About tmtcollins

tmtcollins · ‎04-29-2022

Worked perfectly! thanks

tmtcollins · ‎04-29-2022

Hi, I would like to create a chart of the error rate over time. I have data that shows status= DOWNLOAD_COMPLETE and status = FAILD I can calculate this for a point in time with the below. But can anyone help get the error rate over time? logType=error OR logType=service context=retrieve status=DOWNLOAD_COMPLETE OR status=FAILED | stats count(correlationId) as total_count by status | transpose header_field=status | eval errorRate=FAILED/(FAILED+DOWNLOAD_COMPLETE)*100 | table DOWNLOAD_COMPLETE, FAILED, errorRate

tmtcollins · ‎10-18-2021

Hi, I'd really appreciate some advice on this. I have a data set looking at users and the apps they have access to. There are 3 apps in total. I want to be able to product a pie chart or visualisation showing the combinations that users have access to. Can anyone give any suggestions on the type of query I need to write? Sample data attached UserID App1 App2 App3 1 0 1 0 2 0 1 0 3 0 1 0 4 0 1 0 5 0 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 1 1 1 10 1 1 1 11 1 1 1 12 1 1 0 13 1 1 0 14 1 1 0 15 0 0 0 16 0 0 0 Many thanks, Tim

tmtcollins · ‎09-06-2021

Hi, I hope someone can help guide me in what type of query or visualisation to use here so show the linkage of access permissions. I have a simple data set like the format below (I have a much bigger dataset) It shows a user ID and the access they have to a folder. Users can have access to more than one folder. I would like to answer the question: Of the users who have access to a specific folder, say "Apple", what other folders to they have access to and what are the associated volumes with that connection. I was thinking Sankey diagram but I am having trouble getting the data in the right format. UserID Folder 1 Apple 1 Banana 2 Apple 3 Apple 3 Orange Many thanks, Tim

tmtcollins · ‎09-03-2021

Hi, I need to do some analysis on access permissions of an application. I want to graphically show the relationships of users and the access they have. I have a simple data set like the format below (I have a much bigger dataset): I would like to answer the question: Of the users who have access to a specific folder, say "Apple", what other folders to they have access to and what are the associated volumes with that connection. I was thinking Sankey diagram but I am having trouble getting the data in the right format. Any help would be really appreciated. UserID Folder 1 Apple 1 Banana 2 Apple 3 Apple 3 Orange

tmtcollins · ‎03-13-2020

Amazing thank you sir.

tmtcollins · ‎03-06-2020

I have a table: PageID, UserName, Date, count of hits to that page, I would like to find the average daily page hits , per article at a UserID level. (for the top 100 most frequently viewed pages) So for example, Person xyz , on average views page x , n number of times per day over the last week. This is the start of the query... ... | bucket span=1d _time| stats count by PageID, UserName , _time | sort - count |head 100 Any help much appreciated.

tmtcollins · ‎11-28-2019

You sir, are a splunk answering machine.. This did the trick! I had a slight issue because by bin/bucket range was so large that I changed span=50 bins=5 to span=1log5 Many thanks, Tim

tmtcollins · ‎11-27-2019

I have a list of article IDs and their corresponding article view counts for a given day. I want to see what percentage of articles are viewed between 1-50 times per day, 51-100 times per day, 101-150 times per day, 151-200 times per day and then >201 times per day. ( I may want to further configure these buckets later) My basic search to get the article ID and count is attached. sourcetype=200000747_ivu_access|where id !="" and UserName!="-"|lookup ECCOUser.csv ADSID as UserName OUTPUT Country Department Organisation | lookup ArticleDetails.csv ArticleID as id OUTPUT ArticleTitle|transaction UserName maxpause=30s| stats count(id) as ArticleCount by id |sort ArticleCount desc Many thanks for any help, I am struggling with this one.

tmtcollins · ‎04-09-2019

I am pretty new to Splunk and this is my first posted question so here goes... I have an application and I need to identify: Total distinct users (all time) Total distinct users (Week to date) My query for total distinct users is basic - ns=monocle Action=Search|stats distinct_count(Email) The problem is that this query takes ages to run as it has to calculate the total every time it is run. Is there a more efficient way of doing this? For example, a way of saving the previous results to make the next calculation simpler? Many thanks, Tim

Posts	10
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎04-09-2019

Online Status	Offline
Date Last Visited	‎04-30-2022 12:00 AM

How to create a chart of the error rate over time?

Analysing combinations

Help please! - linkage analysis in Splunk

analysing/visualising one to many relationships

Average page views at a user level for a given pag...

Searching for percentage of total count grouped in...

Save results to avoid recalculation for new users ...

Re: chart to show error rate