Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tonahoyos
tonahoyos
Explorer
Member since:
10-09-2017
06-05-2020
Community Statistics
| Posts | 37 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 10-09-2017 |
Activity Feed
- Karma Re: How can I run stats sum as command on same search for two different values? for MuS. 06-05-2020 12:49 AM
- Got Karma for Re: How to create an If/Else statement inside an eval statement?. 06-05-2020 12:49 AM
- Posted Re: How to return a number for an if statement on Splunk Search. 06-28-2019 07:13 AM
- Posted Re: How to return a number for an if statement on Splunk Search. 06-28-2019 07:11 AM
- Posted Re: How to return a number for an if statement on Splunk Search. 06-28-2019 06:56 AM
- Posted How to return a number for an if statement on Splunk Search. 06-28-2019 06:37 AM
- Tagged How to return a number for an if statement on Splunk Search. 06-28-2019 06:37 AM
- Tagged How to return a number for an if statement on Splunk Search. 06-28-2019 06:37 AM
- Posted Re: How do you turn a string into time format for editable stats? on Splunk Search. 01-04-2019 08:05 AM
- Posted Re: How do you turn a string into time format for editable stats? on Splunk Search. 01-04-2019 08:04 AM
- Posted Re: How do you turn a string into time format for editable stats? on Splunk Search. 01-04-2019 07:17 AM
- Posted Re: How do you turn a string into time format for editable stats? on Splunk Search. 01-04-2019 07:16 AM
- Posted Re: How do you turn a string into time format for editable stats? on Splunk Search. 01-04-2019 06:33 AM
- Posted Re: How do you turn a string into time format for editable stats? on Splunk Search. 01-03-2019 01:57 PM
- Posted How do you turn a string into time format for editable stats? on Splunk Search. 01-03-2019 12:51 PM
- Tagged How do you turn a string into time format for editable stats? on Splunk Search. 01-03-2019 12:51 PM
- Tagged How do you turn a string into time format for editable stats? on Splunk Search. 01-03-2019 12:51 PM
- Tagged How do you turn a string into time format for editable stats? on Splunk Search. 01-03-2019 12:51 PM
- Posted How to turn string value into a time value to calculate the difference between two fields? on Splunk Search. 09-28-2018 09:42 AM
- Tagged How to turn string value into a time value to calculate the difference between two fields? on Splunk Search. 09-28-2018 09:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-28-2019
07:13 AM
Also, my SLA1 if statement has worked when I just add a number instead of linking to the Priority duration case statement. So, it is the Case statement that is probably not the right way to do it.
... View more
06-28-2019
07:11 AM
That was very helpful ! I was duplicating efforts, basically. But what about my if statements? It is still populating incorrectly. Should I change the type of command I am using?
... View more
06-28-2019
06:56 AM
The $INTERNALPRIORITY$ is based on a filter, where I can chose a number (1,2, or 3). If chosen INTERNALPRIORITY 1 then the code should use 15 for the next eval statement, and so on. The result is only giving me "Pass", meaning it is not taking the PriorityDuration correctly on the bolded lines. I need to be able to use the PriorityDuration result based on the INTERNALPRIORITY chosen to compare in the if statement.
Am I using the right eval/case/if statement?
... View more
06-28-2019
06:37 AM
Hello,
I want to find the ResultMin that "Pass" or "Fail" depending on the specific PriorityDuration that is classified by an INTERNALPRIORITY. Here is the code:
$INTERNALPRIORITY$
| eval ActualStart=strptime(ACTUALSTART,"%m/%d/%Y %I:%M:%S %p"), WorkLogEntry=strptime(WORKLOGENTRYDATE,"%m/%d/%Y %I:%M:%S %p")
| stats first(WorkLogEntry) as firstLog , values(ActualStart) as ActualStart by TICKETID
| eval result=firstLog-ActualStart
| convert dur2sec(result) as ResultSec
| eval ResultMin=ResultSec/1440
**| eval PriorityDuration=case(INTERNALPRIORITY==1,"15",INTERNALPRIORITY==2,"30",INTERNALPRIORITY==3,"60")**
**| eval SLA1=if(ResultMin>PriorityDuration, "Fail", "Pass")**
| stats values(SLA1) AS "SLA1 Result" by TICKETID
... View more
01-04-2019
08:05 AM
Thank you! This was perfect!
... View more
01-04-2019
08:04 AM
Oh ok!! Perfect, now I just have to figure out how to subtract one day in epoch time.
... View more
01-04-2019
07:17 AM
I want to show the final duration in hh:mm:ss, not as a string value. Also, I don't think the answer is 22:49:41, it is a very big value. This is the same answer I am getting.
... View more
01-04-2019
07:16 AM
I want to show the final duration in hh:mm:ss, not as a string value.
... View more
01-04-2019
06:33 AM
The StartTime and EndTime format are a string and were uploaded as:
12/22/18 10:04:29 AM
When converted with strptime (| eval Start= strptime(StartTime,"%m/%d/%y %H:%M:%S %p")
), one event looks like:
1545483185.000000
Sum Duration is then:
100181.000000
... View more
01-03-2019
01:57 PM
Hello skoelpin,
The SumDuration answer is 22:49:41, but it should be a sum of about 5 hours. StartTime and EndTime upload in a string format, so I can not use the stats command, SPLUNK gives me an error.
