About rogerdpack

rogerdpack · ‎06-02-2022

Is this more efficient? Like it'll stop the query fast?

rogerdpack · ‎04-08-2022

That total worked. And wasn't intuitive...

rogerdpack · ‎11-22-2019

for followers, in general you extract using substr in an "eval" see https://answers.splunk.com/answers/210683/how-to-use-substr-to-extract-the-first-3-letters-o.html

rogerdpack · ‎04-17-2014

for saved searches it's Searches and Reports -> choose_your_search -> More Info -> schedule [edit] -> next and you can finally change your "email to" settings, etc. yikes!

rogerdpack · ‎04-14-2014

Another option that doesn't require manual editing of the panel is computing the log, like: ... | eval a=log(validated_count) | timechart sum(a)

rogerdpack · ‎11-01-2012

You may be able to add "NOT index=OTHER" to the search criteria. having useother=f works for me here, though. I also was seeing NULL entries and added "AND index=*" to get rid of them.

rogerdpack · ‎10-31-2012

It would be interesting (nice?) if splunk added ability to "dump stats" easily every so often (for instance, all mbeans on the system). Then its graphs could be used to track system metrics more easily.

rogerdpack · ‎09-17-2012

query | chart by host by important part being "by host"

rogerdpack · ‎09-17-2012

http://twitpic.com/avrhm9 basically if you create a "pie graph" of your output, it cuts off half of the text of the topmost line. Cheers!

rogerdpack · ‎09-11-2012

Hello. I noticed that with the dashboard "new panel" and also "edit panel" dialog boxes, there is no dropdown for selecting the time range [?] http://twitpic.com/atkif7 Is this expected? If it is I would suggest something be added because as it is it is super confusing "what do I put in those fields"? for beginners. Thanks.

rogerdpack · ‎09-11-2012

Turns out that the "top" graph is always of events, and to see the "real" graph, you need to click the right tiny icon to show it. Odd. See http://twitpic.com/atkfn7

rogerdpack · ‎09-11-2012

When using this query: index=development host=*app.dev.dps "dgs_size" | timechart sum(dgs_size) It doesn't graph the sum, only the events, what gives?

Posts	12
Solutions	1
Karma Given	26
Karma Received	3
Member Since	‎09-11-2012

Online Status	Offline
Date Last Visited	‎06-02-2022 10:40 PM

feature request: become a competitor to appdynamic...

could you please fix pie graphs so they don't cut ...

why is there no time selector dropdown for the das...

when I use timechart with "sum" why does the graph...

Re: Return only the first matching event

Re: Can you alter the Splunk search used for an al...

Re: How to extract substring in a string for eval ...

Re: Editing, modifing,removing an alerts

Re: Change y axis scale to logarithmic scale

Re: useother=f in a pie chart

feature request: become a competitor to appdynamic...

Re: How do i group the log for ip, or type?

could you please fix pie graphs so they don't cut ...

why is there no time selector dropdown for the das...

Re: when I use timechart with "sum" why does the g...

when I use timechart with "sum" why does the graph...