Hello, I have 2 fields I want to filter they are: name, "short name" I want to pull all the events that contains: name="software" or "short name"=software" and exclude: "Splunk" "A...
From the screenshot, i would like to achieve the below;
LCU04 = 500 x 00000
LCU03 = 500 x 01985
LCU02 = 500 x 01985
LCU01 = 500 x 01985
Then, LCU = (LCU04 + LCU03 + LCU02 + LCU01)
Plea...
...ONG_GRAS
Since field names do confirm to some=data they are automatically extracted.
For some reason some user has §4 in front of name and §r after it.
I have temporary solved this by using SED like t...
Hello, I need a help with a search that seems very easy, but I'm unable to achieve the results I want. The events are recieved in diferrent days, but no more than 3 days and the date is in the field...
...pp=case(app="cisco:wsa:squid","squid") | table _time, app
But using that search as a calculated field always evaluates to zero.
Anyone have any idea why?
Hi all,
I am trying to include the contents of a form field into an AND search clause only if the form field is not null.
So, say there are three input fields: field1, field2, andfield3.
I...
Hello Splunkers.
I'm indexing some SNMP data from a server.
Here is one event indexed:
HOST-RESOURCES-MIB::hrStorageDescr."31" = "/"
HOST-RESOURCES-MIB::hrStorageDescr."35" = "/tmp"
HOST-R...
Hi,
Let's say we have 2 multivalue fieldsField1={a,b,c,d}
Field2={a,b,c,d,e}
Is it possible to evaluate the difference between these fieldsand display the additional value of Field2? S...
Hi,
I'm having problem with evaluating expression using lookup field. I create a lookup fileld by executing this search:
some search| stats avg(count) as Average | outputlookup Average.csv
N...
My data is structured into a JSON with a field inside a block that is as follows
{ "SomeField":"Value",
"serviceInfoBlock":{"SomeOtherField":"Value",
"logID":"V...