Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ALXWBR
ALXWBR
Path Finder
Member since:
04-11-2018
03-19-2024
Community Statistics
| Posts | 31 |
| Solutions | 4 |
| Karma Given | 3 |
| Karma Received | 6 |
| Member Since | 04-11-2018 |
Activity Feed
- Posted Re: Calculate the number of events that occur between two other time values in each event. on Splunk Search. 03-01-2024 07:50 AM
- Posted Re: Calculate the number of events that occur between two other time values in each event. on Splunk Search. 03-01-2024 06:25 AM
- Posted Re: Calculate the number of events that occur between two other time values in each event. on Splunk Search. 03-01-2024 06:22 AM
- Posted Re: Calculate the number of events that occur between two other time values in each event. on Splunk Search. 03-01-2024 04:12 AM
- Posted Calculate the number of events that occur between two other time values in each event. on Splunk Search. 03-01-2024 01:42 AM
- Tagged Calculate the number of events that occur between two other time values in each event. on Splunk Search. 03-01-2024 01:42 AM
- Got Karma for Hide Menus in New Splunk Dashboard Studio. 12-07-2023 03:42 AM
- Posted Format row colour in multiple tables on a dashboard based on column value on Dashboards & Visualizations. 03-23-2023 04:17 AM
- Posted Re: Hide Menus in New Splunk Dashboard Studio on Dashboards & Visualizations. 02-03-2022 04:25 AM
- Posted Re: Rolling txt file keeps re-indexing events on Getting Data In. 11-05-2021 05:19 AM
- Posted Monitored txt file keeps re-indexing events on Getting Data In. 11-05-2021 03:23 AM
- Tagged Hide Menus in New Splunk Dashboard Studio on Dashboards & Visualizations. 07-05-2021 01:41 AM
- Tagged Hide Menus in New Splunk Dashboard Studio on Dashboards & Visualizations. 07-05-2021 01:41 AM
- Posted Hide Menus in New Splunk Dashboard Studio on Dashboards & Visualizations. 07-01-2021 06:52 AM
- Posted Re: Unable to break JSON events from a REST Modular input (SPLUNK CLOUD) AGAIN on Dashboards & Visualizations. 05-07-2021 02:31 AM
- Posted Unable to break JSON events from a REST Modular input (SPLUNK CLOUD) AGAIN on Dashboards & Visualizations. 05-07-2021 01:48 AM
- Tagged Unable to break JSON events from a REST Modular input (SPLUNK CLOUD) AGAIN on Dashboards & Visualizations. 05-07-2021 01:48 AM
- Tagged Unable to break JSON events from a REST Modular input (SPLUNK CLOUD) AGAIN on Dashboards & Visualizations. 05-07-2021 01:48 AM
- Tagged Unable to break JSON events from a REST Modular input (SPLUNK CLOUD) AGAIN on Dashboards & Visualizations. 05-07-2021 01:48 AM
- Karma Re: Can we track changes to a file for paulbannister. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-01-2024
07:50 AM
Ahhh ok, so the reason it wasn't working is because the ASRT and ATOT_ALDT were part of the same event, the example was effectively the events tabled. So now I have split the two timestamps into two separate events, your code works (couple of typos in the streamstats line, but sorted those). This is what I did. Thanks for all your help! | eval
asrt_epoch = strptime(ASRT,"%Y-%m-%d %H:%M:%S"),
runway_epoch = strptime(ATOT_ALDT,"%Y-%m-%d %H:%M:%S"),
event="ASRT_".asrt_epoch.","."ATOT_ALDT_".runway_epoch,
event=if(isnull(event),"ATOT_ALDT_".runway_epoch,event)
| makemv event delim=","
| mvexpand event
| rex field=event "^(?P<event>(ATOT_ALDT|ASRT))_(?P<_time>.+)$"
| sort _time
| streamstats count(eval(if(event="ATOT_ALDT",1,null()))) as times_busy
| stats values(event) as states values(times_busy) as busy values(ATOT_ALDT) as ATOT_ALDT by displayed_flyt_no
| sort ATOT_ALDT
| where states="ASRT" AND states="ATOT_ALDT"
| eval queue=(max(busy)-1)-(min(busy))
... View more
03-01-2024
06:25 AM
Lets take flight16 in my example. It had an ASRT timestamp of 06:19 and an ATOT_ALDT of 06:32. Flight15 had an ATOT_ALDT of 06:19, flight14 06:29 and flight15 06:31, so that's 3 flights that used the runway between the ASRT and ATOT of flight16.
