About andreafebbo

andreafebbo · ‎06-23-2017

I have this query: Base quey | eval EndTime = if(Result="OK", _time, null) | eval StartTime = if(LogType ="START", _time, null) | stats Latest(StartTime) as StartTime Latest(EndTime) as EndTime by PackageName ExecutionInstanceGUID | eval Duration = (EndTime-StartTime) | where (Duration != "" OR Duration >= 0) | stats avg(EndTime) as AVGEndTime avg(Duration) as AVGDuration avg(StartTime) as AVGStartTime by PackageName | fieldformat AVGStartTime = strftime(AVGStartTime,"%H:%M:%S") | fieldformat AVGEndTime = strftime(AVGEndTime,"%H:%M:%S") My problems is that in calculating the average on AVGStartTime and AVGEndTime he considers the day also. I'd like the average to be made just on the hour, minutes, seconds, not on the day. Thanks.

andreafebbo · ‎02-14-2017

If I understood well, for doing so i need an HTML dashboard? Is there any way to keep the dashboard xml? (I hope i'm clear) Thanks

andreafebbo · ‎02-14-2017

Hi all. I have a simple dashboard with a table with few columns. One of these columns represent name of servers. Id like to click in one cell (or even better in all the row) and being sent to another splunk report which the url is like: ......../app/search/dashboard_name/ form.fieldTime.earliest=%40d&form.fieldTime.latest=now&form.Server_Name=SERVER_NAME What i need to do is to click on that cell (or row) and to be sent (better id in a new sheet) to that url, but replacing SERVER_NAME with what is written in the cell. I think is pointless to add code because is just a table. Thank you all!

andreafebbo · ‎02-02-2017

Simply perfect! Thank you!

andreafebbo · ‎02-02-2017

Hi all! I have a table like this: ServerName Metric1 Metric2 Server1 1 0 Server2 1 1 Server3 1 1 Server4 0 1 And i need a table like this: Column Rows Count Metric1 Server1 1 Metric2 Server1 0 Metric1 Server2 1 Metric2 Server2 1 Metric1 Server3 1 Metric2 Server3 1 Metric1 Server4 0 Metric2 Server4 1 This was the simple case. The difficult case is: i need a table like this: Column Rows Col_type Parent_col Count Metric1 Server1 Sub Metric3 1 Metric2 Server1 Sub Metric3 0 Metric3 Server1 (Metric1+Metric2) Metric1 Server2 Sub Metric3 1 Metric2 Server2 Sub Metric3 1 Metric3 Server2 (Metric1+Metric2) Metric1 Server3 Sub Metric3 1 Metric2 Server3 Sub Metric3 1 Metric3 Server3 (Metric1+Metric2) Metric1 Server4 Sub Metric3 0 Metric2 Server4 Sub Metric3 1 Metric3 Server4 (Metric1+Metric2) Thanks all!

andreafebbo · ‎01-27-2017

Hi all I have some events which represent something like a ping. For example : _time: a time stamp doing it: 1 database: db1 server: server1 so i get something like this: the color represent the DB. Now, what i need to do is to write a query which understands that there are 2 groups of events for the violet db and that gives me that _time of the first event and the rime od the last event of every group, like in the next image. I think this can be achieved using clustering, just i dont know how (maybe with k means method). Can you help me?

andreafebbo · ‎01-24-2017

And using search instead of where in that case enhance the performance?

andreafebbo · ‎01-24-2017

What is RHS and what is literal? So 0 menas no limit in the sort?

andreafebbo · ‎01-24-2017

I found the solution myself. This is the code: MY BASE SEARCH | eval StartTime = if(LogType = "START", _time, null) | eval EndTime = if(LogType = "END", _time, null) | stats Latest(StartTime) as StartTime Latest(EndTime) as EndTime Latest(Result) as Result by precess id | join type=left precess [search MY BASE SEARCH LogType ="START" | stats latest(_time) AS LatestStartTime by precess] | eval EndTime = if(isnull(EndTime), if(StartTime = LatestStartTime, now(), null() ), EndTime) | eval Status = if(isnull(Result), "GOING", Result) | eval duration = (EndTime-StartTime) * 1000 | where duration >= 0 | table StartTime precess Status duration | sort StartTime Thanks to all the people who answered! :)

andreafebbo · ‎01-24-2017

What is the difference between | search duration >= 0 and |where duration >= 0 ? What is the difference between | sort 0 StartTime and | sort StartTime ?

