@simpkins1958 would you mind sharing your httpevent stream code. we are trying to push the code via stream, and we are not able to setup the sourcetype and source. It is taking default values as http-stream-too_small or http-stream? ... View more

this is way how I have handle it | tstats sum(DAC.time_ms) as agent_time_ms FROM datamodel=DataModel_DAC groupby _time|timechart span=10m avg(agent_time_ms) as agent_time_ms let me know if you have questions, though this command will work only when data model is accelerated. ... View more

hhmmm so this solution doesn't work at all, as we are doing this at index time 😞 any other approach, or should i raise to to splunk support team. -Sumit ... View more

This works with some workaround on data model , here is new query | tstats sum(ABC.time) as time FROM datamodel=DataModel_ABC groupby ABC.id,_time|| timechart avg(time) as time by id however, I was using post processing in my dashboard. so now I have to write one direct query in dashboard. second avg time value I am not able to round up, as after this search round function is not working, may be I am missing something eval time=round(time,2) third, I am plotting TPS, but using this model and printing below query doesn't give right information on data model. | eval count=1 | timechart per_second(count) ... View more

Please check my last comment, it is just picking first value, not all. ... View more

I found intersting observation not sure, if that is way how splunk works [apifields_min] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_min::$5 MV_ADD = 1 Not able to parse MV_ADD option, and showing only first occurrence only. [apifields_min1] WRITE_META = true REGEX = (\w+):(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_min::$5 MV_ADD = 1 Not able to parse MV_ADD option, and showing only first occurrence only. Not sure for key=value pair I have to add some special multi param in transform file, so that same pattern can be allowed. -Sumit ... View more

My Bad, I thought indexer has been restarted. but it was not, I have restarted and things are started working as we thought. on slide node, underscore or ., both are working. Sorry about confusion and thanks a lot. -Sumit ... View more

Lisa, I have same issue, from pivot I am not able to plot the timechart graph, though by _time I am able to get require graph. Not Working | pivot DataModel_AccessService perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD AUTO SPLITROW host AS hostname| timechart sum(execTime) Working | pivot DataModel_AccessService perf count(TPS) AS "tps" sum(execTime) AS "execTime" SPLITROW _time AS _time PERIOD AUTO SPLITROW host AS hostname| chart sum(execTime) by _time Thanks, Sumit ... View more

Yes, I did. I am giving configuration too, which I have set. Transform.conf [apifields_total] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1.total::$2 [apifields_avg] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_avg::$3 [apifields_count] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1.count::$4 [apifields_min] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_min::$5 [apifields_max] WRITE_META = true REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_max::$6 props.conf [fdpacq] pulldown_type = 1 TRANSFORMS-apifields = apifields_total,apifields_avg,apifields_count,apifields_min,apifields_max ... View more

We have made change on indexer, and still not able to see any result. sorry to coming late on this, but I don't have access to make this change and has to work with splunk admin team. ... View more

transform [apifields_totaltime] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1.totaltime::$2 SOURCE_KEY = _raw MV_ADD = 1 [apifields_avgtime] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_avgtime::$3 SOURCE_KEY = getDataStack MV_ADD = 1 [apifields_totalno] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_totalno::$4 SOURCE_KEY = getDataStack MV_ADD = 1 [apifields_mintime] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_mintime::$5 SOURCE_KEY = getDataStack MV_ADD = 1 [apifields_maxtime] CLEAN_KEYS = 1 REGEX = (\w+)=(\d+):(\d+):(\d+):(\d+):(\d+) FORMAT = $1_maxtime::$6 SOURCE_KEY = getDataStack MV_ADD = 1 props [fdpacq] REPORT-REPORT-getDataAcq = extractserverStack,apifields_totaltime,apifields_avgtime,apifields_totalno,apifields_mintime,apifields_maxtime ... View more

No success .. I have same configuration, I have multiple of this values in and event I feel somehow, adding to extracted value with string causing issue .. ... View more

I have done above formatting but it is not working as we are expecting. though it is putting value on total,avg,min and max but not with $1. Not sure formatting is concat $1 and string value ?? BTW, my other pattern are working fine where I am assigning the value as $1::$2 ... View more

This time is it not about key and value, We are doing this, but for any API getting this value using key-pair will take long log message. hence we made little effective and producing this in above manner. I am doing below parsing getOAuthToken=(?(getOauth_totalExecTime>\d+):(?(getOauth_avgExecTime>\d+):(?(getOauth_noOfExecutions>\d+):(?(getOauth_minTime>\d+):(?(getOauth_maxTime>\d+) I want a way to effectively use the api name and associate with new key values like. getCall_TotalTime getCall_AvgTime getCall_AvgTime getCall_Occurance getCall_MInTime getCall_MaxTime ... View more