...se the where function to compare two fields I get no results. I am searching a list of hostnames, setting a threshold to compare against, and trying to display only events that are older than the set t...
...3.420 I should mention too that only the time portion, not the date, will need the difference calculated. The YYYY-MM-DD will always be the same between _time and lockTime.
...6
How would I go aboutcalculating the percentage of shapes that a heavy by color_and_shape?
I tried doing ...| eval pct=sc/total
but this does not work.
...field name which i could create an alias of.
So i tried to extract them with calculatedfields...
com_cf_sensor_xyz = if(valueName="Sensor_xyz", value, "")
When I search the corresponding s...
...680 3108
What I want to do is add a few columns calculating a percentage. For example, I want a column between field2 and field3 that is essentially field2 divided by field1. And then a...
...ven when choosing for fast-mode. However, this seems not to be that way.
So my questions: (How) are fields stored in splunk in an index when extracted during ingest?
Can I tell splunk to N...
Hello, Recently I added a question about how I could extract fields or get a table from a json input (https://community.splunk.com/t5/Splunk-Search/Field-extraction/m-p/517524#M145531). The s...
Hello, I'm attempting to display three calculatedfields (total_meeting_hours, total_use_no_meeting_hours, and hours_not_in_use) as a part of a pie chart. Each of these fields should represent a calculated...
...ations are then of course wrong, but that's not the point).
So my question is:
Why does removing/adding the append command changes the value of a previous calculatedfield?
I have a...
...as just wondering if there was any documentation anywhere that talks about being able to override _time with a calculatedfield. NB: I can't set the event _time at ingestion to be the correct date f...