The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
Blaine Morgan's Discussions
Synthesizing sistats in search results
I have a service that drops a stats line every minute on every host on 20+ hosts. If I use sistats I lose information on the true count of events and things like "top fieldvalue" do not work as…Continue
Tags: aggregate, aggregation, index, summary, sistats
Started Jun 22, 2010
Blaine Morgan's Page
Gifts Received
Blaine Morgan has not received any gifts yet
Latest Activity
Blaine Morgan posted a discussionSynthesizing sistats in search results
I have a service that drops a stats line every minute on every host on 20+ hosts. If I use sistats I lose information on the true count of events and things like "top fieldvalue" do not work as expected. I believe that with the correct set of evals I can produce the correct set of summary fields to have si comparable results.looking at si generated data from sistas fields, I have deduced the following meanings but need further clarification:psrsvd_ct_FIELDNAME = countpsrsvd_nc_FIELDNAME = Also…See More
Profile Information
- Are you an existing splunk user?
- Licensed
- What do you do for your day job?
- Production Engineering
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