... View more
03-01-2024
06:22 AM
Thanks @PickleRick, however, that search doesn't work for me. Not sure if I've made it clear enough. So for every single departing flight in the table (DepOrArr=D), I need to count the total of other flights who's ATOT_ALDT time was between the ASRT timestamp and ATOT_ALDT timestamp of that flight. So if Flight1234 has and ASRT of 09:00 and an ATOT_ALDT of 09:15, how many other flights in the list had an ATOT_ALDT timestamp between those 2 times. And then so on for the next flight...etc etc. What makes this more complicated is a flight can have an ASRT timestamp after another flight but still have an ATOT_ALDT timestamp before.
... View more
03-01-2024
04:12 AM
I'm not sure that approach would work? Are you able to share some SPL with me so I can fully understand what your approach is. Here's some sample data. I've worked out what the values should be using excel with a good ol' fashioned countif. DepOrArr displayed_flyt_no ASRT asrt_epoch ATOT_ALDT runway_epoch queue A flight1 29/02/2024 00:52 1709167953 A flight2 29/02/2024 01:41 1709170889 A flight3 29/02/2024 05:08 1709183310 A flight4 29/02/2024 05:33 1709184834 A flight5 29/02/2024 05:36 1709185003 A flight6 29/02/2024 05:40 1709185247 A flight7 29/02/2024 05:51 1709185889 A flight8 29/02/2024 06:01 1709186519 A flight9 29/02/2024 06:04 1709186679 D flight10 29/02/2024 05:49 1709185740 29/02/2024 06:08 1709186895 3 D flight11 29/02/2024 05:57 1709186220 29/02/2024 06:10 1709187000 3 D flight12 29/02/2024 06:03 1709186580 29/02/2024 06:14 1709187280 3 A flight13 29/02/2024 06:19 1709187540 D flight14 29/02/2024 06:15 1709187300 29/02/2024 06:29 1709188186 1 D flight15 29/02/2024 06:16 1709187360 29/02/2024 06:31 1709188261 2 D flight16 29/02/2024 06:19 1709187540 29/02/2024 06:32 1709188338 3 D flight17 29/02/2024 06:22 1709187720 29/02/2024 06:34 1709188485 3 D flight18 29/02/2024 06:31 1709188260 29/02/2024 06:42 1709188973 3 A flight19 29/02/2024 06:44 1709189074 D flight20 29/02/2024 06:32 1709188320 29/02/2024 06:46 1709189180 4 D flight21 29/02/2024 06:38 1709188680 29/02/2024 06:47 1709189278 3 A flight22 29/02/2024 06:49 1709189378 D flight23 29/02/2024 06:27 1709188020 29/02/2024 06:51 1709189475 9 A flight24 29/02/2024 06:52 1709189531 D flight25 29/02/2024 06:36 1709188560 29/02/2024 06:54 1709189648 7 A flight26 29/02/2024 06:55 1709189707 D flight27 29/02/2024 06:43 1709188980 29/02/2024 06:56 1709189807 8 A flight28 29/02/2024 06:57 1709189868 D flight29 29/02/2024 06:45 1709189100 29/02/2024 06:59 1709189970 9 A flight30 29/02/2024 07:01 1709190080 D flight31 29/02/2024 06:46 1709189160 29/02/2024 07:03 1709190229 11 D flight32 29/02/2024 06:49 1709189340 29/02/2024 07:04 1709190292 10 D flight33 29/02/2024 06:47 1709189220 29/02/2024 07:06 1709190373 12 D flight34 29/02/2024 06:53 1709189580 29/02/2024 07:07 1709190447 9 D flight35 29/02/2024 06:50 1709189400 29/02/2024 07:09 1709190577 12 A flight36 29/02/2024 07:10 1709190630 D flight37 29/02/2024 06:56 1709189760 29/02/2024 07:12 1709190720 10 A flight38 29/02/2024 07:13 1709190798 D flight39 29/02/2024 06:55 1709189700 29/02/2024 07:14 1709190892 13 A flight40 29/02/2024 07:15 1709190939 D flight41 29/02/2024 06:57 1709189820 29/02/2024 07:16 1709191019 13 D flight42 29/02/2024 06:45 1709189100 29/02/2024 07:18 1709191096 22 A flight43 29/02/2024 07:18 1709191123 D flight44 29/02/2024 07:04 1709190240 29/02/2024 07:20 1709191225 12 D flight45 29/02/2024 07:06 1709190360 29/02/2024 07:21 1709191299 12 A flight46 29/02/2024 07:22 1709191364 D flight47 29/02/2024 07:07 1709190420 29/02/2024 07:24 1709191474 13 A flight48 29/02/2024 07:25 1709191548 D flight49 29/02/2024 06:59 1709189940 29/02/2024 