...his:
| eval (distinct_count(host)) < 3
But it does not work.
I guess I need to assign a key to the value derived from "stats distinct_count(host) by fruit" so I can use that key for the evaluation....
I have a panel which provides us a list of transactions along with the StartTime of the transactions. I want a drill down panel which searches for a specific transaction within the time range (StartT...
Hi,
I am trying to create an anomaly detector for unusually high thruputs across all sourcetypes in my Splunk internal logs. I have used the following code to compile a table of the sourcetype by ...
...ollowing search: index=app_logs env=prod | makemv delim="," ids | mvexpand ids
Does not yield the expected results of 5 new events.
It seems like this is a bug in the way Splunk evaluates m...
...son_extract(utfx,"{}.9E")) or this: f=replace(_raw,"\\\\x([0-9a-fA-F]{2})","\1")), which simply removes the "\x" ...so is it like the capt.groups of the regex in replace() is not evaluated if it is a...
Streamstats can produce sum of differences like
(fieldB- fieldA)+ (fieldC-fieldB)+(fieldD - fieldC) = a total of 30 min.
Can we achieve this evaluation through streamstats ? (fieldB - f...
...as to use the dc() function to get a count of unique user-ids, and the list() function to put them together as multivalues associated with their given, common, IP address. Here is the search:
i...
Hi,
I am trying to add new evaluation for a field in search-time.
For some reason, when I run query from my search head, I get the old values and it seems that the props.conf is not working....
...hange>
</input>
The issue is that only the first instance of the space is replaced - so with my example above I'm ending up with ('a','b c d')
Documentation on the replace evaluationfunction...
Hello all,
I have the following eval function which functions properly:
| eval my_count=if(match(lower(FieldName),"\\\filename.exe"),1,0)
But I want to evaluate a few things in the if s...