Activity Feed
- Posted Working with loadjob on Reporting. 01-31-2014 06:37 PM
- Tagged Working with loadjob on Reporting. 01-31-2014 06:37 PM
- Posted Re: How can I compare the average of values across all events with specific values in events? on Splunk Search. 01-30-2014 03:00 PM
- Posted appendpipe variable on Splunk Search. 01-30-2014 02:08 PM
- Tagged appendpipe variable on Splunk Search. 01-30-2014 02:08 PM
- Posted Re: How can I compare the average of values across all events with specific values in events? on Splunk Search. 01-30-2014 05:47 AM
- Posted Re: How can I compare the average of values across all events with specific values in events? on Splunk Search. 01-29-2014 10:45 PM
- Posted Re: Hashtable Functionality OR lookup Tables on Splunk Search. 01-29-2014 05:57 PM
- Posted How can I compare the average of values across all events with specific values in events? on Splunk Search. 01-29-2014 05:17 PM
- Tagged How can I compare the average of values across all events with specific values in events? on Splunk Search. 01-29-2014 05:17 PM
- Tagged How can I compare the average of values across all events with specific values in events? on Splunk Search. 01-29-2014 05:17 PM
- Posted Re: Hashtable Functionality OR lookup Tables on Splunk Search. 01-22-2014 05:20 AM
- Posted Re: Hashtable Functionality OR lookup Tables on Splunk Search. 01-22-2014 05:15 AM
- Posted Hashtable Functionality OR lookup Tables on Splunk Search. 01-21-2014 09:46 PM
- Tagged Hashtable Functionality OR lookup Tables on Splunk Search. 01-21-2014 09:46 PM
- Posted behavior of a "*" on Monitoring Splunk. 01-14-2014 12:02 PM
- Tagged behavior of a "*" on Monitoring Splunk. 01-14-2014 12:02 PM
- Tagged behavior of a "*" on Monitoring Splunk. 01-14-2014 12:02 PM
- Posted scheduled update of a lookup file. on Splunk Search. 01-13-2014 10:39 AM
- Tagged scheduled update of a lookup file. on Splunk Search. 01-13-2014 10:39 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 |
01-31-2014
06:37 PM
Hi, I am hoping you can help me here.
I am running a search out of a saved search using the load job.. I did something like :
|loadjob savedsearch="abc:search:my search"
This produces a table of field cols that look like host1#maxpings , host2#maxpings etc.. Where max pings s the maximum pings that the host can have. Under these columns are the daily pingNumbers for these hosts.
something like :
…...
-………… host1#23…………. host2#56.1
day1 ………...3………………………..4
day2 ………..10……………………..11
day3 ………..20……………………….50
I need to find out if the average pings for 3 days is more than the numbering the column name. for example : in the above, I need to find for column1, (3+10+20)/3 < 23 and for column2 (4+11+50)/3 < 56.1 … I should then show only those columns, where the avg number is less than the number in the column…
i want to pseudocode something like |loadjob savedsearch="abc:search:my search" | stats avg(*) as average(*) | where average < substring-after( col-name,'#') . So that this will show only those columns where the average is less than the number in the column.
I am losing hopes on the help from google and splunk docs. Help with this will be highly appreciated.
Thanks in advance.
dT
... View more
- Tags:
- loadjob
01-30-2014
02:08 PM
Hi Guys,
appendpipe [stats avg(*) as *] , adds a new row with the average of all the rows of the respective column.
I wanted to get hold of this average value . So I did appendpipe [stats avg(*) as average(*)] . So that I can use the "average" as a variable . This is all fine. The issue is when i do the appendpipe [stats avg(*) as average(*)] , I get new columns added, with the names average(colname) and the row that existed before , with appendpipe [stats avg(*) as *] gets deleted..
How do I keep the averages row as it is , still be able to use average(*) , so that I can get the average value in a variable? is it possible?
... View more
- Tags:
- appendpipe
01-30-2014
05:47 AM
1) will that time chart give me avg of all seven days? or avg of each day:
2) is my query wrong?
