About andreacorrie

andreacorrie · ‎09-19-2016

This will work but again, it doesn't scale for more than a few days. I'm looking for a solution that I can search 30 days, for example.

andreacorrie · ‎09-13-2016

In my example, I want to search the 8th or the 9th. I'm using syntax you would use in Apache Pig to specify multiple days. Yes, I could use source = source="/foo/bar/2016/09/08/*.avro OR source="/foo/bar/2016/09/09/*.avro but this doesn't scale if you want to search more than a couple days.

andreacorrie · ‎09-13-2016

How do I search multiple source files within my search? I want to do something like: source="/foo/bar/2016/09/{08,15}/*.avro" or source="/foo/bar/2016/09/[08-30]/*.avro" but neither syntax returns results.

andreacorrie · ‎12-05-2014

I am trying to count occurrences of events from raw logs. Basically, if the log contains the string "MediaFailed", then count it. The difficulty is this string is not part of a key-value pair so I can't do an equality statement. I'm just looking for its existence within the entire log. I have tried the following, unsuccessfully: | eval failures=case(match(_raw,"MediaFailed"),uuid) Any help is appreciated!

andreacorrie · ‎10-20-2014

I am trying to create a graph showing values for each percentile from 0 to 100. I know how to use the perc function but how do I plot each percentage point? I have tried something like this without success: | stats range(Latency) as diff | eval rank=((Latency/diff)*100) |bucket rank bins=100| table rank I can get the range easily but am struggling with how to then rank each Latency value. Thank you in advance for the help!

andreacorrie · ‎09-18-2014

Thanks. Sounds like a feature request is in order!

andreacorrie · ‎09-17-2014

I'm not sure I understand. Hunk is a bi-directional hadoop connector by design so I don't believe I need an add-on. We don't have a splunk instance, only Hunk. I know accelerated search results are saved in hdfs but they expire. I want to be able to save search results over the long term.

andreacorrie · ‎09-17-2014

I am wondering how to save job search results in Hunk over the long term. I can see where to save a job but there seems to be a defined lifetime. I want to be able to run monthly jobs and save the results-indefinitely-in a directory on hdfs.

andreacorrie · ‎09-17-2014

Oh, ok, that makes sense. Thank you!

andreacorrie · ‎09-17-2014

Thanks. This works but the avg bothers me. What is being averaged? Shouldn't it just be one percentage value for each day? i.e. For Monday: 500 failures / 1000 sessions = 50% I tried swapping out avg with max and received different results. I guess I'm just confused about what is being averaged.

andreacorrie · ‎09-16-2014

I am trying to get a percentage of failures per day using timechart and eval but keep getting the error: Error in 'timechart' command: The eval expression has no fields |streamstats dc(failures) as failed by DeviceType | streamstats dc(total) as sessions by DeviceType | timechart span=1d eval(100-(failed/sessions)*100) as Percent_Error by DeviceType Where am I going wrong?

Posts	11
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎09-15-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to search multiple sources within my search?

Count Occurrence of string from raw log

How to create a graph showing values for each perc...

How do I save job search results in Hunk?

Why timechart with eval can't recognize fields try...

Re: How to search multiple sources within my searc...