About kjcorbin

sideview · ‎08-12-2011

Ah excellent. Well all's well that ends well. No worries; it's always fun to help even (especially) when I get to go out on a limb.

krussell101 · ‎10-05-2012

Could be CPU related . . . http://splunk-base.splunk.com/answers/33717/scheduled-searches-for-summary-index-does-not-run-no-skipped-log-in-schedulerlog

kjcorbin · ‎08-01-2011

I ended up solving this by adding the totals to the original query. However, because I was sharing the search node with other charts that were displaying averages and top usage I had to exclude the Totals from the data on the other post-process steps. I did this by adding: search NOT ServiceName="Totals" |

sideview · ‎07-30-2012

Strange. stats sum(Households) should work, that is unless the main search is completely empty. What 'illegal' message did that return? Can you paste it in? As to the second postProcess, timechart span=1d sum(play_seconds_val) by ServiceName useother="f" - Well this wont work because the final results for your base search doesn't have a field called play_seconds_val. You renamed it to PlaySeconds. And the third postProcess, for one thing there's a typo -- PlaySecnds instead of PlaySeconds , and for a second problem indeed you need to have a function argument like distinct_count() or sum() or max(). You can't just specify raw field names.

0waste_splunk · ‎08-08-2013

What is curl? can you please list the steps? which resolved this problem? thanks

Posts	12
Solutions	1
Karma Given	0
Karma Received	8
Member Since	‎05-25-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Pulldown works great for admin, not for other user...

Splunk scheduled jobs do not run

SimpleResultsTable ignoring count

Post processing summarized data

Re: Pulldown works great for admin, not for other ...

Re: Splunk scheduled jobs do not run

Re: SimpleResultsTable ignoring count

Re: Post processing summarized data

Re: Saved Searches fail to generate PDF attachment...