andreafebbo · ‎01-24-2017

It still creates overlapping 😞

andreafebbo · ‎01-23-2017

If I invert the orders of the queries it works 😞

andreafebbo · ‎01-23-2017

I did that. The error comes in the append: the appendo command add the empty column AVGDuration but it does not append any rows.

andreafebbo · ‎01-23-2017

I dont understand how is possible that if i put my 2 search in a dashboard everything works. Bu if in that dashboard i click the magnifying lens the research (the 2 researches together) comes out and it does not work any more. It cannot evaluate the variable timing because AVGDuration is empty. This is the full code: (index and source) earliest=-31d latest=now (Result="OK" OR LogType ="START") | eval EndTime = if(Result="OK", _time, null) | eval StartTime = if(LogType ="START", _time, null) | stats Latest(StartTime) as StartTime Latest(EndTime) as EndTime by PackageName ExecutionInstanceGUID | eval Duration = (EndTime-StartTime) | where (Duration != "" OR Duration >= 0) | stats avg(EndTime) as AVGEndTime avg(Duration) as AVGDuration avg(StartTime) as AVGStartTime by PackageName | table PackageName, AVGDuration | append [ search (index and source) earliest=-24h@h latest=now | eval StartTime = if(LogType = "START", _time, null) | eval EndTime = if(LogType = "END", _time, null) | stats Latest(StartTime) as StartTime Latest(EndTime) as EndTime Latest(Result) as Result by PackageName ExecutionInstanceGUID | eval EndTime = if(isnull(EndTime), now(), EndTime) | eval duration = (EndTime-StartTime) | where (duration != "" OR duration >= 0) | table StartTime PackageName Result duration | sort StartTime |eval flag = 1 ] | eventstats values(AVGDuration) as AVGDuration by PackageName | where flag=1 | fields - flag | eval Timing = if(duration > AVGDuration, "InLate", "OnTime") | eval Status = if(isnull(Result), Timing, Result) | eval Duration = duration * 1000 I think the problem is that when the 2 searches come together, the first one (base) does not work anymore for some reason, but in the dashboard everything fine. Please help.

andreafebbo · ‎01-20-2017

OMG! It seems to work but i don't understand why! what does eventstats values(basesearchfield) as basesearchfield by process does? Thanks

andreafebbo · ‎01-20-2017

Hi all! I recently discovered that i can wire in my xml dashboard a search and then calling it in N other searches in N other different panels. I found it really useful since in my dashboard the searches often share some part. Now I need to join my base search with another search but I have the following problems: I cannot use append and then stats max since In the second search I have more than one row with the same join key because the base search contains the average execution duration of some processes (so one for each process name) and the 2nd search contain the processes execute in the time span i choose (so they can be more than one for each process name). So the optimal solution would be a right join, bust Splunk does not have a right join (and i sincerely don't understand why!) But at the same time I cannot exchange the searches for using a left join because a base search cannot be used like this second search | join type=left key [base search] I trued and if hard code the 2 searches together with the 2nd search in left join with the base search it work perfectly

andreafebbo · ‎01-20-2017

Does not work, it keeps overlapping.

andreafebbo · ‎01-19-2017

Its possible to have 2 instances running in the same day but never together, so if there is overlapping the fist one is been killed.

andreafebbo · ‎01-19-2017

the base query only contains an index and a source. The events are jsons with fisically written, between the other things, "START" or "END".

