If I run the following search for the previous month, the number of days that appears next to Sunday is 8? If I look at the data, I do only see 5 different dates in the events, yet 8 different dates appear in the Time column. For example, an event with the time "20150830 21:47:17" shows "8/31/15 12:00:00.000 AM" in the time column, whereas an event with the time "20150830 22:01:39" shows "8/30/15 12:00:00.000 AM" in the Time column. source="c:\\logs\\aaaa" | transaction bbbb startswith=("CCCC STARTED") endswith=("CCCC ENDED") | bin span=1d _time | stats count dc(_time) as days by date_wday | eval average_count = count / days ... View more

Am doing the following trying to get the average number of transactions by hour by day: | bucket _time span=1h | stats avg(count) AS "Average Transaction Count" by date_hour, date_wday By leaving out "avg", I can get the total count of transactions by hour by day, but I would just like to get the average of them. ... View more

I have the following in a search | timechart span=1h max(CPU%) AS "CPU", max(Memory%) as "MEM" by host If the number of hosts is 10 or fewer, it works as expected. If there are 11 hosts, the hostname is shown as "OTHER." Is this a built in limit? If so, can this limit be extended? ... View more

I have the following search: | metadata type=hosts | eval since=now()-lastTime | rename firstTime as "First Time", lastTime as "Last Event", recentTime as "Last Update" | fieldformat First Time=strftime('First Time', "%c") | fieldformat Last Event=strftime('Last Event', "%c") | fieldformat Last Update=strftime('Last Update', "%c") which formats the times correctly when executed in a search, but does not format the times at all when in the body of an alert email: In alert: First Time Last Event Last Update host since totalCount type 1423978950 1425327716 1425327717 Hostname1 243484 13437 hosts 1423257448 1425414744 1425414744 Hostname2 156456 2049 hosts 1423978463 1423978495 1423978835 Hostname3 1592705 14 hosts In search: Sun Feb 15 00:42:30 2015 Mon Mar 2 15:21:56 2015 Mon Mar 2 15:21:57 2015 Hostname1 249510 13437 hosts Fri Feb 6 16:17:28 2015 Tue Mar 3 15:32:24 2015 Tue Mar 3 15:32:24 2015 Hostname2 162482 2049 hosts Sun Feb 15 00:34:23 2015 Sun Feb 15 00:34:55 2015 Sun Feb 15 00:40:35 2015 Hostname3 1598731 14 hosts Any idea how to format the times in an alert email? ... View more

I have a dashboard which displays a timechart with a one hour span. When the user clicks on the timechart I am using a drilldown and passing the time as follows: $click.value$ If I then display that time_tok as follows: I get a value that looks like: 1423584000.000 which is all well and good. I'm not formatting anything yet. Now that the user has clicked on a point representing a one hour span, I would like to show a timechart starting 30 minutes before that point and ending 30 minutes after. I can't find any syntax that works. namely: index=perfmon earliest=$time_tok$ | table a_formated_time, host, etc, etc, Is there a way to subtract 30 minutes from $time_tok$ such as $time_tok$-30m or $time_tok$-1800? Then I could do something similar for latest. ... View more

I used the deployment monitor to create a new server class and added 11 servers to it. I created an app that just targets a couple of windows performance items. However, I only get data from 4 of the 11 forwarders. When I look at the server class in the deployment monitor it shows all 11 servers, however on the 7 from which I am getting no data the client name just shows "deploymentClient" whereas on the others there are identifiers such as "C9D11F05-A6AF-4DFC-B003-58174CB478A6" I don't seem to be able to see anything different between the servers from which I am getting data from the servers from which I am not getting data. Any ideas? ... View more