Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About RexStout
RexStout
Explorer
Member since:
09-12-2017
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-12-2017 |
Activity Feed
- Posted Re: How can I use my billing info to create a prediction for the future? on Getting Data In. 09-27-2017 09:01 AM
- Posted Re: How can I use my billing info to create a prediction for the future? on Getting Data In. 09-27-2017 06:50 AM
- Posted Re: How can I use my billing info to create a prediction for the future? on Getting Data In. 09-26-2017 12:30 PM
- Posted How can I use my billing info to create a prediction for the future? on Getting Data In. 09-26-2017 05:46 AM
- Tagged How can I use my billing info to create a prediction for the future? on Getting Data In. 09-26-2017 05:46 AM
- Tagged How can I use my billing info to create a prediction for the future? on Getting Data In. 09-26-2017 05:46 AM
- Tagged How can I use my billing info to create a prediction for the future? on Getting Data In. 09-26-2017 05:46 AM
- Posted Re: How do I sum values over time and show it as a graph that I can predict from? on Splunk Search. 09-25-2017 11:34 AM
- Posted Re: How do I sum values over time and show it as a graph that I can predict from? on Splunk Search. 09-25-2017 03:52 AM
- Posted How do I sum values over time and show it as a graph that I can predict from? on Splunk Search. 09-22-2017 06:38 AM
- Tagged How do I sum values over time and show it as a graph that I can predict from? on Splunk Search. 09-22-2017 06:38 AM
- Tagged How do I sum values over time and show it as a graph that I can predict from? on Splunk Search. 09-22-2017 06:38 AM
- Tagged How do I sum values over time and show it as a graph that I can predict from? on Splunk Search. 09-22-2017 06:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
09-27-2017
09:01 AM
As I'm getting my data from an Excel spreadsheet, I took your hint and edited the [raw] data so that my CCYY-MM became CCYY-MM-DD HH:MM:SS:XX.
I can now use, virtually, the same search to get what I want.
Thank you,
Richard aka RexStout
... View more
09-27-2017
06:50 AM
Hmm, I've re-edited the raw data now.....twice.
I suppose I'd have to run the search again for that index...but I'm fairly sure that...
I'd guess it was: dd-mm-ccyy:hh:mm:ss
I used all 12s for the hh:mm:ss so that it slotted into the middle of the day.
The only other option would've been: dd-mm-ccyy.hh:mm:dd
What's the best format for a Splunk timestamp?
Richard aka RexStout
... View more
09-26-2017
12:30 PM
Well, what you're suggesting is exactly what I'd tried but never got it to work. All I got was a sum of the events and a prediction of that too. I was convinced that it was all because I tried to shoe-horn in a fake timestamp.
Back to the drawing board!
Thank you,
Richard aka RexStout.
... View more
09-26-2017
05:46 AM
I've asked about this before and now I've re-loaded the raw data without any modifications. It looks like this (without an actual timestamp):
Month,Billing,MsgType,BillSize,Direction
2013-04,BI70276,ORDHDR,5,SENT
2013-04,BI70276,INVFIL,8,RECV
2013-04,BI70276,ORDHDR,5,SENT
2013-04,BI70276,INVFIL,34,RECV
2013-04,BI70276,ORDHDR,20,SENT
2013-04,BI70276,INVFIL,13,RECV
2013-04,BI70276,ORDHDR,7,SENT
2013-04,BI70276,INVFIL,1,RECV
2013-04,BI70276,ORDHDR,1,SENT
2013-04,BI70276,ORDHDR,5,SENT
2013-04,BI70276,INVFIL,4,RECV
2013-04,BI70276,ORDHDR,6,SENT
2013-04,BI70276,INVFIL,9,RECV
2013-04,BI70276,ORDHDR,12,SENT
2013-04,BI70276,INVFIL,178,RECV.................................etc.
I have this data for every CCYY-MM for the last 53 months, c200k events. So, no actual timestamp for each event.
If I use this:
index=IX Billing=BI70400 MsgType=ORDHDR Direction=SENT | stats sum(BillSize) as MonthSize by Month
...I get the column chart that I expect/want.
How can I use this to create a prediction for the future? We've tried a few variations, based on this, but without success.
Thank you.
... View more
09-25-2017
11:34 AM
Rich,
Thank you for persevering.
Yes, I'm sure it's it's me, my data, and not Splunk; no surprise there.
I, too, have put it down to a timestamp problem and so I'll re-jig my data, re-load it, and start again.
As a parting shot, i can produce exactly what I want for events...but not for Size.
I think I'd better think it out again.
Thank you.
Richard aka RexStout.
... View more
09-25-2017
03:52 AM
Thank you for that, Rich.
As it stands, that still doesn't return anything.
I've got: index=IX Type=ORD | timechart span=1mon sum(Size) as TotalSize
Nothing
Bear in mind that my created timestamp is, for example: 4/1/2013:12:01:03.
Relevant?
But the result of my search shows, for example, _time as 2017-08 and TotalSize as being empty.
... View more
09-22-2017
06:38 AM
How do I sum values over time and show it as a graph that I can predict from?
This is something that I’ve tried to achieve on my own but with limited success. It seems that it should be straightforward too.
I have this type of data going back five years, e.g. 52 months, that I’ve concatenated into one file.
TimeStamp Type Size
4/1/2013:12:01:03 ORD 5
4/1/2013:12:04:11 INV 8
4/1/2013:12:05:21 ORD 5
4/1/2013:12:05:33 INV 34
4/1/2013:12:06:30 ORD 20
4/1/2013:12:06:54 INV 13
4/1/2013:12:07:00 ORD 7
4/1/2013:12:34:44 INV 1
4/1/2013:12:39:32 ORD 1
4/1/2013:12:44:28 ORD 5
4/1/2013:12:49:22 INV 4
4/1/2013:12:50:32 ORD 6
4/1/2013:12:55:30 INV 9
4/1/2013:12:59:29 ORD 12...etc
I want to produce a timechart for the sum of the ‘Size’ for each ‘Type’ over the amount of time I have data for. We only need it by month so I edit the ‘TimeStamp’, in advance, to be ‘M/1/201Y::12:00:00’.
I’d then like to use this histogram to ‘predict’ the next few months. If someone can provide the ‘code’ for doing just one ‘Type’, I’d be most grateful. I have almost 20 ‘Types’. I can manage the predicting part.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
