Hi johan,
thank you for the really fast response.
I think there is something wrong in the default config for this version (2.2.2).
The scheduler portion is missing entirly in the stanzas for these two searches.
Here an extract of the savedsearches.conf.
[Generate pages - scheduled]
alert.digest_mode = 1
search = eventtype=pageview \
[| inputlookup WA_settings \
| fields value \
| dedup value \
| rename value AS site] \
| top limit=100 http_request by site \
| fields site http_request \
| table site http_request \
| outputlookup WA_pages createinapp=t
alert.track = 0
dispatch.earliest_time = -30d
[Generate user sessions - scheduled]
alert.digest_mode = 1
search = | inputlookup WA_sessions \
| appendcols \
[| tstats summariesonly=t max(time) AS _time FROM datamodel= datamodel GROUPBY Web.http_session \
| sort -_time \
| head 1 \
| rename _time AS datamodel_update_time \
| fields datamodel_update_time] \
| appendcols \
[| rest /servicesNS/-/-/data/models splunk_server=local search="acceleration=* eai:acl.app=SplunkAppForWebAnalytics" \
| fields acceleration] \
| append \
[ search eventtype=pageview _index_earliest=-20m@m _index_latest=now site=* \
| eval time=_time \
| eval http_referer = _time."".http_referer \
| eval http_referer_domain = time."".http_referer_domain \
| eval http_referer_hostname = time."".http_referer_hostname \
| fields time time http_referer http_referer_domain http_referer_hostname site clientip http_user_agent http_request \
| transaction site clientip http_user_agent maxpause=30m maxspan=4h keepevicted=f \
| eval user=md5(clientip."".http_user_agent) \
| eval http_session=md5(clientip."".http_user_agent."".time) \
| stats first(site) as site,first(user) as user, first(time) AS http_session_start, last(time) AS http_session_end,count(http_request) AS http_session_pageviews,first(duration) as http_session_duration,first(http_referer) as http_session_referrer,first(http_referer_domain) as http_session_referrer_domain,first(http_referer_hostname) as http_session_referrer_hostname by _time,http_session \
| search user=* \
| eval http_session_referrer=replace(http_session_referrer,"^[0-9.]*","") \
| eval http_session_referrer_domain=if(http_session_referrer="-","-",replace(http_session_referrer_domain,"^[0-9.]_","")) \
| eval http_session_referrer_hostname=if(http_session_referrer="-","-",replace(http_session_referrer_hostname,"^[0-9.]_","")) \
| dedup http_session \
| lookup WA_channels Hostname AS http_session_referrer_hostname OUTPUT Channel AS http_session_channel \
| eval http_session_channel=if(http_session_referrer="-","Direct", if(like(site,"%".http_session_referrer_domain),"Direct", if(isnull(http_session_channel) AND isnotnull(http_session), "Referal", http_session_channel))) ] \
| dedup http_session \
| filldown datamodel_update_time acceleration \
| where \
(_time>=datamodel_update_time AND acceleration=1)\
OR\
(acceleration=1 AND isnull(datamodel_update_time))\
OR\
((_time>relative_time(now(), "-1d@d")) AND (acceleration=0 OR acceleration='' OR isnull(acceleration))) \
| reverse \
| streamstats count \
| where count <1000000 \
| table acceleration,datamodel_update_time,count,_time,site,user,http_session,http_session_start,http_session_end,http_session_pageviews,http_session_duration,http_session_referrer,http_session_referrer_domain,http_session_referrer_hostname http_session_channel \
| outputlookup WA_sessions createinapp=t
Shall I copy and use portions of the savedsearches.config from an older release (v2.1.0) as a workaround?
... View more
