Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gt_dev
gt_dev
Explorer
Member since:
12-13-2016
12-11-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 12-13-2016 |
Activity Feed
- Karma Splunk integration with statuspage for kpavan. 06-05-2020 12:50 AM
- Karma Re: Converting relative time into epoch for the time range picker for niketn. 06-05-2020 12:49 AM
- Got Karma for Re: Converting relative time into epoch for the time range picker. 06-05-2020 12:49 AM
- Got Karma for Re: Are real-time dashboards for NOC putting too much strain on the Splunk Cloud environment?. 06-05-2020 12:49 AM
- Karma Re: replace one backslash by double backslash for cphair. 06-05-2020 12:46 AM
- Posted Re: Are real-time dashboards for NOC putting too much strain on the Splunk Cloud environment? on Dashboards & Visualizations. 08-01-2018 09:04 AM
- Posted Re: Are real-time dashboards for NOC putting too much strain on the Splunk Cloud environment? on Dashboards & Visualizations. 08-01-2018 08:52 AM
- Posted Re: Are real-time dashboards for NOC putting too much strain on the Splunk Cloud environment? on Dashboards & Visualizations. 08-01-2018 04:29 AM
- Posted Are real-time dashboards for NOC putting too much strain on the Splunk Cloud environment? on Dashboards & Visualizations. 07-31-2018 02:01 PM
- Tagged Are real-time dashboards for NOC putting too much strain on the Splunk Cloud environment? on Dashboards & Visualizations. 07-31-2018 02:01 PM
- Tagged Are real-time dashboards for NOC putting too much strain on the Splunk Cloud environment? on Dashboards & Visualizations. 07-31-2018 02:01 PM
- Tagged Are real-time dashboards for NOC putting too much strain on the Splunk Cloud environment? on Dashboards & Visualizations. 07-31-2018 02:01 PM
- Posted Re: Converting relative time into epoch for the time range picker on Splunk Search. 07-20-2018 11:16 AM
- Posted Re: Why does having multiple values for mvlist produce unexpected results for my transaction search? on Splunk Search. 01-04-2017 07:44 AM
- Posted Re: Why does having multiple values for mvlist produce unexpected results for my transaction search? on Splunk Search. 01-04-2017 07:43 AM
- Posted Why does having multiple values for mvlist produce unexpected results for my transaction search? on Splunk Search. 12-14-2016 04:41 AM
- Tagged Why does having multiple values for mvlist produce unexpected results for my transaction search? on Splunk Search. 12-14-2016 04:41 AM
- Tagged Why does having multiple values for mvlist produce unexpected results for my transaction search? on Splunk Search. 12-14-2016 04:41 AM
- Tagged Why does having multiple values for mvlist produce unexpected results for my transaction search? on Splunk Search. 12-14-2016 04:41 AM
- Tagged Why does having multiple values for mvlist produce unexpected results for my transaction search? on Splunk Search. 12-14-2016 04:41 AM
Topics I've Started
08-01-2018
09:04 AM
1 Karma
thank you again @daljeanis. I can work with data models and saved searches to make my dashboards.
... View more
08-01-2018
08:52 AM
sorry, maybe there has been some confusion on my first question. My first question specifically asks if SPLUNK can support real time dashboards that run every minute. Supports in this case means that they can sustain a dashboard (hopefully multiple) running at that frequency. Other vendors are doing this and it seems odd that SPLUNK would not be focused on this.
... View more
08-01-2018
04:29 AM
@DalJeanis, thank you very much for your answer.
Currently our NOC is full of real-time dashboards that watch a number of our major applications. A real-time dashboard is required to see when performance starts to degrade so that people can react to that outage. If the data comes in every 10 minutes then we could potentially be 10 minutes behind a problem. For those that work in operations/support we all know that being 10 minutes behind a problem is almost useless.
I feel that SPLUNK needs to figure this out because their competition is already guaranteeing real-time dash-boarding for exactly the the scenario I state above. I feel that .conf should have some data regarding this and i hope its as good as it can be.
... View more
07-31-2018
02:01 PM
We have a NOC and have started to use some SPLUNK dashboards to show the performance of specific applications. The dashboards show 1-2hours of data and refresh every 60 seconds. Recently we have been getting mixed information about the viability of doing this and have been told that refreshing every 60 seconds puts too much strain on the SPLUNK Cloud environment.
Can SPLUNK Cloud handle real-time dashboarding?
what are the best practices for NOC dashboards that need to show data quickly so as to make it actionable?
... View more
07-20-2018
11:16 AM
1 Karma
I have been looking for this answer for about 3 hours today. Thank you very much!
... View more
01-04-2017
07:44 AM
...continued:
If i use mvlist=true i get the following:
... View more
01-04-2017
07:43 AM
When i use the following in my transaction line:
| transaction visitID mvlist=actionName
I get the following results:
When i use the following in my transaction line:
| transaction visitID mvlist=actionName, apdex_score
I get the following results:
... View more
12-14-2016
04:41 AM
I am still not able to get 2 fields in the mvlist list. Here is my transaction line now:
| transaction visitID mvlist=actionName
I get a nice set of values that groups actions by visitID. However, if I change the above line to:
| transaction visitID mvlist=actionName,event_time
I get a totally different result set that doesn't look anything like the way I want it. Below is my full search:
source="/var/log/logstash/dynatraceqa*" businessTransaction="Real User Page Actions - Copy"
| transaction visitID mvlist=actionName
| table application, visitID, event_time, actionName, eventcount
| sort event_time
| addtotals row=f col=t fieldname=Total labelfield=actionName eventcount
| rename event_time as "Start Time", application as "Application", visitID as "Visit ID", actionName as "User Action". eventcount as "Action Count"
... View more
12-13-2016
01:25 PM
I am still not able to get 2 fields in the mvlist list. Here is my transaction line now:
| transaction visitID mvlist=actionName
i get a nice set of values that groups actions by visitID. However, if i change the above line to:
| transaction visitID mvlist=actionName,event_time
I get a totally different result set that doesn't look anything like the way i want it. Below is my full query:
source="/var/log/logstash/dynatraceqa*" businessTransaction="Real User Page Actions - Copy"
| transaction visitID mvlist=actionName
| table application, visitID, event_time, actionName, eventcount
| sort event_time
| addtotals row=f col=t fieldname=Total labelfield=actionName eventcount
| rename event_time as "Start Time", application as "Application", visitID as "Visit ID", actionName as "User Action". eventcount as "Action Count"
... View more
