I have been editing the following query in order to get the duration for workload.....how ever while creating the visualization we only see duration of the bar chart......i am looking to see if we can get something with regards to the workload and/0r Jobname. | inputlookup cyclestarttimes.csv | lookup cycleendtimes.csv CYCLE WORKLOAD | search WORKLOAD=F91 | where isnotnull(ENDTIME) | eval STARTC = "2021-08-19" | eval ENDC = "2021-08-20" | eval STARTC = strptime(STARTC, "%Y-%m-%d") | eval ENDC = strptime(ENDC, "%Y-%m-%d") | eval CYCLEC = strptime(CYCLE, "%Y-%m-%d") | where CYCLEC >= STARTC AND CYCLEC <= ENDC | stats values(STARTTIME) as START values(ENDTIME) as STOP by WORKLOAD CYCLE | eval _time = strptime(START, "%Y-%m-%d %H:%M:%S") | eval end_time = strptime(STOP, "%Y-%m-%d %H:%M:%S") | eval duration = (end_time - _time) * 1000 | eval JOBNAME = WORKLOAD | stats count by _time,duration, WORKLOAD, JOBNAME | table _time WORKLOAD JOBNAME duration ... View more

Hello,  This is the query that I am working on. Its showing multiple time entries. How do we get it to filter down to single entry? (index=xyz source=abc) SMF30JBN=MC2DC03D SMF30JNM=JOB* SMF30STP=5 | table DATETIME SMF30JBN SMF30STP SMF30JNM SMF30STM   Thank you, Chinmay. ... View more

Hello, I am looking for a simple query that would provide me the completion percentage of the data migration from On-prem environment to Cloud. Please see the example below.    ... View more

I wish to generate the results for month of September. I am currently using the following query, however if i set the date range it doesnt generate results for September. We still see the data for October.    index=XYZ source=XYZ (SMF30JBN=F*DC03D OR SMF30JBN=M*DC03D) (SMF30STP=1 OR (SMF30STP=4 AND SMF30STM=DOWNS020)) SMF30JNM=JOB* earliest=@d-48h latest=@d+6h | eval ACTUAL_START = case(SMF30STP=1,DATETIME) | eval ACTUAL_END = case(SMF30STP=4,DATETIME) | stats values(ACTUAL_START) as ACTUAL_START values(ACTUAL_END) as ACTUAL_END by SMF30JNM SMF30JBN | rename SMF30JBN as JOBNAME | eval CYCLE = relative_time(now(),"@d-720m") | eval WEEKDAY=strftime(CYCLE,"%A") | eval CYCLE = strftime(CYCLE, "%Y-%m-%d %H:%M:%S.%2N") | eval MONTH = substr(CYCLE,6,2) | eval DAY = substr(CYCLE,9,2) | eval YEAR = substr(CYCLE,1,4) | eval DATE = substr(CYCLE,1,10) | lookup workloadinfo.csv JOBNAME output WEEK_START WEEK_END WEEK_RT SAT_START SAT_END SAT_RT SYS STATES | eval WEEK_START = case(WEEK_START="SLA0600",relative_time(now(),"@d-1080m"),WEEK_START="SLA0700",relative_time(now(),"@d-1020m"),WEEK_START="SLA1300",relative_time(now(),"@d-660m"),WEEK_START="SLA1400",relative_time(now(),"@d-600m"),WEEK_START="SLA1430",relative_time(now(),"@d-570m"),WEEK_START="SLA1600",relative_time(now(),"@d-480m"),WEEK_START="SLA1700",relative_time(now(),"@d-420m"),WEEK_START="SLA1730",relative_time(now(),"@d-390m"),WEEK_START="SLA1800",relative_time(now(),"@d-360m"),WEEK_START="SLA1830",relative_time(now(),"@d-330m"),WEEK_START="SLA1900",relative_time(now(),"@d-300m"),WEEK_START="SLA1930",relative_time(now(),"@d-270m"),WEEK_START="SLA2000",relative_time(now(),"@d-240m"),WEEK_START="SLA2100",relative_time(now(),"@d-180m"),WEEK_START="SLA2200",relative_time(now(),"@d-120m")) | eval