDate,CRSDepTime TIME_FORMAT = %Y-%m-%d%H%M category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true

dominhthe110 · ‎02-27-2020

Hi, I used "Add Data: Files and Directories" function to add a 200MB csv file from my hard drive into Splunk Enterprise 8.0.2 (Trial Version, MacOS). In order to do that, I configured it with a custom sourcetype and a custom index called "bigdbook". As the result, the file was uploaded successfully. I checked again by looking in the Settings > Data: Indexes section and saw an increment at the value of the current size column, the value was 124MB. But after I shut down Splunk and started it back on, then I did several searches and found out that the data that I inputted was completely gone as the current size column's value in the indexes section returned to the default value 1MB. So far, I have tried reinstalling Splunk and switching to "Add Data: Monitor" but the problem remains the same. Please help me regarding this.

Posts	10
Solutions	0
Karma Given	12
Karma Received	0
Member Since	‎02-18-2020

Online Status	Offline
Date Last Visited	‎08-03-2020 07:36 AM

Different colors for each column in chart?

Calculate number of days (exclude weekends) betwee...

How to calculate average based on 2 fields and gro...

Data loss after shutdown Splunk

Different colors for each column in chart?

Re: Calculate number of days (exclude weekends) be...

Calculate number of days (exclude weekends) betwee...

Re: How to calculate average based on 2 fields and...

How to calculate average based on 2 fields and gro...

Re: Data loss after shutdown Splunk

Re: Data loss after shutdown Splunk

Re: Data loss after shutdown Splunk

Re: Data loss after shutdown Splunk

Data loss after shutdown Splunk