Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nfieglein
nfieglein
Path Finder
Member since:
11-03-2014
06-05-2020
Community Statistics
| Posts | 32 |
| Solutions | 4 |
| Karma Given | 4 |
| Karma Received | 12 |
| Member Since | 11-03-2014 |
Activity Feed
- Got Karma for Re: How to use JSON extracted fields with eval function typeof?. 03-01-2022 03:49 PM
- Got Karma for Re: How to use JSON extracted fields with eval function typeof?. 01-20-2022 08:09 AM
- Got Karma for Re: Is there a limit on the number of events returned from the transaction?. 01-13-2021 11:10 PM
- Karma Re: How do you use extracted JSON fields in transactions and buckets? for aweitzman. 06-05-2020 12:47 AM
- Karma Re: I am try to to find the number of business days between two extracted fields for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How do I keep a sum total of events before a dedup? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to convert all fields that have "Date" in the name to a standard date format from JSON message data? for somesoni2. 06-05-2020 12:47 AM
- Got Karma for Re: Is there a limit on the number of events returned from the transaction?. 06-05-2020 12:47 AM
- Got Karma for Re: Is there a limit on the number of events returned from the transaction?. 06-05-2020 12:47 AM
- Got Karma for How to convert all fields that have "Date" in the name to a standard date format from JSON message data?. 06-05-2020 12:47 AM
- Got Karma for Re: How to convert all fields that have "Date" in the name to a standard date format from JSON message data?. 06-05-2020 12:47 AM
- Got Karma for Re: How to use JSON extracted fields with eval function typeof?. 06-05-2020 12:47 AM
- Got Karma for Re: How to use JSON extracted fields with eval function typeof?. 06-05-2020 12:47 AM
- Got Karma for Re: How to use JSON extracted fields with eval function typeof?. 06-05-2020 12:47 AM
- Got Karma for Re: How to use JSON extracted fields with eval function typeof?. 06-05-2020 12:47 AM
- Got Karma for Re: How to use JSON extracted fields with eval function typeof?. 06-05-2020 12:47 AM
- Posted Re: How to add a row to a stats chart to display the total number of events with a unique ID? on Splunk Search. 11-25-2014 03:44 PM
- Posted How to add a row to a stats chart to display the total number of events with a unique ID? on Splunk Search. 11-25-2014 03:07 PM
- Tagged How to add a row to a stats chart to display the total number of events with a unique ID? on Splunk Search. 11-25-2014 03:07 PM
- Posted Re: I am try to to find the number of business days between two extracted fields on Splunk Search. 11-18-2014 06:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
11-25-2014
03:44 PM
I am looking for the total of all events regardless of status and then the total of those just with those stati. There are many other stati, but I am showing those stati in relation to the total.
... View more
11-25-2014
03:07 PM
This is probably simple. I am trying to add a row to stats/chart which displays the total number of events with a unique ID garnered using:
eventstats dc(UniqueID) as MyTotal
The stats will be something like:
search CurrentStatus=Status1 OR CurrentStatus=Status2 | stats count by CurrentStatus
... View more
11-18-2014
06:35 AM
It is not scheduled for my next two sprints, so it may be a while.
... View more
11-14-2014
10:40 AM
Not sure if I am 100% clear in the question, but here is what I am looking to do. I have a stream of incoming messages which have an identifier which can be duplicated (updated statuses). I have a flag which indicates whether the message is a new message and a flag which indicates whether the message is a close of the event. I want to run a dedup to have the current status of the message, but I want to count all of the new messages and compare them to all of the open and closed messages. I cannot seem to find a mechanism for counting a set of events and then counting a subset of those events created through the dedup command. I cannot use transactions as the number of events can range into the millions and the number of messages per event can range in the 20-30s.