07:27 1709191640 20 A flight50 29/02/2024 07:28 1709191701 D flight51 29/02/2024 06:58 1709189880 29/02/2024 07:29 1709191786 22 A flight52 29/02/2024 07:31 1709191881 D flight53 29/02/2024 07:10 1709190600 29/02/2024 07:34 1709192073 17 D flight54 29/02/2024 07:11 1709190660 29/02/2024 07:35 1709192137 17 A flight55 29/02/2024 07:36 1709192194 D flight56 29/02/2024 07:12 1709190720 29/02/2024 07:38 1709192299 19 A flight57 29/02/2024 07:38 1709192339 D flight58 29/02/2024 07:16 1709190960 29/02/2024 07:40 1709192441 17 A flight59 29/02/2024 07:41 1709192511 D flight60 29/02/2024 07:04 1709190240 29/02/2024 07:43 1709192613 28 A flight61 29/02/2024 07:44 1709192692 D flight62 29/02/2024 07:17 1709191020 29/02/2024 07:46 1709192788 20 D flight63 29/02/2024 07:19 1709191140 29/02/2024 07:47 1709192845 19 A flight64 29/02/2024 07:48 1709192888 D flight65 29/02/2024 07:23 1709191380 29/02/2024 07:49 1709192986 18 D flight66 29/02/2024 07:27 1709191620 29/02/2024 07:50 1709193048 17 A flight67 29/02/2024 07:51 1709193089
... View more
03-01-2024
01:42 AM
Really struggling with this one, so looking for a hero to come along with a solution! I have an index of flight data. Each departing flight has a timestamp for when the pilot calls up to the control tower to request to push back, this field is called ASRT (Actual Start Request Time). Each flight also has a time that it uses the runway, this is called ATOT_ALDT (Actual Take Off Time/Actual Landing Time). What I really need to calculate, is for each departing flight, how many over flights used the runway (had an ATOT_ALDT) between when the flight calls up (ASRT) and then uses the runway itself (ATOT_ALDT). This is to work out what the runway queue was like for each departing aircraft. I have tried using the concurrency command, however, this doesn't return the desired results as it only shows the number flights that started before and not the ones that started after. We may have a situation where an aircraft calls up after one before but then departs before. And this doesn't capture that. So I've found an approach that in theory should work. I ran an eventstats that lists the take off/landing time of every flight, so then I can mvexpand that and run an eval across each line. However, multi-value fields have a limit of 100, and there can be up to 275 flights in the time period I need to check. Can anyone else think of a way of achieving this? My code is below: REC_UPD_TM = the time the record was updated (this index uses the flights scheduled departure time as _time, so we need to find the latest record for each flight) displayed_flyt_no = The flight number e.g EZY1234 DepOrArr = Was the flight a departure or an arrival. index=flights
| eval _time = strptime(REC_UPD_TM."Z","%Y-%m-%d %H:%M:%S%Z")
| dedup AODBUniqueField sortby - _time
| fields AODBUniqueField DepOrArr displayed_flyt_no ASRT ATOT_ALDT
| sort ATOT_ALDT
| where isnotnull(ATOT_ALDT)
| eval
asrt_epoch = strptime(ASRT,"%Y-%m-%d %H:%M:%S"),
runway_epoch = strptime(ATOT_ALDT,"%Y-%m-%d %H:%M:%S")
| table DepOrArr displayed_flyt_no ASRT asrt_epoch ATOT_ALDT runway_epoch
| eventstats list(runway_epoch) as runway_usage
| search DepOrArr="D"
| mvexpand runway_usage
| eval queue = if(runway_usage>asrt_epoch AND runway_usage<runway_epoch,1,0)
| stats sum(queue) as queue by displayed_flyt_no
... View more
- Tags:
- concurrency
Labels
- Labels:
-
eval
-
fields
-
stats
-
transaction
03-23-2023
04:17 AM
