Hello everyone, I am getting incorrect values while using appendcols to fetch the different results like a currentweek, 1weekago,  2weeksago.   |bin _time span=1h | stats count{trid) as transaction_count_1WAgo avg(duration) as Average RT_1WAgo by _time ABC | fields *   |appendcols [search earliest=** latest=** | |bin _time span=1h | stats count(trid) as transaction_count_2WAgo avg(duration) as Average RT_2WAgo by _time ABC | fields * ]   |appendcols [search earliest=** latest=** | |bin _time span=1h | stats count{trid) as transaction_count_currentweek avg(duration) as Average RT_currentweek by _time ABC| fields *]   If I run all this queries individually it shows some results and when I am trying to use them in a single search by appending using "appendcols" they shows different..   Please suggest on this? Note: i have used all latest, earliest time frames correctly but didn't show here. ... View more

Hi All, here I'm trying to build a query, which produces the values of yesterday and today. earliest=-1d@d latest=@d index="summary" | stats count(count) as yesterday_count by orig_sourcetype | appendcols [ search earliest=@d latest=now index="summary" | stats count(count) as today_count by orig_sourcetype] What I'm looking for is, I want a report of day-1, day-2, day-3, day-4.. if anyone of the day-4 count is more/less than 30% of previous days.. It should trigger the alert. ... View more

Hello, Getting this error message everytime when I'm trying to add the search peer to master. Failed to register with cluster master reason: failed method=POST path=/services/cluster/master/peers/?output_mode=json master=113.134.117.122:8089 rv=0 gotConnectionError=0 gotUnexpectedStatusCode=1 actual_response_code=500 expected_response_code=2xx status_line="Internal Server Error" socket_error="No error" remote_error=Cannot add peer=18.218.129.11 mgmtport=9089 (reason: http client error=Connect Timeout, while trying to reach https://18.218.129.11:9089/services/cluster/config). [ event=addPeer status=retrying AddPeerRequest: { _id= _indexVec=''active_bundle_id=3BA0B5A63B5F98681601E92106214CBE add_type=Initial-Add base_generation_id=0 batch_serialno=1 batch_size=2 last_complete_generation_id=0 latest_bundle_id=3BA0B5A63B5F98681601E92106214CBE mgmt_port=9089 name=EE4D1ED7-70B3-4AAC-A5E6-0A920EEE2FFC register_forwarder_address= register_replication_address= register_search_address= replication_port=8080 replication_use_ssl=0 replications= server_name=ip-12-31-4-60.us-east-2.compute.internal site=default splunk_version=8.0.2.1 splunkd_build_number=f002026bad55 status=Up } ]. 3/27/2020, 2:15:20 AM Can someone help me with this? I tried, remove the old configuration in server.conf and restarted many ties but no use. ... View more

Hello everyone, I have a python script which will connect to splunk and search with the query which I passed through a script and fetches the results. So now my script is working fine and fetching the splunk results. Now I want to send these results to Prometheus.. i have Prometheuslib installed... Can anyone help me with docs, or script on this? ... View more

Hello, I have a Splunk query which generates some output so I want to send this output to Grafana/premethes. So what are the steps to be followed to achieve this? ... View more

Hello everyone, I have some barcharts and column chart panels in my dashboard. If there are less results the view perfect along with the name.. But if we pull up 30 days report, it combines all the results and the view is not good. So I would like to add horizontal scrollbar, like how the default scroll bar will be added to statistical table. So it possible to set scrollbar in column chart? ... View more

Hello, I want create a pattern for similar error message without discarding all the events.. Let's say, I have events like: error occurred from ui correlationId; abcd1234 error occurred from ui correlationId; abcd2345 error occurred from ui correlationId; abcd4536 error occurred from ui correlationId; abcd6475 Like that it has 100 errors, when I'm trying to count it shows 100 different errors but in this case it is just single error.. Here i want to do like 1. error occurred from ui correlationId; xxxx-yyyy capture remaining message 2. Count the total similar events as a single error 3. Any better solution to capture different errors to take the action immediately it will be very useful in our production... ... View more