Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About EvansB
EvansB
Path Finder
Member since:
05-22-2021
11-13-2022
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 2 |
| Member Since | 05-22-2021 |
Activity Feed
- Got Karma for After DB Connect upgrade from 3.8 to 3.10, it won't accept any connection previously set?. 11-10-2022 12:31 PM
- Posted After DB Connect upgrade from 3.8 to 3.10, it won't accept any connection previously set? on Installation. 09-10-2022 01:52 PM
- Tagged After DB Connect upgrade from 3.8 to 3.10, it won't accept any connection previously set? on Installation. 09-10-2022 01:52 PM
- Got Karma for Re: Calculating time difference. 09-07-2022 02:18 PM
- Karma Re: How to calculate time difference? for richgalloway. 09-07-2022 12:55 PM
- Posted Re: Calculating time difference on Splunk Search. 09-07-2022 12:54 PM
- Posted Re: Calculating time difference on Splunk Search. 09-07-2022 09:45 AM
- Posted Re: Calculating time difference on Splunk Search. 09-07-2022 08:45 AM
- Posted How to calculate time difference? on Splunk Search. 09-07-2022 08:12 AM
- Tagged How to calculate time difference? on Splunk Search. 09-07-2022 08:12 AM
- Tagged How to calculate time difference? on Splunk Search. 09-07-2022 08:12 AM
- Posted Re: How to get Result for field value difference? on Splunk Search. 05-23-2022 05:06 PM
- Posted Re: How to get Result for field value difference? on Splunk Search. 05-23-2022 02:06 PM
- Posted How to get result for field value difference? on Splunk Search. 05-23-2022 12:53 PM
- Tagged How to get result for field value difference? on Splunk Search. 05-23-2022 12:53 PM
- Karma Re: How can I display _time in my results using stats command? for tshah-splunk. 02-19-2022 07:11 PM
- Karma Re: How can I display _time in my results using stats command? for gcusello. 02-19-2022 07:11 PM
- Posted How can I display _time in my results using stats command? on Splunk Search. 02-17-2022 04:56 PM
- Tagged How can I display _time in my results using stats command? on Splunk Search. 02-17-2022 04:56 PM
- Karma Re: eval/sum field for ITWhisperer. 02-06-2022 11:23 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-10-2022
01:52 PM
1 Karma
After upgrade of DB Connect from version 3.8 to 3.10, it won't accept any connection that was previously set. Everything works fine before the upgrade but now my outputs and inputs can't load. When I try choosing a connection table, it displays the error "invalid database connection"
I also noticed the new DBX version has a keystore tab on the settings menu. (This is new and not on the previous version 3.8)
I have necessary drivers installed; Splunk_JDBC_mssql version 1.1 and JRE version 11.0
Can someone assist me with what I'm missing for my connections to work?
... View more
- Tags:
- app upgrade
Labels
- Labels:
-
app
-
heavy forwarder
-
upgrade
09-07-2022
12:54 PM
1 Karma
I eventually used this index=* source=*
| rename Properties.actionedDate as actionedDate
| eval actionedTS = strptime(actionedDate, "%Y-%m-%dT%H:%M:%S.%7N%:z")
| eval diff = _time - actionedTS
| table actionedDate, _time, diff Appreciate you @richgalloway
... View more
09-07-2022
09:45 AM
did you edit your first comment.... I'm getting same results can you post the corrected query? Appreciate.
... View more
09-07-2022
08:45 AM
Thanks for your response. This should work but I'm not getting results on the diff field - (I sorted with this field) Does that mean there are no difference between timestamps and _time?
... View more
09-07-2022
08:12 AM
I'm looking to get a difference between both times and create a 3rd field for the results (Properties.actionedDate - _time). My current query is like this
index=* source=* | table Properties.actionedDate, _time
Here is a screenshot of my current result
... View more
05-23-2022
02:06 PM
This gives me general results. I need results that are only greater than 10 and beyond. This is for the purpose of setting up an alert when values between May and Apr is greater than 10 Thanks
... View more
05-23-2022
12:53 PM
Working with this query, I'm hoping to get only results where field values are greater than the other.
index="index*"
| eval MonthNumber=strftime(_time,"%m")
| chart eval(round(avg(durationMs), 0)) AS avg_durationMs by properties.url, MonthNumber
| rename 04 AS "Apr", 05 AS "May"
I want to get only results of where Apr values is greater than May by 10
... View more
- Tags:
- field values
Labels
- Labels:
-
count
02-17-2022
04:56 PM
How can I display _time in my results using stats command I get this field when I use "table _time"
Just like the image above, I want to get the time field using stats and/or eval command The image below is how my time events look like.
... View more
- Tags:
- field values
Labels
- Labels:
-
field extraction
02-05-2022
09:08 AM
You're correct, I want to get a count of total viewerId that occurs in my time period(past week) and compare it with another time period(this week) to see possible increase or decrease of all viewerId. Also, I want to convert this result into percentage. Thank you.
... View more
02-04-2022
06:38 AM
Thanks for the quick turnaround, I'm hoping to perform 2 tasks 1. Add up the values of viewer.id, and how many distinct viewer ids between those dates? 2. I want to get the count of the total "viewer_id" for the past week against this week and compare if there were more viewers or less. I also want to get this result not only as a count but also convert (more viewers or less total count) to percentage.
... View more
02-03-2022
05:12 PM
Hi folks, What query can I use to sum up my field "viewer.Id" to see how many viewers we have between 01/22/2022 and 02/02/2022. I would like to see the count of Increment/decrement from my results and also in % by comparing it with different dates. Thanks Evans
... View more
- Tags:
- Numeric calculations
Labels
- Labels:
-
count
-
eval
-
field extraction
-
stats
01-20-2022
06:44 AM
Thank you guys, it worked! What is the best option to correctly fix the JSON quote?
... View more
01-19-2022
08:09 PM
I would like to get the list of those items in the properties field, like appName, levelId, etc.
... View more
- Tags:
- field values
Labels
- Labels:
-
field extraction
01-17-2022
04:55 AM
I need help in getting the step by step process in upgrading Splunk on-prem HF
... View more
Labels
- Labels:
-
upgrade
01-10-2022
10:49 AM
Thanks, but how can I subtract 'EBVS%' and 'PFAVS%' fields from the 'successful plays%' field to increase the successful plays KPI?
... View more
01-10-2022
10:06 AM
Can anyone assist me with the SPL to subtract EBVS% and PFAVS% fields to allow the successful plays field to improve? I've attached a screenshot below.
... View more
Labels
- Labels:
-
field extraction
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-13-2022
10:14 PM
|
Karma given to
