Thanks @niketnilay! I found the trick 2 minutes ago. With this, I'm can get what I looking for. Thanks a lot 🙂 ... View more

Hi @cusello At the moment, the query is ok. I get the expected values. My problem is the next step: with that query, how can I calculate the Total and then use it to calculate the relative? I can calculate the totals with addcoltotals, or even a appendpipe like this: appendpipe [stats sum(EventConversion) as TotalConversion] but then, how can I put that value in the equation Relative Conversion = Event Conversion / Total Conversion for all the cities? ... View more

Ok, I will check the roles but this happen with the admin user, too. ... View more

Hi again @inventsekar My query is really simple: index=index1 $token$ $token2$ $token3$ $token4$ $token5$ $token6$ | stats count I get 10 million with every user, everywhere (search box or panel). This is a fresh install, and we are set up the config when we need it and by now, we didn't touch any config file (unless limits.conf for this case). Maybe a 6.4.1 limitation? ... View more

Hi @inventsekar Isn't the case this time. Is a simple Splunk Enterprise 6.4.1 deployment in a Linux Ubuntu Server 16.04 ... View more

Thanks for your quick answer! I know about the sort limit before and I think that the problem was similar, but I can't find something like that in the stats documentation. My query is really simple: index=some_index $token1$ $token2$ | stats count Any other suggestion? Regards. ... View more

I check the Data Model Audit page and I haven't seen any error. The field last error from the Acceleration Details panel isn't showing anything. ... View more

Ok, I have tried with 10 minutes, and my panels didn't show me the new data, but when I launch the seach that you sugestted, Splunk show me sessions for the time period that I expect (in this case, from yesterday) ... View more

Hi jbjerke Thank for your efforts. I added the line in the SPLUNK_HOME/etc/apps/SplunkAppForWebAnalytics/local/datamodels.conf (the line acceleration.cron_schedule = 2,12,22,32,42,52 is in the default/datamodels.conf and I haven't commented) and I scheduled it one hour later after the batch (batch 3 a.m. and datamodel 4 a.m.)... but like always, Splunk indexed the data but the session fields from the data model are empty. I will try with less time between both (10 minutes for example) ... View more

I scheduled for today at 3 a.m. (local) the download of the yesterday data. I just check Splunk now and I have the same empty fields. If the App works like you said: 'The scheduled search is looking for the last 20min of indexed data and the last 24hours in total window regardless' the app would shown me some data, isn't it? ... View more

With this last context, if I put the file from yesterday in the directory, the app do it fine, but when I did last test that I comment, it doesn't. ... View more

Yes, in this case I added 4 hours ago the data from yesterday. With this context, the app would shown me some data, isn't it? ... View more

Sorry, I mislead the context of my last comment. The context was: I have indexed 10 days of logs (10 files) without errors (index, datamodel and panels show the correct info). At this point, the Splunk App for Web Analytics works normally. I stopped the "Generate user sessions - scheduled" I added one day more (one file) in the monitored directory When Splunk has indexed the new data, I manually run the "Generate user sessions - scheduled" I wait until the Events in the data model increases (I can see this in the step 4 Data Model Acceleration check) I check any panel, but the new data is missing (the panel didn't show it) I scheduled again the "Generate user sessions - scheduled" and wait 10 minutes Nothing change ... View more

More info: I stopped the scheduled Generate user sessions, indexed new data and run manually the scheduled Generate user sessions. "the problem" has replicated. ... View more

Hi @jbjerke_splunk and thank you for your answer. After all this days of testing, I realise that my problem is similar to the problem explained by @kjhanson in his question: https://answers.splunk.com/answers/389610/splunk-app-for-web-analytics-v17-lookups-not-popul.html Seems to be that, sometimes, the scheduled Generate user sessions didn't get the data that I expented. After your answer, I suppouse that when you write... : The Splunk App for Web Analytics generates sessions for the web traffic through a scheduled search that looks into the last 20 minutes worth of data. ... you mean the last 20 minutes of indexed data, and when you write... : My theory is that you get new data into Splunk through the batch process but this data is then excluded from the scheduled search because of a timing issue ... you mean that is possible a "conflict" between the data indexing time and the scheduled lookup time? like both of them start at the same time? About rebuild the datamodel, I suppose that you mislead the last step Expand data model "Web" by clicking on the arrow on the left hand side. Click "Rebuild", but yes I did this many times, most of them when I get an error and I have to re-do all the process, but sometimes (for test purposes) when I got the error I rebuild the datamodel and in that cases the solution is worse. I did another test: I configured in Splunk that only monitored a file. Up to this point Ok. Then, I injected events from other day (from other file: cat file1 >> filemonitorizedbysplunk) and "the problem" was replicated (the events appeared in the index, but the fields in the data model were empty) I haven't tried the real time yet but... You believe that I could solve my problem if I try? ... View more

Ok, more info: I have compared two Splunk instances; the two of them has the same data, but one has "the problem" and the other one hasn't it. When I check both indexes, they are the same. No problems at all. But when I check the data model, I find the same empty fields that I wrote in the question above (only in the Splunk instance with "the problem"). Seems to be that "the problem" happens between the index and the data model... but why? ... View more

More info -- I tried a fresh deployment in a Virtual instance, with the same results. -- Until yesterday, when I copied the logs typing the commands (without cron), I've never had errors. But today when I copied four at once in the monitored directory, Splunk indexed correctly only the last one (In this case, the previous 10 days in the index weren't affected) -- I did some test with only two days (two files) and when the cron activates the script, I always have problems with the first file indexed. @jbjerke_splunk , Could you give me some advice or clue, please? ... View more

Seems to be some issue between the automated script (cron) and the indexing step... but not always. When this happen, I delete the index, create a new one, put the same logs downloaded by the script in the directory monitored by Splunk, and after the configuration steps, all works fine (exactly the same files). ... View more