I have a dashboard that I'm working on that requires me to conditionally format table rows based on a field. The dashboard currently has 6 identical tables (in terms of the column names) and I need to be able to apply the JavaScript to each of them. I am aware that I can just state each table in the JavaScript, however, ideally I'd like to not have to do that, as I'm going to be adding additional tables to the dashboard over time. As this will live on cloud, I don't want to have to keep uploading the app every time I make a change. Is there a way to replace 'the get('highlight01')' with something more generic or even loop that aspect of the code for all tables on the dashboard? requirejs([
// It's important that these don't end in ".js" per RJS convention
'../app/TA-lgw_images_and-_files/libs/jquery-3.6.0-umd-min',
'../app/TA-lgw_images_and-_files/libs/underscore-1.6.0-umd-min',
'../app/TA-lgw_images_and-_files/theme_utils',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/simplexml/ready!'
], function($, _, themeUtils, mvc, TableView) {
// Row Coloring Example with custom, client-side range interpretation
var CustomRangeRenderer = TableView.BaseCellRenderer.extend({
canRender: function(cell) {
// Enable this custom cell renderer
return _(['target_met']).contains(cell.field);
},
render: function($td, cell) {
// Add a class to the cell based on the returned value
var value = parseFloat(cell.value);
// Apply interpretation for number of historical searches
if (cell.field === 'target_met') {
if (value > 0) {
$td.addClass('range-cell').addClass('range-elevated');
}
}
// Update the cell content
$td.text(value.toFixed(2)).addClass('numeric');
}
});
mvc.Components.get('highlight01').getVisualization(function(tableView) {
tableView.on('rendered', function() {
// Apply class of the cells to the parent row in order to color the whole row
tableView.$el.find('td.range-cell').each(function() {
$(this).parents('tr').addClass(this.className);
});
});
// Add custom cell renderer, the table will re-render automatically.
tableView.addCellRenderer(new CustomRangeRenderer());
});
}); Example dashboard XML you can use <dashboard version="1.1" script="dpi_ops_evaluation.js" stylesheet="dpi_ops_evaluation.css">
<label>DPI TEST</label>
<row>
<panel>
<table id="highlight01">
<search>
<query>| makeresults count=6
| streamstats count as Ref
| eval target_met = random() % 2,
measure= "Measure ".Ref
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<table id="highlight02">
<search>
<query>| makeresults count=6
| streamstats count as Ref
| eval target_met = random() % 2,
measure= "Measure ".Ref
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<table id="highlight03">
<search>
<query>| makeresults count=6
| streamstats count as Ref
| eval target_met = random() % 2,
measure= "Measure ".Ref
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<table id="highlight04">
<search>
<query>| makeresults count=6
| streamstats count as Ref
| eval target_met = random() % 2,
measure= "Measure ".Ref
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<table id="highlight05">
<search>
<query>| makeresults count=6
| streamstats count as Ref
| eval target_met = random() % 2,
measure= "Measure ".Ref
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<table id="highlight06">
<search>
<query>| makeresults count=6
| streamstats count as Ref
| eval target_met = random() % 2,
measure= "Measure ".Ref
| fields - _time</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>
... View more
Labels
- Labels:
-
CSS
-
dashboard
-
javascript
02-03-2022
04:25 AM
Not currently, no, however I submitted it as an idea and its planned for a future release https://ideas.splunk.com/ideas/EID-I-1063
... View more
11-05-2021
05:19 AM
Yup, no joy. I've just been monitoring it more carefully. It actually looks like its indexing each event ~100 times in the first place. I ran a real time search to see each event come in live and this one for example indexed 99 times.