andreafebbo · ‎01-19-2017

I read the documentation and I think it might help me but is not easy to understand deeply how it works. Could you please try to integrate it in my code so I can understand it better? Thanks

andreafebbo · ‎01-19-2017

Hi all! I have something which sends me the START and the STOP of some processes. I have this search that creates a timeline chart and, if in some processes we have just the START event, assumes that this process must be GOING so it attributes to that process endtime = now (just for the sake of drawing the bar) . MY BASE SEARCH | eval StartTime = if(LogType = "START", _time, null) | eval EndTime = if(LogType = "END", _time, null) | stats Latest(StartTime) as StartTime Latest(EndTime) as EndTime Latest(Result) as Result by process id | eval EndTime = if(isnull(EndTime), now(), EndTime) | eval Status = if(isnull(Result), "GOING", Result) | eval duration = (EndTime-StartTime) * 1000 | where (duration != "" OR duration >= 0) | table StartTime process Status duration | sort StartTime Anyway sometimes this process has been killed and does not send the STOP event. The consequence of this is that a process that has been killed continues to draw this bar and if the same process started again, we have overlapping, like in the image: What I would like to do is to exclude those instance of the process which have just a start without having an end but only if another instance of the process is already started. (Instances of the process are identified in the search by the field "id") Example: Event1 -> processA id1 Start Event2 -> processA id2 Start Event3 -> processA id2 end In the previous example, with those events a chart with overlapping (like the image) would come out. So I would like the search to exclude the First start because there is a second start and no end, which means that the process was killed. I hope I was clear in my explanation. Please don't hesitate to ask me any further details. Thank you

andreafebbo · ‎01-17-2017

Is there any way to show it in the title without using the token?

andreafebbo · ‎01-17-2017

I tried to add the option refresh.time.visible but i can't see any changing in the panel. Maybe i'm adding the option in the wrong place. <panel> <title>MAIN</title> <table> <title>Bla</title> <search> <query>my query</query> <earliest>0</earliest> <latest>now</latest> <refresh>$r$</refresh> <refreshType>delay</refreshType> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="rowNumbers">true</option> <option name="wrap">true</option> <option name="refresh.time.visible">true</option> </table> </panel> thank you

andreafebbo · ‎01-16-2017

I noticed that in the new version of Splunk, i can choose to autorefresh panels. So i would like to show when my panel was last refreshed. For doing so I tried to put the last refresh date in a token but it does not work. My code: <panel> <title>MAIN</title> <table> <title>BLA</title> <search> <query> my query | eval lastRrefresh=strftime(now(),"%Y-%m-%d %H:%M:%S") </query> <earliest>0</earliest> <latest>now</latest> <refresh>$r$</refresh> <refreshType>delay</refreshType> <done> <eval token="time">$result.lastRrefresh$</eval> </done> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="rowNumbers">true</option> <option name="wrap">true</option> </table> </panel> For some reason the token does not get any value. Can someone understand why? Is there a better, more simple way of showing the last update of a panel? Thanks

andreafebbo · ‎01-16-2017

I solved everything with an eventype. Thank you!

Posts	65
Solutions	1
Karma Given	38
Karma Received	20
Member Since	‎08-24-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Average on time only, without considering date

Drill down from table to another dashboard

How to use pivot (unpivot) command

Using clustering to calculate start and end of a p...

Join 2 searches with the base search in right join

How to edit my search to avoid overlapping events ...

Splunk 6.5: How to show the timestamp of the last ...

Creating "Custom groups" and using them in a filte...

Showing panel only if in multiple selection menu i...

How to dynamically set the y-axis scale of a chart...

Average on time only, without considering date

Re: Drill down from table to another dashboard

Drill down from table to another dashboard

Re: How to use pivot (unpivot) command

How to use pivot (unpivot) command

Using clustering to calculate start and end of a p...

Re: How to edit my search to avoid overlapping eve...

Re: How to edit my search to avoid overlapping eve...

Re: How to edit my search to avoid overlapping eve...

Re: How to edit my search to avoid overlapping eve...

Re: How to edit my search to avoid overlapping eve...

Re: Join 2 searches with the base search in right ...

Re: Join 2 searches with the base search in right ...

Re: Join 2 searches with the base search in right ...

Re: Join 2 searches with the base search in right ...

Join 2 searches with the base search in right join

Re: How to edit my search to avoid overlapping eve...

Re: How to edit my search to avoid overlapping eve...

Re: How to edit my search to avoid overlapping eve...

Re: How to edit my search to avoid overlapping eve...

How to edit my search to avoid overlapping events ...

Re: Splunk 6.5: How to show the timestamp of the l...

Re: Splunk 6.5: How to show the timestamp of the l...

Splunk 6.5: How to show the timestamp of the last ...

Re: Creating "Custom groups" and using them in a f...