I have a panel which provides us a list of transactions along with the StartTime of the transactions. I want a drill down panel which searches for a specific transaction within the time range (StartT...
...his:
| eval (distinct_count(host)) < 3
But it does not work.
I guess I need to assign a key to the value derived from "stats distinct_count(host) by fruit" so I can use that key for the evaluation....
Hi,
I am trying to create an anomaly detector for unusually high thruputs across all sourcetypes in my Splunk internal logs. I have used the following code to compile a table of the sourcetype by ...
...ollowing search: index=app_logs env=prod | makemv delim="," ids | mvexpand ids
Does not yield the expected results of 5 new events.
It seems like this is a bug in the way Splunk evaluates m...
Streamstats can produce sum of differences like
(fieldB- fieldA)+ (fieldC-fieldB)+(fieldD - fieldC) = a total of 30 min.
Can we achieve this evaluation through streamstats ? (fieldB - f...
...as to use the dc() function to get a count of unique user-ids, and the list() function to put them together as multivalues associated with their given, common, IP address. Here is the search:
i...
Hi,
I am trying to add new evaluation for a field in search-time.
For some reason, when I run query from my search head, I get the old values and it seems that the props.conf is not working....
...hange>
</input>
The issue is that only the first instance of the space is replaced - so with my example above I'm ending up with ('a','b c d')
Documentation on the replace evaluationfunction...
Hello all,
I have the following eval function which functions properly:
| eval my_count=if(match(lower(FieldName),"\\\filename.exe"),1,0)
But I want to evaluate a few things in the if s...
I have multiple queries for same index and therefore trying to avoid subsearches. Looking for right syntax, trying to do something like:
index=abc sourcetype=xyz | eval w=case("keyword1", "k1", ...