Here are the two searches that I want to combine:
index=dccmtdit
| `GetDatesAndTimes`
| stats sum(IsNewDispatch) as DispatchesOpened by QuarterCreated
And:
search index=dccmtdit
| `GetDatesAndTimes`
| dedup DpsNum sortby -IsClosed -CurrentStatusDateEpoch
| stats sum(IsOpen) as OpenDispatches, sum(IsClosed) as ClosedDispatches, by QuarterCreated
I want to take those results and work further like this:
| search OpenDispatches!=0 OR DispatchesOpened!=0
| eval PercentOpen=exact(OpenDispatches/DispatchesOpened*100)
| eval PercentClosed=exact(ClosedDispatches/DispatchesOpened*100)
... View more
11-14-2014
10:31 AM
I have not completed the code, yet, but I am going to be creating a lookup which generates the regular expression for matching holidays. The users will then be able to load a holidays CSV file every year against which the expression match will work. I have not yet completed the design and if someone else has it, please point me there.
... View more
11-13-2014
12:11 PM
You can build a regex string which checks for the holidays from a lookup table. That takes care of the floating holidays like Thanksgiving. Here is an example macro I created where the regex string is hardcoded to look for Christmas Day, New Years Day and Independence Day in America.
eval localvar = $StartDate$
| eval mysd = if( isnotnull(tonumber(localvar)), tonumber(localvar), strptime(localvar, "%m/%d/%Y %H:%M") )
| eval start = relative_time(mysd, "@d")
| eval localvar = $EndDate$
| eval myed = if( isnotnull(tonumber(localvar)), tonumber(localvar), strptime(localvar, "%m/%d/%Y %H:%M") )
| eval end = if (myed == -1, relative_time(now(), "@d"), relative_time($EndDate$, "@d") + 86400)
| eval DateRange = mvrange(start, end, 86400)
| convert ctime(DateRange) timeformat="%+"
| eval BusinessDays = mvcount( mvfilter( NOT match(DateRange,"(Sun|Sat).*") AND NOT match(DateRange, ".*(Dec 25|Jul 04|Jan 01).*") ) )
| eval BusinessDays = if( isnotnull(BusinessDays), BusinessDays, 1 )
| fields - localvar mysd myed start end DateRange
... View more
11-11-2014
11:41 AM
3 Karma
It is actually a limit of the number of open transaction handles. The parameters (also in limits.conf) is maxopentxn. Playing with this variables, though, seems to have crashed my splunkd. I think I am going to have to seek an alternative to transactions for what I want to do. I really just want to combine events which have the same ID, so maybe dedup will allow me to do that.
... View more
11-11-2014
09:44 AM
I run this command:
index=dccmtdit sourcetype=DCCMT_Log4J_JSON | transaction DpsNum maxevents=-1
It returns: 4,999 events (before 11/11/14 11:34:05.000 AM)
I would expect the number of events returned to be the same as the distinct count of events returned by the following command:
index=dccmtdit sourcetype=DCCMT_Log4J_JSON | stats dc(DpsNum)
However, the number of events returned from the second command is:
dc(DpsNum)
45733
Is there a limit somewhere which prevents me from having all of the events in the transaction? I have various messages coming in which update the status of the event and it is possible that these messages may come in out of order.
... View more
- Tags:
- limits
- transaction
11-07-2014
01:30 PM
I am going to give both musskopf and myself a partial answer on this. His definitely find the right value in a single date multivalue and you could probably do the same thing with all of the date fields in an event. Mine is a bit more involved, but I only have one pass to get the earliest/latest date. You choose the one you like.
My code:
convert mktime(*Date) as *DateEpoch timeformat="%a %b %d %H:%M:%S %Z %Y"
| eval CreateDateEpoch=now()+(60*60*24*365)
| foreach *DateEpoch
[eval CreateDateEpoch= if (typeof('<<FIELD>>')=="Invalid", CreateDateEpoch, min(CreateDateEpoch, '<<FIELD>>'))]
| eval CreateDate = strftime(CreateDateEpoch, "%m/%d/%Y %H:%M:%S")
Musskopf's code:
| gentimes start=0 end=1 | eval mv="Fri Oct 31 00:00:00 CDT 2014,Mon Oct 27 00:00:00 CDT 2014,Sat Nov 01 00:00:00 CDT 2014,Thu Oct 30 00:00:00 CDT 2014,Tue Oct 28 00:00:00 CDT 2014,Wed Oct 29 00:00:00 CDT 2014" | makemv delim="," mv
| eval datemv=strptime(mv,"%a %b %d %H:%M:%S CDT %Y")
| eval most_recent_seconds=max(datemv)
| eval most_recent_human=strftime(most_recent_seconds,"%a %b %d %H:%M:%S CDT %Y")
... View more
11-07-2014
01:23 PM
Works like a charm! I have added it to a macro and now I am finding business days like crazy. I may start to go really crazy and look for holidays, but I am happy now.
