About jrnastase

jrnastase · ‎10-15-2018

Hello all, Currently I have acquired a timechart in the format: Field_A / Field_B / Field_C / Field_D / Total //// 10 ///////// 20 ///////// 15 ////////// 5 //////// 50 etc. using the | addtotals command. I would like to somehow change each column to represent a percentage of the total to wind up with something like: Field_A / Field_B / Field_C / Field_D //// 0.2 //////// 0.4 //////// 0.3 ///////// 0.1 Thanks very much. Any help would be greatly appreciated!

jrnastase · ‎08-22-2018

Hello all, I've seen examples of how to find time between events using streamstats , and also to find the time since the most recent event using stats , but how would I accomplish doing both? Ultimately I'm trying to detect a loss of information that's reported every 10 minutes, so I'm using streamstats to search for differences of > 10 min, however this "outage" isn't detected until after the data is reported again, thus giving streamstats two items to actually compare. I need all of these deltas, and also the time since the most recent as occurred. Thanks, and here's some code I have: search | streamstats current=t last(_time) as last_time by field | eval outage= last_time - _time | eval outage=tostring(outage, "duration") | table field _time outage

jrnastase · ‎07-24-2017

Not sure if the most efficient solution but here's what I have so far that seems to work... | eventstats perc01(statistic) as statistic_01p BY Field | where statistic >= statistic_01p | stats avg(statistic), min(statistic) BY Field

jrnastase · ‎07-24-2017

Hello all. I have calculated measures of a given statistic for a variety of values for the field "Link", and I need to keep the top 99% of values for each Link, and then find the average/minimum of what is left over. Any idea how to do that? I tried sorting, then dedup X Link to return the top X values, but the problem is each link has a different number of points. Any help would be greatly appreciated!

jrnastase · ‎07-19-2017

Hello all, I've used the field extractor to pull out the following field, but because the permissions are a little screwy I can't use it. How do I use this search expression with the Rex function to manually pull out what I want? (?=[^P]*(?:"Required Text"|P.*"Required Text"))^(?:[^:\n]*:){7}\s+\w+\s+(?P\d+) Apparently it's not simply rex Field =_raw "(?=[^P]*(?:Port|P.*Port))^(?:[^:\n]*:){7}\s+\w+\s+(?P\d+)" but I'm new to this and not sure! Thanks for any help!

jrnastase · ‎06-15-2017

If it helps, this is what I tried before, but it only works if values exist for logs++ index="index" field = "field" sourcetype="sourcetype" | bucket _time span=1d | stats count by _time | eventstats avg(count) as average stdev(count) as standard_deviation | where count>average+standard_deviation | eventstats count as logs | where count>average+(2*standard_deviation) | eventstats count as logs+ | where count>average+(3*standard_deviation) | eventstats count as logs++

jrnastase · ‎06-15-2017

Hello all! I'm trying to find the number of days that the daily count of my event exceeds the daily mean + standard deviation for a 3-week period. I also need to return the number of days that exceeds the mean + 2 stdevs and mean + 3 stdevs, and keep it all together. Is there an easy way to do this?

Posts	7
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎06-15-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How do I timechart the percentage of a total?

Find Time between events, including current Time.

Keeping highest 99% of values for each field value

How to use the Rex command with text copied from F...

How to generate a search to find the number of day...

How do I timechart the percentage of a total?

Find Time between events, including current Time.

Re: Keeping highest 99% of values for each field v...

Keeping highest 99% of values for each field value

How to use the Rex command with text copied from F...

Re: How to generate a search to find the number of...

How to generate a search to find the number of day...