...escription"=(Message) OR (name) | table ... "Event Description"
.... | eval "Event Description"=Message OR name | table ... "Event Description"
None of these seem to work. They usually give us malform eval express...
Hi, One of my value in table is being passed as an Booleanexpression as below
(assignment_group = 1213App_Development1 OR assignment_group = App-Testing OR assignment_group = App Support OR a...
I know this is a Splunk newbie question but I am having some issues getting this to work. I have a column field named "Account_Name" from a sourcetype="AD", for instance. I am creating a form where t...
...reated it as a calculated field(systemid) and gave an eval expression systemid=if(isnull(systemid),"NULL",systemid). Now I get the error "Error in 'eval' command: Fields cannot be assigned a boolean r...
...roviding too many logical/OR expressions is there a way I can put all these values A, B, C, D ....& Z in a table and write something like...search if field2 is in the table...?
...MLField
I've got tens of regular expressions working as field extractions, I've got this particular expression working in search and in a python script, I'm just really out of ideas as to why it's n...
...here signature has specific src or cidr range. I seem to be creating unbalanced parenthesis when trying my booleanexpressions or Wheres. Please assist
When a kvstore lookup definition filters a kvstore of 1 million events down to 300k, does performance improve vs using the original kvstore collection unfiltered?
Hi,
One saved search can have only one alert condition.
I have "heartbeat" string in my log and I set up a saved search in scheduler --
sourcetype="app.log" "Heartbeat check comple...