... View more
11-05-2021
03:23 AM
PLEASE HELP! This has been driving me mad for days! Every time an event is added, its re-reading the text file from the start and re-indexing events. I am getting hundreds of duplicate events and have tried a variety of combos in the inputs.conf, but still cant solve it! I am monitoring a series of text files. Each day a new .txt file is created and events are written into this text continuously throughout the day, until the beginning of the next, where again a new file is created. the files are named as follows. Statistics_20211104_034330_840.txt The contents of the file is as follows QPS statistics: SW-Version:3.64 [UTC+00:00] time,id,valid,invalid,mode,......[ETC ETC ETC] 2021-11-04T03:43:19+00:00,248559,1,0,A,....[ETC ETC ETC] 2021-11-04T03:43:19+00:00,248560,1,0,A,....[ETC ETC ETC] This is what I currently have in the inputs.conf [monitor://\\Lgwnasapp002\bsr$\] disabled = false index = idx_security_scanner sourcetype = QPSdata whitelist = .+Statistics_\d{8}_\d{6}_\d{1,5}\.txt crcSalt = <SOURCE> Any ideas?
... View more
Labels
- Labels:
-
heavy forwarder
-
inputs.conf
-
monitor
07-01-2021
06:52 AM
1 Karma
Does anyone know if it is possible to automatically hide the navigation menus on the new Splunk Dashboard Studio dashboards? On classic dashboards you could just use hideChrome="true". Or if its even possible to default open a page in full screen mode? We just want to display some dashboards on some kiosks, however, the menus look untidy.
... View more
Labels
- Labels:
-
Dashboard Studio
05-07-2021
02:31 AM
Solved it myself class BlipTrackHandler:
def __init__(self,**args):
pass
def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
if response_type == "json":
output = json.loads(raw_response_output)
for measurement in output["measurements"]:
measurement["currentServerTime"] = output["currentServerTime"]
print_xml_stream(json.dumps(measurement))
else:
print_xml_stream(raw_response_output) And changed the sourcetype to json_no_timestamp
... View more
05-07-2021
01:48 AM
We are pulling some data from REST using REST API Modular Input (splunkbase.splunk.com/app/1546/), Response type json, and receiving the below response {
currentServerTime: 2021-05-07T07:01:35.652+0000
measurements: [
{
count: 0
open: true
resultId: CSA_S_FT_L_ANY
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_ANY
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_7
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_6
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_5
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_4
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_3
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_10
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_2
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_1
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
calculatedTimeInSeconds: 0
count: 0
open: true
resultId: CSA_N_REG_L_2
time: 00:10:00
timeInSeconds: 600
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_1
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_10
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_4
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_9
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_3
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_8
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_6
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
calculatedTimeInSeconds: 0
count: 0
open: true
resultId: CSA_N_FT_L_8
time: 00:05:00
timeInSeconds: 300
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_5
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_8
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_7
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_FT_L_10
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_9
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_FT_L_9
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_ANY
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_FT_L_3
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_FT_L_2
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_FT_L_1
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_FT_L_ANY
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
]
} We would like to split each individual result into individual events using "updated" as the timestamp, however, no matter what I have tried, I can't get Splunk to break the events. I've tried writing a custom response handler, but it's not working, this isn't my area of expertise so i'm really struggling! This is what I have written. class BlipTrackHandler:
def __init__(self,**args):
pass
def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
if response_type == "json":
output = json.loads(raw_response_output)
for measurement in output["measurements"]:
measurement["timestamp"] = output["measurements"]["updated"]
print_xml_stream(json.dumps(measurement))
else:
print_xml_stream(raw_response_output) Is anyone able to help?
