Hi,
Can I changethe operator in theresultofformat command for subsearch? I actually want to pass thesubsearchformatresult with "greater than (>) operator" in a particular field.
E...
Hi,
I am creating a custom view dashboard. In that I'm trying to utilize the same search to extract a single value and then modify that search slightly to put the rest oftheresults in a column c...
...essageid ) over a set amount of time I get over 15,000 results. When I change this search to make it a subsearch
index=smtp sourcetype=smtp [search index=smtp sourcetype=smtp rule=x | fields + m...
Is there anyway of emulating a nested subsearch? I know its sometimes possible to rewrite a search to factor-out a subsearch, but I'm hitting a wall.
Yes, I know this could be possible using l...
...hat they are.
Here is the search. The list of macs in the search below are actually populated via another subsearch. I removed that subsearch and replaced with the actual resultofthesubsearch i...
...able toto titi tata
the time range is based for the first index
but the second one need to changethe date time to get the correct results.
i tryed someting using gentimes but unsuccessful.
c...
...istorical stock market prices (Ticker, Close-price, Volume). I want to extract several information here: 1. The %Changeof a given day compared to the previous (work) day and the respective volume. A...
....
However, if i shorten the timespan to 7 days, then I do get some results (approx 12,000) which is strange? Maybe I am reaching the limit for time/number of events in thesubsearch.
I am j...
...ields in the Event data, but did not changethe search results. Any suggestion or help highly appreciated I am newbie to Splunk... TIA 12/2/21 7:24:52.106 PM 2021-D...
...eleted:
| from datamodel:"Change_Analysis"."Account_Management" | where 'tag'="delete" | search NOT "changed: /usr*" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",v...