...eeps eventorder intact. But stats values() sorts the values using lexicographical order.
Is there any other functions or ways that keeps the eventorder intact like stats list()?
...loses a transaction
* "field1" and "field2" have relatively close timestamps (5 minutes at most between them)
I've tried many combinations of "transaction", "filldown" and "sort" functions, but I'm u...
...simple fix by editing one of the python functions in the app so that Splunk indexes the latest event, but I haven't quite figured out a fix. Has anyone else experienced this issue or know of a workaround?
...rite a search query to identify the functions that run for more than 'x' seconds, using transaction command as follows (i.e. extract the 'function' and use thread_name and function as unique IDs)
s...
...ata 1 A 2 1 B 3 3 B Data 3 B Data 3 B 4 3 Is this possible? I looked into mapping functions (to try and map the first eventResult to the eventName) but couldn't f...
When I search with stats first(myfield) last(myfield)
They return the opposite !!!!
example :
10/10/2010 myfield=A
12/12/2012 myfield=B
| stats first(myfield) last(myfield)
returns fir...
Hello, I have some issues extracting fields from the following raw event. I should be getting following fileds from this event. Any help will be highly appreciated. Thank you! Field Names: T...
...an't write custom functions with python that works with the fast mode ? Did I forget something in the command.conf file or somewhere else ? Or maybe is there a way to force the smart mode to fetch the f...
Hi,
Here is my Data in 2 logs having 3 fields:
Log1:
Books Bought AccountName={} , BookIds={}
(here BookId can contains multiple bookIds)
eg:
Books Bought AccountName={ABC...