WEEK_END = case(WEEK_END="SLA0600",relative_time(now(),"@d-1080m"),WEEK_END="SLA0700",relative_time(now(),"@d-1020m"),WEEK_END="SLA1300",relative_time(now(),"@d-660m"),WEEK_END="SLA1400",relative_time(now(),"@d-600m"),WEEK_END="SLA1430",relative_time(now(),"@d-570m"),WEEK_END="SLA1600",relative_time(now(),"@d-480m"),WEEK_END="SLA1700",relative_time(now(),"@d-420m"),WEEK_END="SLA1730",relative_time(now(),"@d-390m"),WEEK_END="SLA1800",relative_time(now(),"@d-360m"),WEEK_END="SLA1830",relative_time(now(),"@d-330m"),WEEK_END="SLA1900",relative_time(now(),"@d-300m"),WEEK_END="SLA1930",relative_time(now(),"@d-270m"),WEEK_END="SLA2000",relative_time(now(),"@d-240m"),WEEK_END="SLA2100",relative_time(now(),"@d-180m"),WEEK_END="SLA2200",relative_time(now(),"@d-120m")) | eval SAT_START = case(SAT_START="SLA0600",relative_time(now(),"@d-1080m"),SAT_START="SLA0700",relative_time(now(),"@d-1020m"),SAT_START="SLA1300",relative_time(now(),"@d-660m"),SAT_START="SLA1400",relative_time(now(),"@d-600m"),SAT_START="SLA1430",relative_time(now(),"@d-570m"),SAT_START="SLA1600",relative_time(now(),"@d-480m"),SAT_START="SLA1700",relative_time(now(),"@d-420m"),SAT_START="SLA1730",relative_time(now(),"@d-390m"),SAT_START="SLA1800",relative_time(now(),"@d-360m"),SAT_START="SLA1830",relative_time(now(),"@d-330m"),SAT_START="SLA1900",relative_time(now(),"@d-300m"),SAT_START="SLA1930",relative_time(now(),"@d-270m"),SAT_START="SLA2000",relative_time(now(),"@d-240m"),SAT_START="SLA2100",relative_time(now(),"@d-180m"),SAT_START="SLA2200",relative_time(now(),"@d-120m")) | eval SAT_END = case(SAT_END="SLA0600",relative_time(now(),"@d-1080m"),SAT_END="SLA0700",relative_time(now(),"@d-1020m"),SAT_END="SLA1300",relative_time(now(),"@d-660m"),SAT_END="SLA1400",relative_time(now(),"@d-600m"),SAT_END="SLA1430",relative_time(now(),"@d-570m"),SAT_END="SLA1600",relative_time(now(),"@d-480m"),SAT_END="SLA1700",relative_time(now(),"@d-420m"),SAT_END="SLA1730",relative_time(now(),"@d-390m"),SAT_END="SLA1800",relative_time(now(),"@d-360m"),SAT_END="SLA1830",relative_time(now(),"@d-330m"),SAT_END="SLA1900",relative_time(now(),"@d-300m"),SAT_END="SLA1930",relative_time(now(),"@d-270m"),SAT_END="SLA2000",relative_time(now(),"@d-240m"),SAT_END="SLA2100",relative_time(now(),"@d-180m"),SAT_END="SLA2200",relative_time(now(),"@d-120m")) | eval EXP_START = if(WEEKDAY="Saturday" OR WEEKDAY="Sunday",SAT_START,WEEK_START) | eval EXP_END = if(WEEKDAY="Saturday" OR WEEKDAY="Sunday",SAT_END,WEEK_END) | eval RUNTIME = if(WEEKDAY="Saturday" OR WEEKDAY="Sunday",SAT_RT,WEEK_RT) | eval ACTUAL_START = strptime(ACTUAL_START, "%Y-%m-%d %H:%M:%S.%2N") | eval ACTUAL_END = strptime(ACTUAL_END, "%Y-%m-%d %H:%M:%S.