I want my search to consider a 5 minute timeframe. I have a stats with a bin for a span of 5 minutes but when running it sometimes it is split into two 5 minutes intervals. I want it to only consider 1 interval of 5 minutes. So right now I would snap to say 1:00-1:05 and 1:05-1:10. I would like it to just do something like 1:03-1:08; really whatever time it runs on I want that 5 minute span to be treated as one result set.   ... View more

I was working in the MLTK, very new to it and exploring. I was working to establish a few searches where I will fit a algorithm and then apply it to identify if any values out of a set boundary and then alert on that. I have two question from this.   Is this a valid use case or not so much? I have a predicted value after my fit but, its too close to my actual values so I was thinking of doing something like(+ or - depending on need): eval bound = (predictedavg - (stdev * 3))  Would it be more beneficial to calculate this in the fit search or when applying the model? ... View more

I am running something like the following.       | bin _time span=1s | stats count by fuzz       When doing this though I do get gaps where there is no result for some second time frames.  I do need per second data but when doing this I feel I am getting some false data since it is not accounting for the missing seconds. Essentially I want to see how many transactions a second we are posting to specific servers ... View more

I am looking through our current alerts and we have a few evaluations that occur like below. Total_Trade: 129 Total_Value: 300 Total_Amount: 1000 I have a rex like below:       | rex max_match=0 Total_(?<Type>\w+):(?<amount>\w+)       Doing this though I get two fields with multiple events like below. Type amount Trade Value Amount 129 300 1000   What I wanted was each of these to be separate though/ Type amount Trade 129 Value 300 Amount 1000     ... View more

Right now I have a lot of macros to help with reports, dashboards and knowledge items in general. We do not really use tags/eventtypes. Right now though each business has multiple macros that need to be managed based on how our items our logged (this is the root cause but this wont change easily). I am wondering from a performance standpoint is there a way I could more easily get the events I need through a tag/event type or other way?   For example I need to get a list of all functions that get called. So with that we need to have an over all macro, something to exclude some carryovers/one time jobs and other items we dont care about. We are implementing more and its becoming a huge mess so far. I was thinking use the macros to create a weekly lookup that then can be used in dashboards/reports to try and make things more efficient as well. Just looking for ideas as to what might be a better/cleaner way to do things.   Edit: I get macros are not a performance issue and will just run whatever SPL is in there. I was more wondering is this generally the most efficient way or could I benefit from using something different here. ... View more

I have the following query that I am working to establish a prediction for. I am able to be the volume to predict but I wanted to also predict a failure rate for this. When I add in the failure count though I do not get any results. I confirmed the query works fine when removing the predict also. Is this a limitation on predict?     |timechart span=15m count as volume, count(eval(match(login, "failure"))) as "failures" | predict volume, failures       I also see, "Invalid time series index: 2". ... View more

I am using a chart command to get a list of IP's and servers with an error. I am attempting to only get the top 10 results. For some reason when I do the top for IP I do not get results but if I do it for server I get results. index=foo result=error | chart count by server, ip | top limit=10 ip   ... View more

We have specific ID's that track how request process through the system. What I want to do search for all these ID's in one index and then join all other index's to see how these funnel down. So essentially track how a request tracks through our system, and then get all the service requests associated. I was thinking something like:    index=foo |fields service, ID | join ID [index=*] | stats service   ... View more

I want to find items in one index based on results from another index's search. I have the following but only get a handful of results for some reason.     index=a sourcetype=test |join id [search index b | rename id as idb] |stats count by id, idb     Is this the best way to accomplish it and any reason I only get a small number of results?  ... View more