About mrhodes93

mrhodes93 · ‎03-22-2022

I have two separate queries that I am presenting as unique pie charts on a dashboard, the second being a further breakdown of one of the categories of the first search. Is it possible, as in Excel, to have a pie of pie chart where the further breakdown of one category is present within the same chart, or do they have to be two independent charts as I'm doing currently? No code sample to demonstrate as I have no idea of the feasibility.

mrhodes93 · ‎04-29-2021

I've got logs that contain a timestamp in 24 hour YYYY-MM-DD HH:MM:ss:SSS format (example: 2021-04-29 18:43:07.557). The timestamp in this log message is +5 hours ahead of the _time of the event. So far I've got this much, which extracts the timestamp from the message but I don't know how to go about showing the difference between these two, especially with the five hour offset. Ideally would just like to show a third value of the difference in the table. Appreciate any instruction. sourcetype="PCF:log" cf_app_name=app1 (msg="*message query here*") | rex field=msg "created on\s+(?<lockTime>\S+\s+\S+)" | table _time,lockTime _time lockTime Expected 2021-04-28 12:46:37.381 2021-04-28 17:46:33.961 00:00:03.420 I should mention too that only the time portion, not the date, will need the difference calculated. The YYYY-MM-DD will always be the same between _time and lockTime.

mrhodes93 · ‎06-26-2020

This is fantastic, I'm fairly new to splunk and was not aware of transaction. It seems as though it overcomes an issue like: launch, complete, launch (exit without completing) The second launch without a complete is not considered part of the transaction, hence the time is discarded from the calculation. Am I understanding that correctly?

mrhodes93 · ‎06-26-2020

Considering the following two messages: sourcetype="PCF:log" cf_app_name=app1 msg="launch processing started" UserID: ABC sourcetype="PCF:log" cf_app_name=app1 msg="flow complete" UserID: ABC I want to capture the elapsed time between the earliest occurrence of "launch processing started", and the latest occurrence of "flow complete", by matching on UserID (which I've regex extracted to a field). How would I approach this? Edit: I should mention this is timeboxed to one day. If a user launches but doesn't complete in a day, I don't care.

mrhodes93 · ‎06-24-2020

I'm trying to track the elapsed time it takes a user to complete a web application based on the earliest and latest occurrences of specific messages. The end goal is to have two separate charts, the first, a scatterplot with the date on the X axis and the elapsed times to complete on the Y axis (multiple values present each day); the second chart almost the same but an average of the elapsed time on the Y axis rather than all values. My query thus far looks like: sourcetype="PCF:log" cf_app_name=myApp (msg="*launch configuration*" OR msg="*complete for Account Owner*" ) | rex field=msg "AccountNum: (?<AccountNum>\w+)" | rex field=msg "UserId: (?<UserID>\w+)" | stats min(_time) as start_time max(_time) as end_time by AccountNum, UserID | eval time_to_complete = end_time-start_time | eval time_to_complete=strftime(time_to_complete, "%M:%S") The shortcomings are: 1) A user can re-launch after completing (launch, complete, launch) and so the min/max _times can be off in these scenarios. I need something like earliest("launch configuration) and latest("complete for Account Owner") but not sure on the syntax for that. 2) The OR condition for the logs returns entries where only launch happens, and never complete. I'd like to discard those from the calculations rather than have a bunch of elapsed time of 00:00 present. 3) I'm not totally sure that this query will track combinations of users/accounts as I need. If User A launches with account 1 but never finishes, and user B launches with account 1 and does finish, I only (ideally) want the elapsed time for user B. 4) I'm generally struggling with how to incorporate the date component into a graph as well. Sincerely appreciate help, and explanations welcome so I can better learn.

mrhodes93 · ‎06-11-2020

Thank you both so much, both for the information and the explanations! Minor regex tinkering got this working as expected!

mrhodes93 · ‎06-11-2020

I haven't yet tried the query but wondered if this will work as the regex for identifying the AccountNum varies slightly between the two queries? rex field=msg "BAN: (?<BAN>\w+)" - space between colon and var value rex field=msg ",ban:(?<BAN>\w+)" - prefixed comma, no space between colon and var value

mrhodes93 · ‎06-11-2020

Hi all, I've got two queries I'm trying to combine to track authorizations that are completed, or expire after a period of seven days. The first query gets all of the authorizations sent, filtered by a unique AccountNum. Query 1: earliest=-8d@d latest=-7d@d sourcetype="PCF:log" cf_app_name=app1 "Sending authorization" | rex field=msg "BAN: (?<AccountNum>\w+)" | dedup AccountNum The second query returns all authorizations that have expired after a period of inactivity. Query 2: earliest=@d latest=now sourcetype="PCF:log" cf_app_name=app2 "authorizationExpired" | rex field=msg ",ban:(?<AccountNum>\w+)" | dedup AccountNum The closest I've gotten to combining them how I need is: Query 3: earliest=-8d@d latest=-7d@d sourcetype="PCF:log" cf_app_name=app1 "Sending authorization" | rex field=msg "BAN: (?<AccountNum>\w+)" | dedup AccountNum | append [search earliest=@d latest=now sourcetype="PCF:log" cf_app_name=app2 "authorizationExpired" | rex field=msg ",ban:(?<AccountNum>\w+)" | dedup AccountNum ] | fields msg | eval action=case( match(msg,"Sending authorization+"), "Total Authorizations Sent", match(msg,"authorizationExpired+"), "Authorizations Expired") | stats count(msg) by action However, there are two mistakes/gaps with this third query. The first problem is I need the second query to only return results where AccountNum in query 2 is matching an AccountNum in query 1. Secondly, I'd like to have a pie chart of Authorizations Expired (query 2) vs Authorizations Complete (total - expired = complete) but I'm struggling with the syntax on how to achieve that. This third query shows total + expired, where expired is actually a subset of total. I guess a third thing would be I don't know that append is really what I need or if there's a better, more performant way to construct this query? I'd love to learn any helpful tips or tricks! Greatly appreciate any help

mrhodes93 · ‎03-02-2020

I was able to get exactly what I needed by simply removing the the makesresults through the table commands replacing with my two queries noted. I greatly appreciate the help @to4kawa!

mrhodes93 · ‎03-02-2020

Okay let me work with this. I presented the question in a sample table but my query (for page 1) looks something like this: sourcetype="PCF:log" "/page1" | rex field=msg "UserID: (?\w+)" | rex field=msg "AccountNum: (?\w+)" | dedup UserID, AccountNum | table UserID, AccountNum The only difference for page 2 would be the literal "/page2". How would this information change what you've posted above?

mrhodes93 · ‎02-28-2020

Hi all, I've been struggling with a good query for this for a few days. Basically I'm trying to track users that drop off between pages in a guided web application. I'm able to get the results for Page1 and for Page2 individually, but I don't know how to combine the two queries to get the desired result. I don't know if I need to work with join or distinct count. Basically on page1 I can dedup the AccoutNum, UserID (I don't care if the same user comes through with the same account), but I do care if a different user does. Users B and F both came to page one with account 567, but only F proceeded. I really want to learn so any guided help or explanation would be amazing. Please let me know if anything is unclear.

Posts	11
Solutions	0
Karma Given	10
Karma Received	0
Member Since	‎02-28-2020

Online Status	Offline
Date Last Visited	‎03-23-2022 11:05 AM

Is a pie of pie chart possible?

Calculate time difference with extracted fields an...

How to find last of A and first of B in one query?

Scatterplot elapsed time by date with both earlies...

Combined queries, matching unique rex values and c...

Distinct results with multiple fields & multiple q...