... View more
Labels
- Labels:
-
other
01-28-2020
02:00 AM
Hi @alexspunkshell
On the single viz, select format visualisation, then select color.
Under use colors, select 'Yes'
Then change the first range from min to 0 with color red and set the second range from 0 to max with color green.
... View more
08-20-2019
07:06 AM
1 Karma
David....there are no words to describe how grateful I am!
That appears to have done the trick! Thank you so much! I've been racking my brain over that one for hours. I was all over the reset_after etc. too!
Have a great day!
... View more
08-20-2019
06:51 AM
1 Karma
Hi
I'm a little confused as to what you are actually trying to achieve here, but if it's a count of time ranges where there are zero logs then you could try the below?
index=mssql_db source=event_log "Completed : Automated Process Aii - Hunter : 29 : System Process - Ai2 Express Queue"
| eval date_hourmin = strftime(_time, "%H%M%S"),
time_bin = case(date_hourmin >= 071000 AND date_hourmin <= 072000, "07", date_hourmin >= 091000 AND date_hourmin <= 092000, "09", date_hourmin >= 111000 AND date_hourmin <= 112000, "11", date_hourmin >= 131000 AND date_hourmin <= 132000, "13", date_hourmin >= 151000 AND date_hourmin <= 152000, "15", date_hourmin >= 171000 AND date_hourmin <= 172000, "17", date_hourmin >= 191000 AND date_hourmin <= 192000, "19", date_hourmin >= 211000 AND date_hourmin <= 212000, "21")
| stats count as logs by time_bin
| stats count(eval(logs=0)) as missing_logs
... View more
08-20-2019
05:35 AM
This is the second time I have come across this problem but I really can't seem to find any answer anywhere. I need to streamstats sum a number field that has positive and negative integers, but I don't want the answer to go below zero. Fore example:
If the FIELD column represents the values I want to sum, then currently a streamstats sum(FIELD) command produces results in the CURRENT column, where as, I need it to calculate as the DESIRED column.
This is because I am reviewing capacity usage and I can't have it negatively used.
PLEASE HELP!!!
... View more
08-09-2019
03:32 AM
Looks good, thank you 🙂
... View more
07-25-2019
07:47 AM
Error in 'eval' command: The expression is malformed. An unexpected character is reached at ') )'.
index=idx_sems source="sems_north" sourcetype=SEMSSmartLaneEvents Tag="XRY_STVD" EquipmentID=3
| transaction EquipmentID startswith=TagBitData="1" endswith=TagBitData="0"
| timechart span=15m sum(duration) as total
| eval amount=coalesce(case((total/900)>1 AND round(total/900,0)>(total/900), round(total/900,0), (total/900)>1 AND round(total/900,0)<(total/900), round(total/900,0)+1), 0)
| streamstats current=f count as counter
| eval carryover=if(total>900, total-900, 0)
| eval future=if(carryover>0, counter+amount, 0)
| eval group=case(
[| search index=idx_sems source="sems_north" sourcetype=SEMSSmartLaneEvents Tag="XRY_STVD" EquipmentID=3
| transaction EquipmentID startswith=TagBitData="1" endswith=TagBitData="0"
| timechart span=15m sum(duration) as total
| eval amount=coalesce(case((total/900)>1 AND round(total/900,0)>(total/900), round(total/900,0), (total/900)>1 AND round(total/900,0)<(total/900), round(total/900,0)+1), 0)
| streamstats current=f count as counter
| eval carryover=if(total>900, total-900, 0)
| eval future=if(carryover>0, counter+amount, 0)
| search NOT future=0
| stats min(counter) as counter by future
| sort 0 - future
| eval future="counter<=".future
| eval counter="counter>=".counter
| streamstats count as group
| eval search="(".counter." AND ".future."), \"".group."\""