... View more
11-07-2014
06:32 AM
I am trying to follow what the others have done, but I am stumped as to why things are not functioning for me. I have a couple of date fields and sometimes I want to find the number of business days between those fields and sometimes from one of those fields to now. No matter what I try, I cannot seem to append BusinessDays to my rows.
index=dccmtdit sourcetype="dccmt_log4j_json" | transaction DpsNum | convert ctime(CreateDateEpoch) as cd timeformat="%m/%d/%Y:%H:%M:%S" | eval ld=strftime(now(), "%m/%d/%Y:%H:%M:%S") | append [|gentimes start=$cd$ end=$ld$ | search starthuman!="Sun*" starthuman!="Sat*" | stats count as BusinessDays]
This produces the following error:
[subsearch]: command="gentimes", invalid literal for int() with base 10: '$cd$'. Traceback: Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\search\bin\gentimes.py", line 66, in generateTimestamps starttime = getTime(startagostr) File "C:\Program Files\Splunk\etc\apps\search\bin\gentimes.py", line 35, in getTime daysago = int(val) ValueError: invalid literal for int() with base 10: '$cd$'
I am stumped as to why I am getting the error. But even if I hard code the dates to get by that error, I do not have BusinessDays as a field after my search. Can anyone tell me what I am doing wrong? Eventually, I want to turn this into a macro so that I can always get the BusinessDays between two dates.
... View more
11-06-2014
07:05 AM
Since I wanted to span multiple date fields, I came up with this code that seems to be working.
convert mktime(*Date) as *DateEpoch timeformat="%a %b %d %H:%M:%S %Z %Y"
| eval CreateDateEpoch=now()+(60*60*24*365)
| foreach *DateEpoch
[eval CreateDateEpoch= if (typeof('<<FIELD>>')=="Invalid", CreateDateEpoch, min(CreateDateEpoch, '<<FIELD>>'))]
| eval CreateDate = strftime(CreateDateEpoch, "%m/%d/%Y %H:%M:%S")
... View more
11-06-2014
07:00 AM
1 Karma
The following from somesoni2 works perfectly! Thanks somesoni2!
your base search | convert mktime(*_date) as *_date_epoch timeformat="%Y-%m-%d %H:%M:%S"
... View more
11-05-2014
02:52 PM
I actually created a calculated field for source and set it to the corresponding value from JSON. This seems to work correctly.
... View more
11-05-2014
02:50 PM
I would be fine with a search time option, but I would like to be able to add a correspnding epoch time field for every date value that I have, including multivalue fields.
... View more
11-05-2014
02:46 PM
LogEntry.Content.CommentSegmentGrp.CommentSegment{}.CommentDate
Fri Oct 31 00:00:00 CDT 2014
Mon Oct 27 00:00:00 CDT 2014
Sat Nov 01 00:00:00 CDT 2014
Thu Oct 30 00:00:00 CDT 2014
Tue Oct 28 00:00:00 CDT 2014
Wed Oct 29 00:00:00 CDT 2014
... View more
11-05-2014
02:25 PM
I have a multivalue field which contains date strings. I would like to find the earliest one of the field and set a new variable to that value. Foreach seems to choke on multivalue fields. Any ideas would be grand.
... View more
11-05-2014
10:28 AM
I would have thought so as well, however, when passing a field to a macro it only works with no single quotes. I think that there really needs to be a scorecard or some uniformity.
