Followup to previous, the SPL below shows status 'dots' in a chart.  I am prepared to use it if I can't find a pie slice coloring that will work for me. | makeresults | eval dbs = "[{\"entity\":\"I0\",\"instanceCount\":\"0\",\"instanceMax\":\"3\"},{\"entity\":\"I1\",\"instanceCount\":\"1\",\"instanceMax\":\"3\"},{\"entity\":\"I2\",\"instanceCount\":\"2\",\"instanceMax\":\"3\"},{\"entity\":\"I3\",\"instanceCount\":\"3\",\"instanceMax\":\"3\"}]" | spath input=dbs path={} output=dblist | mvexpand dblist | spath input=dblist | eval pct_avail=round(100*instanceCount/instanceMax,1) | eval status=case(pct_avail=100, "🟢", pct_avail>=50, "🟡️", pct_avail>1 , "🟠" ,true(), "🔴") | table _time entity instanceCount instanceMax pct_avail status ... View more

I was batting around the double transpose method with a peer and got a minor variation to work regardless of whether I was throwing the top5 or top40 at it.  And it doesn't muck with the column names.  Given the simplicity, I think I am going to drop the idea of going after a table subsearch following the timechart.   There is no need since the double transpose method is clean and elegant. Thank you for the suggestion and the follow ups. Tim |fields - _span* |transpose |sort - "row 5" ```uses values from the last row (latest time) ``` |transpose header_field="column" 0 |fields - column   ... View more

I re-implemented your solutions and found #2 sorted by name. Your solution #3 does indeed sort by value.  There is a limitation of 9 or less fields/columns due lexical sorting, and the fields now have additional ##_ prepended.  The limitation of 9 or less is significant if you watch a couple of dozen items and rank them. I will accept the answer.  I am thinking there is a simpler subsearch to drive the | table projection of the columns and I will continue to look in that direction.  For now, I will probably save as a macro. Thank you. ... View more

I would rather have a straight search SPL solution, to drive the Trellis layout The proposed solutions I have seen have the effect of sorting the resulting | timechart fields by name rather than by value.  The goal is sort by field value.  I appreciate the attempt so far. ... View more

Have there been any updates on methodologies for extacting multiple metrics in a single mstats call?  I can do the work with a join across _time and dimensions held in common, but after about 2 metrics, the method gets a bit tedious. ... View more

You were absolutely right on the first point. I did drop the minute modifier on the time_window after contorting my example multiple times and not making any progress and as a result made typos. On the second point, below are the example searches and the outputs. Note, I did change the stats to use aggregator avg() instead of latest() from the streamstats. Now changing the aggregator was actually what was needed, solving my own problem, I think. I believe the issue was my use of latest load, 5min load, 15min load was the cause of the problem.  Please validate my thinking. How would getting the below example searches and output to compare or contrast help you enlighten me? <mysearch> | bin span=1m _time | eval load = round(PercentUserTime + PercentSystemTime, 1) | eval host="foo" | streamstats time_window=5m avg(load) as five_min_load by host | streamstats time_window=15m avg(load) as fifteen_min_load by host | timechart span=1m partial=false avg(load) as load avg(five_min_load) as five_min_load avg(fifteen_min_load) as fifteen_min_load by host _time fifteen_min_load: foo five_min_load: foo load: foo 2023-01-16 16:46:00 5.3 5.1 5.5 2023-01-16 16:47:00 5.3 5.5 17.2 <mysearch> | bin span=1m _time | eval load = round(PercentUserTime + PercentSystemTime, 1) | eval host="foo" | streamstats time_window=5m avg(load) as five_min_load by host | streamstats time_window=15m avg(load) as fifteen_min_load by host | stats latest(_time) as _time avg(load) as load avg(five_min_load) as five_min_load avg(fifteen_min_load) as fifteen_min_load by host | table _time host load five_min_load fifteen_min_load _time host load five_min_load fifteen_min_load 2023-01-16 16:55:00 foo 4.9 5.5 5.4   ... View more

I came up with my own resolution.  My initial data is already summarized into neat 10 minute sample buckets.  I set up a similar second summary to just capture just the maximums.  A subsearch on the secondary search gave me the historic data for capacity measurements.  I hope this helps someone else. index=my_summary report=summary_appservice source=summary_appservice | timechart span=10m sum(successful) as successful_transactions earliest=-1d | eval maximum_observed_transactions=[ `comment("Historic Maximum for capacity")` search index=my_summary report=summary_appservice_ceiling earliest=-3y latest=-1m | stats max(successful_transactions) as x | return $x ] | eval capacity = maximum_observed_transactions | eval utilization=successful_transactions/capacity*100   ... View more

Answered 4/5/2019 | lookup dnslookup clientip AS ip OUTPUT clienthost AS host ... View more

Answered in https://answers.splunk.com/answers/717313/how-do-i-do-a-reverse-dns-lookup-in-splunk-1.html ... View more

There has been a lookup dnslookup in splunk for a long time now. name to ip: | lookup dnslookup clienthost AS host OUTPUT clientip as ip ip to name: | lookup dnslookup clientip AS ip OUTPUT clienthost AS host ... View more

Setting window=1 didn't work for me, but current=t did. Thanks much ... View more

Yes, the extraction period is one day. Chart only allows one criterion or 'by' value. The requirement is to provide the highest value of distinct_mac for a given relay agent. I think that the method you offer is the total over all of the relay agents per chart time period ( 1 hour ). Using your method, the max_mac is identical over all of the relay_agents. I think I might be confused ... View more

Brute force, but simple.. I like the method. It reminds me of what I did in other programming languages. Tim ... View more

While sundareshr provided exactly what I asked for, unfortunately, I need something with higher performance. I believe that I will need to do something with summary indexes in order to complete in a reasonable time frame. None the less, I will accept this answer and rephrase / re-pose the question. Tim ... View more

I think this was what i was looking for. Why didn't I think of it "| chart count over subnet by time " is just what I was looking for. I will try it out, make a few modifications and likely accept this answer. Thanks, Tim ... View more

The aim was to count or chart over time. subnet, 0-30days, 31-60days, 61-90days, ... View more