Fancy stuff... I am still trying to dissect it (and digest it). With the original chart command, i get 3 columns, as expected, one for the Components (basically most part of log description) and then 2 days worth of metrics. I don't seem to get those with this answer, but I am trying to see how I can leverage some of the ideas. I get 4 days in first column and then columns for a pair of pipeline and queue values. Will tinker a bit more... ... View more

I guess its not about root access, but some kind of AWS Authorization. When I go into the folder /home/splunk , there are only dot files and .splunk. Within .splunk only one token: authToken_ip- perhaps its more about AWS IAM... any ideas? Thanks... V ... View more

Ok, I added a duration per Section and then tried to sort by that field: ... | sort -sduration Section -duration Component |.. which seems to work fine for the Section and its duration but the Component part doesnt get sorted... Do I need to change drastically the solution or is there something to sort the Component subtable? Thanks, - V ... View more

Ok it looks good... just changed the sorting order in last sort to: sort Section -duration Component and i do get all sections... Just need to pick the top 3 Sections now... This can be fun 🙂 Cheers, - V ... View more

Good stuff... There is more that one transaction (Component) per Section and I am able to compute the duration by using "window=1" on streamstats after sorting by time as well. However, I did try your solution and it seems to work well, but for some reason only get 3 sections (lexicographically) not sure why. Any idea? (More interesting would be to pick the top 3 Sections by time as well...) Thanks, - V ... View more

Good ideas... However, 'duration' seems to vanish after the sort operation. In any case, the transaction statement only calculates the duration for the Sections, and its desired to have it by Component, and use that for the top 5 rankings within Section. Perhaps I need to calculate the duration of every line (Component) first and then proceed to the Section calculations. Is 'transaction' the best way to calculate duration of each log entry, given that they are sequential in timestamp? V ... View more

Nothing special to these logs. The format is more or less like this timestamp IPaddr Component In reality "found section" and "After render" are the first two words of Component, a text description. I could tweak the format if that could help for the end goal, The transaction operation works well in grouping the section, now just need to get the duration for each intermediary log event, all in sequence through the timestamp. Then find the top 5 for each Section. Each Section group appears in different parts of the stream (so their component durations would be need to be aggregated before picking top 5 of each Section) Thanks, - V ... View more

I guess the (time) duration needs to be calculated from the previous timestamp and the current one. They are sequential log messages. Thanks - V ... View more

Good stuff, Its close... but I'd like top 5 in time duration, not in count... I guess it would be like considering every log within a Section as a transaction itself and then determine duration and rank it by top 5 per Section. Also, i get '1' for the count of the first Section components and I can see there are more than 1... distributed across the Section transactions Thanks, - V ... View more

I try to do this at the start... Which login/pwd should be entered? It doesnt take either "admin/changeme" nor my own Splunk credentials... Thanks ... View more