... View more
01-29-2014
10:45 PM
I donna...I will check.. But then thinking about it, if all I want is an average of mb per week , then I could also keep it simple.. and create a new search :
index=_internal source=*license_usage.log
| eval sizemb=b/1024/1024
| avgvolperweek = avg(sizemb)
and run the search for -7d@d to @d
( i was trying to reuse an existing search that produced time chart to also get me average for comparison, but i guess its a bad idea)
... View more
01-29-2014
05:57 PM
This is great. Thanks for this.. although I figured that if I keep the variable name same as the name of the key, then it works straight away . Thanks again
... View more
01-29-2014
05:17 PM
I have the following in my query
index=_internal source=*license_usage.log | eval sizemb=b/1024/1024
timechart span=1d sum(sizemb) by host limit= 10 | appendpipe [stats avg(*) as *]
The last bit as we know adds the last row with the averages of all the days.. Is there a way I can get hold of this average value? someway I can keep this value in the eval variable.. I need this avg of cols to check entry of each day against the average… I need to compare the day1 entry with the average.. Is this possible?
dakT
... View more
- Tags:
- appendpipe
- average
01-22-2014
05:20 AM
i can't do your suggestion because for lookup keyvaluepairs keyfield OUTPUT value to work, there should be a header in csv called keyfield. but csv only has key and value as header. so i was hoping , there could be a solution where i can search for a record in the csv. where key = keyfield. and return Value entry for the corresponding record
... View more
01-22-2014
05:15 AM
i did lookup that syntax in docs.. but my query should do the following :
1. search on the sourcetype: *
2.create an interim variable called keyfield which has the concat of the field1 and field2
3.look up into the CSV ( it has two headings: Key and Value.) for the record, where key = keyfield variable we evaluated.
4. Output the value of the record, where Key = key field.
so the pseudo query, or the query i would have thought, which obviously won't work, is :sourcetype=*|eval keyfield = field1."#'.field2 | lookup kevalpairs.csv [Key=keyfield] OUTPUT val.
... View more
01-21-2014
09:46 PM
Hi All,
I have a lookup table that looks like:
Key,value
cat1,val1
cat2,val2
cat3,val3
this is in a lookup file called keyvalpairs.csv
i want to query the look up table to return value when a key is passed in.
key is a concat of two field values in a search
i want a pseudo query that looks something like,
sourcetype = * | eval keyfield = field1."#'.field2 | lookup keyvalpairs.csv [where Key = **keyfield] OUTPUT value |
so that the concat of field1 and field2 from the events is looked into the CSV and the corresponding value is printed..
is this doable?
... View more
- Tags:
- lookup
01-14-2014
12:02 PM
Hi all,
I wanted to know the behavior of * .
When I do index = * , does it get me all the indexes?
I have the following happening.
When I do index = _* , i get two indexes called _aaaindex and _bbbindex .
but when I do index = * , i do not see these indexes ( _aaaindex and _bbbindex . ) there.. I would have thought index = * is a super set and it will bring everything back? including ( _* )..
... View more
01-13-2014
10:39 AM
Dear Splunkers.
I have a form, where I am loading a drop down, using a lookup file, that searches the top products. I am using.
><![CDATA[|inputlookup top-products.csv]]>
The top-products.csv is a result of outputting the search results of the top products. <!--
index = "ssh" | dedup product | table product | outputlookup products-table.csv
called as Search-Product-->
I then use one of the products selected in the drop down for creating a search string. All works fine. I now need to make sure I always get the correct and updated set of products in the drop down. This probably requires me to run the search " Search-Product" above, regularly like every day, so that I can get the updated results every day..
Is there a way to schedule a search like :
index = "ssh" | dedup product | table product | outputlookup products-table.csv
on a daily basis or hourly basis?
Dak
... View more
01-07-2014
05:11 PM
Hi All,
I have created a lookup table of all the users by piping the search results to output lookup called users.csv.
I would need to now read the csv and populate a drop down… I looked up the resources, and nothing seems to be really working…
I saw the look up files using the manager and I can indeed see the loop up file there.
So my Questions are :
1) Is there a way to see the lookup file that the output lookup created? I mean see the contents of the file?
2) How do I use it to populate the drop down. This file contains only user information and nothing else.
3) is there some other alternate way of doing the same?
... View more
- Tags:
- dropdowns
- lookuptable
01-07-2014
01:10 PM
HI All,
I am new to SPlunk. My colleague who is very experienced in this, had this in his code..
eval runtime="$run.value$"
I searched for the $run.value$ in the code and I couldn't find any. If anyone would please point me to where I can search for this , It will be of great relief. I am guessing this is some env variable, but I am not sure.
Thanks in advance…
dak
... View more
- Tags:
- variable