... View more
01-03-2019
12:51 PM
Hello,
I have been trying to use the stats command to determine the duration of a certain event. When I add the data, the start and end times upload as a string, but I need to convert it to time format in order to eval and output a total duration of the event. The output with the following code gives me 22:49:41, which should not be the final answer. What am I doing wrong?
| eval Start= strptime(StartTime,"%m/%d/%y %H:%M:%S %p"), End= strptime(EndTime,"%m/%d/%y %H:%M:%S %p")
| eval Duration=End-Start| stats sum(Duration) as SumDuration
| fieldformat SumDuration=strftime(SumDuration,"%H:%M:%S")
... View more
09-28-2018
09:42 AM
Hello,
I have a log that when uploaded to SPLUNK this appears as a string even though it should be in time format. So, I have to convert this string into a time in order to calculate the difference between an end time and a start time. This is my code:
| eval StartTimestamp=strptime(StartTime,"%d/%m/%Y %H:%M:%S"), ActualTimestamp=strptime(ActualAlarmTime,"%d/%m/%Y %H:%M:%S")
| eval ResponseTimestamp= (StartTimestamp-ActualTimestamp)
| stats avg(ResponseTimestamp) as ResponseTime
It is not creating any errors, but I am not sure if the answer is in seconds or in an epoch format. I would like to see the ResponseTime in a %H:%M:%S format.
Thanks!
... View more
08-23-2018
01:54 PM
The individual search works:
| timechart count(Number) as CountEvents by sourcetype
sourcetype="totaltru"
| timechart sum(Total) as Total by Site
but trying to include them in the same search in order to create a ratio is the problem.
... View more
08-23-2018
01:49 PM
Yes, those are the sourcetypes. Thank you for your help, but the query did not work, that is why I am using the subsearch.
... View more
08-23-2018
12:55 PM
This is the following Query I am using and it is not working:
index="jamlog"
| timechart count(Number) as CountEvents by sourcetype
| appendcols
[search sourcetype="totaltru"
| timechart sum(Total) as Total by Site ]
| eval Ratio=CountEvents/Total
| stats avg(Ratio) by sourcetype
I want to be able to use these two results and divide them to make a ratio:
Site Total
DFW 353233
SAT 491025
sourcetype CountEvents
BUF 2983
DFW 5318
HNL 3730
ORD 7446
SAT 9213
What do you think I am doing wrong?
... View more
08-23-2018
11:55 AM
Hello @skoelpin,
I have not been able to solve the question. I keep trying to work around it and see if there is something missing, but it has not worked out yet.
Thank you for your time.
... View more
08-21-2018
11:49 AM
I am using what you have provided and it states that the eval argument is invalid.
| stats count(Number) as CountEvents, avg(CountEvents) as AverageCount by date_mday, sourcetype
| bin _time span=1d
| stats eval(if(sourcetype="SAT",'CountEvents',"null")) as count_avg, eval(if(sourcetype="",'AverageCount',"null")) as count_total
| eval Total=count_avg/count_total
I have tried separating it, but it comes up as invalid also.
... View more
08-21-2018
11:38 AM
Hello,
Thank you for your answer. Should I still use the subsearch? and enter the subsearch with your answer?
Best.
... View more
08-20-2018
01:49 PM
Hello,
I want to divide AverageCount by AverageTotal. The problem is that Average count is separated by Sourcetype and Average Total is separated by a Field. For example:
index=x Sourcetype: SAT --> I calculate Average Count using this search
index=x Sourcetype:TotalTru Site:SAT --> I calculate Average Total by day using this search
Is there a way that I can use an eval statement by specifying with an if statement what site to relate the average to. I was thinking:
If sourcetype: SAT, then eval by site when site: SAT
index="x"
| bin _time span=1d
| stats count(Number) as CountEvents by _time, sourcetype
| chart avg(CountEvents) as AverageCount by sourcetype
| append
[search sourcetype=TotalTru
| eval Total=if(sourcetype==SAT,
....
Thanks!!
... View more
06-27-2018
08:18 AM
Hello,
I want to be able to ignore days where data was not collected. I am using the following search:
index="x"
| timechart span=1d count(Number)
What command can I use to ignore these non value added days?
... View more
- Tags:
- splunk-enterprise
05-02-2018
11:15 AM
Hello,
In one index I have multiple sourcetypes. I want to be able to compare the values between these sourcetypes, but I do not know where to even start.
I was trying the following search:
index="log"
| stats count events if(sourcetype="SAT") as SAT
but this search seems very complicated. I want to be able to do something like:
|stats count events by sourcetype
but again, this doesn't work. Help!
... View more
- Tags:
- splunk-enterprise
01-31-2018
08:46 AM
Thank you! Everything is acting well, so far!
... View more
01-31-2018
08:22 AM
1 Karma
This is how I included your recommendation, thank you! I will double check my results and see if there is anything wrong. Let me know if you see any inconsistencies in the code. Thanks again!
| stats sum(ActualPTDCostsAMT) as ActualTotal, sum(LEThisMthCostsAMT) as LETotal by Project
| eval ActualTotal=-ActualTotal, LETotal=-LETotal, n=max(1,2,3,4,5,6,7,8,9,10,11,0,MonthNum)
| eval divisor1= case(Project=="1405688",14-n, true(),15-n),
divisor2= case(Project=="1408525",n-3,Project=="1410522",n-4,Project=="1404501",n-4,
Project=="1409599",n-3, true(),n)
| eval YTDAvg=(ActualTotal/divisor2), YTGAvg=(LETotal-ActualTotal)/divisor1
| eval Ratio=YTGAvg/YTDAvg
| eval Number=1
| table Project,Ratio,Number
... View more
01-31-2018
07:53 AM
What does the 1==1 do?
... View more