| stats list(search) as search
| eval search=mvjoin(search, ", ")])
| eventstats max(amount) as maxamount max(future) as maxfuture max(total) as maxcarryover count as groupcount by group
| eval finalTotal=case(isnotnull(group) AND (NOT counter=maxfuture OR groupcount=1), 900, isnotnull(group) AND counter=maxfuture, (maxcarryover-((maxamount-1)*900))+coalesce(total,0), isnull(group), total)
| eval finalcarryover=if(finalTotal>900, finalTotal-900, null())
| streamstats window=1 current=f values(finalcarryover) as lastfinalcarryover
| eval finaltotal=case(finalTotal>=900, 900, finalTotal<900 AND (lastfinalcarryover+finalTotal)<900, lastfinalcarryover+finalTotal, finalTotal<900 AND (lastfinalcarryover+finalTotal)>900, 900, finalTotal<900 AND NOT (lastfinalcarryover+finalTotal)<900 AND NOT (lastfinalcarryover+finalTotal)>900, finalTotal)
| rename total as oldTotal
| table _time oldTotal finaltotal
... View more
07-25-2019
06:32 AM
I'm getting an error in the | eval group=case(.....
Only works with makeresults but not search
😞
... View more
07-25-2019
02:09 AM
Sorry, but still not there. That period between 03:00 and 04:00 isn't right.
_time oldTotal finalTotal
2019-07-22 00:00:00
2019-07-22 00:15:00
2019-07-22 00:30:00
2019-07-22 00:45:00
2019-07-22 01:00:00
2019-07-22 01:15:00
2019-07-22 01:30:00
2019-07-22 01:45:00
2019-07-22 02:00:00
2019-07-22 02:15:00 98.893 98.893
2019-07-22 02:30:00 937.92 900
2019-07-22 02:45:00 1009.674 900
2019-07-22 03:00:00 2593.638 900
2019-07-22 03:15:00 900
2019-07-22 03:30:00 793.638
2019-07-22 03:45:00 706.153 706.153
2019-07-22 04:00:00 1015.469 900
2019-07-22 04:15:00 451.892 115.469
2019-07-22 04:30:00 329.411 329.411
2019-07-22 04:45:00 319.438 319.438
... View more
07-24-2019
08:03 AM
I've been racking my brain with streamstats>eval>if combos for two days now and just can't seem to find the combo.
... View more
07-24-2019
07:57 AM
oh yeah sorry! Well the machines could be out of use for a few hours at times, for example, the day I am looking at right now has a transaction over 10,000 seconds long, which would roll over into 12 buckets.
... View more
07-24-2019
07:48 AM
Thanks for this. However it's not quite doing the trick. Its only rolling over twice, but if the number is in excess of 2700, it doesn't continue to keep rolling down until the seconds have all bee accounted for.
... View more
07-24-2019
05:54 AM
Hi Giuseppe
There are no orphans, there's only ever a start and an end event which is very consistent.
... View more
07-24-2019
05:19 AM
I am running the below search to get a sum of starvation per 15 minute period. The problem I am having, is that duration is always attributed to the start time of the event; So if the starvation runs over more than one 15 minutes period, it's still attributing it back to the start time-slice. Ideally I need it to roll over seconds into the next span if they exceed 900 seconds.
Here is the search:
index=idx_sems source="sems_north" sourcetype=SEMSSmartLaneEvents Tag="XRY_STVD" EquipmentID=3
| transaction EquipmentID startswith=TagBitData="1" endswith=TagBitData="0"
| timechart span=15m sum(duration) as total
Here is an example of the result
_time sum
2019-07-22 02:15:00 98.893
2019-07-22 02:30:00 937.92
2019-07-22 02:45:00 1009.674
2019-07-22 03:00:00 2593.638
2019-07-22 03:15:00
2019-07-22 03:30:00
2019-07-22 03:45:00 706.153
I need to to show a maximum of 900 in the sum and roll down any difference.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-19-2024
06:59 AM
|
Karma from