%2N") | eval STARTC = case(ACTUAL_START < EXP_START AND ACTUAL_END > EXP_START, EXP_START,ACTUAL_START > EXP_START,ACTUAL_START,(ACTUAL_START < EXP_START AND ACTUAL_END < EXP_START),null(),(ACTUAL_START > EXP_END AND ACTUAL_END > EXP_END),null()) | eval ENDC = case(ACTUAL_END > EXP_END AND ACTUAL_START < EXP_END, EXP_END, ACTUAL_END < EXP_END,ACTUAL_END,(ACTUAL_START < EXP_START AND ACTUAL_END < EXP_START),null(),(ACTUAL_START > EXP_END AND ACTUAL_END > EXP_END),null()) | eval DURATION =(ENDC-STARTC)/60 | eval ACTUAL_START = strftime(ACTUAL_START, "%Y-%m-%d %H:%M:%S.%2N") | eval ACTUAL_END = strftime(ACTUAL_END, "%Y-%m-%d %H:%M:%S.%2N") | eval EXP_START = strftime(EXP_START, "%Y-%m-%d %H:%M:%S.%2N") | eval EXP_END = strftime(EXP_END, "%Y-%m-%d %H:%M:%S.%2N") | eval STARTC = strftime(STARTC, "%Y-%m-%d %H:%M:%S.%2N") | eval ENDC = strftime(ENDC, "%Y-%m-%d %H:%M:%S.%2N") | eval DURATION =if(DURATION < 0,0,DURATION) | eval DURATION = round(DURATION,2) | stats values(ACTUAL_START) as ACTUALSTART values(ACTUAL_END) as ACTUALEND values(EXP_START) as EXPSTART values(EXP_END) as EXPEND latest(STARTC) as CALCSTART latest(ENDC) as CALCEND sum(DURATION) as AVAILABILITY values(RUNTIME) as EXPRUNTIME values(WEEKDAY) as WEEKDAY values(MONTH) as MONTH values(DATE) as DATE values(SYS) as TYPE values(STATES) as CONTRACTOR values(YEAR) as YEAR values(DAY) as DAY by JOBNAME | eval DOWNTIME = round(abs(AVAILABILITY - EXPRUNTIME),2) | eval SLA_PERC = round(((AVAILABILITY / EXPRUNTIME) * 100),2) | eval AVAILABILITY = if(SLA_PERC > 100, ((AVAILABILITY)-(EXPRUNTIME)), AVAILABILITY) | eval SLA_PERC = if(SLA_PERC > 100, ((SLA_PERC)-100), SLA_PERC) | eval WORKLOAD = substr(JOBNAME, 1, 3) | fields * ... View more

I have worked on a query in order to generate a report that gives us the monthly visits and bandwidth used etc. I have listed the query below. It gives the results in the splunk environment. But when we generate a PDF document we see the error listed below the query, after the results table. I would appreciate suggestions to resolve this issue. |rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)" |rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)" |rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)" |timechart span=1mon@mon dc(reqip) as "Unique Visitors", dc(uri) as Pages, sum(bytes) as Bandwidth(KB), count(uri) as Hits |eval Bandwidth(KB) = round('Bandwidth(KB)'/1024,2) |append [search index="med" sourcetype="med:httpaccess:log" *med.cms.gov* |rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)" |rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)" |rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)" |bin span=1mon@mon _time |stats count(uri) as viewed by _time, reqip |stats sum(viewed) as "Number of Visits" by _time] |stats values(*) as * by _time |fillnull |addcoltotals label="Total" labelfield="_time" |table _time "Unique Visitors" "Number of Visits" Pages Hits Bandwidth(KB) The expected result is        ... View more