... View more
11-05-2014
08:52 AM
OK, that worked for transaction, but when I do something like strptime, I need the single quotes. Is there some scorecard indicating when and when not?
eval TimeOpen = now() - strptime(LogEntry.Content.StatusSegmentGrp.StatusDate, "%a %b %d %H:%M:%S %Z %Y") - Does not Work
eval TimeOpen = now() - strptime('LogEntry.Content.StatusSegmentGrp.StatusDate', "%a %b %d %H:%M:%S %Z %Y") - Works
transaction LogEntry.Content.StatusSegmentGrp.StatusDate - Works
transaction 'LogEntry.Content.StatusSegmentGrp.StatusDate' - Does not Work
... View more
11-05-2014
06:45 AM
I tried doing the following and got back nothing:
sourcetype=json | transaction 'LogEntry.Content.SvctagSegmentGrp.DpsNum'
but had no results. However, when I do the following, I get the expected results:
sourcetype=json | eval DispatchNumber='LogEntry.Content.SvctagSegmentGrp.DpsNum' | transaction DispatchNumber
Has anyone encountered this issue?
... View more
11-05-2014
06:16 AM
,"SvctagSegmentGrp":{
"ModelNumber":"DZ","ServiceLevel":"CP","TechNameIssuedCall":"STC: SOME TECH","DspReplyCode":"0000","TechBadgeNumIssuedCall":659662,"ReasonCode":"SW3F","TechIdIssuedCall":"000251779","Buid":"000000707","ItemSubClass":"002","Svctag":"B375ST1","DpsNum":"000175479487","ProductDesc":"7737,NOTEBOOK,HADLEY 17FBTX","LineOfBusiness":55}
}
}
}
}
}
(Completed message)
... View more
11-05-2014
06:16 AM
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Gave service request number to customer.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"THIS IS AN ALABANG DISPATCH","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"S:dps media","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Created from DellServ Case #999999999","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"ETSB SOME OTHERTECH","DetailProblemDesc":"PART OK","CommentDate":20141101}
,{
"CommentType":"EXG","TechName":"ETSB SOME OTHERTECH","DetailProblemDesc":"RS APPROVED DPS","CommentDate":20141101}
]}
,"RaSegmentGrp":{
"RaFlag":"N"}
,"AddressSegmentGrp":{
"TimeZone":"EST","EdiRegionCode":"CA","StreetTwo":"Suite 3333","State":"ON","ZipCode":"999 999","City":"Gloucester","CountryCode":"CA","StreetOne":"9999 Duck St"}
,"StatusSegmentGrp":{
"StatusDate":"20141103:14:34:54.495440","RecordType":"C","StatusCode":"TTC"}
,"TranhistSegmentGrp":{
"EventDate":"20141103:14:34:54.448741","VendorNum":"0016","VendorDate":"20141104:16:00","EventCode":"VX","EventComments":"RTN WAYBILL#: KAM001231827"}
(again TBC)
... View more
11-05-2014
06:15 AM
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"FTF USED. ARTICLE NUMBER: non compliance","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Audibly obtained PN","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"No APN","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"VDI Told cust about Refurb replacement parts","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"VPKRS: No need for plastic replacement","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Media Check. Customer has: None","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Provided TAT: 1-2 BD","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"CRU/FRU part/s verified thru DTT/EducateDell","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Provided Moxie as a lifeline","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Sent summary email during call. Customer","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"confirmed e-mail is received.","CommentDate":20141031}
(again TBC)
... View more
11-05-2014
06:14 AM
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"SYSTEM: Inspiron 17","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"BTTR: Cx declined follow-up","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Consulted: CM POC Ice Bordeos","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Heat Check: SAT","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Captured, verified and updated Customer Name and","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Contact info in SR header.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Captured, keyspelled and updated email address","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"in SR header.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"VA TOADE","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Cx agreed to 'One-Strike policy'","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"Provided Ownership Spiel/s","CommentDate":20141031}
(again TBC)
... View more
11-05-2014
06:13 AM
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"D:Media Request","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"cx called in bec he would like to reinstall the","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"OS however he don't have the Media Recovery disc,","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"cx requesting for it, he would like to reinstall","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"the OS bec there's a lot of stuff or apps on","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"system and cx would like to refresh or to clean","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"it up, he wants to remove all the files and data.","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"inform cx the this request is a one time deal","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"only, cx understand, inform also cx the warranty","CommentDate":20141031}
,{
"CommentType":"EXG","TechName":"STC: SOME TECH","DetailProblemDesc":"details. done CDO - set to prio 4","CommentDate":20141031}
(again TBC)
... View more
