Does anyone know of a good way to pull one event of a specific eventcode/type when searching for multiple eventcodes?
It doesn't appear that eventsampling can do something like that.
I was h...
I've been studying and creating several pieces of code to take advantage of the wonders of the HTTP Event Collector and noticed noone published a PowerShell sample, then since I created one I d...
...nd most importantly a column with a sample event from each sourcetype.
I want it to be something like the attached table:
Can someone please help me with the search that provides me with such a...
For the type of data I am trying to extract, EventSampling really speeds up the query. This works fine when executing SPL queries, but I have not been able to figure out how to do this in a d...
I've been through this thread: https://answers.splunk.com/answers/295142/line-breaker-in-single-line-printed-json-doc.html
without any success.
I have JSON data coming in as 1 event, and I n...
Hi people, I wonder whether it is possible to run a query that generates a set of n-sample of events for each sourcetype in an index? In some sense, if the log data has been ingested and c...
If telephone number is present in both Index 1 and Index 2 display the associated device name from the event in index 2 and then display resolution code from index 2. If anyone could point me in t...
From my understanding, the eventsampling works on a ratio basis, so we can have a 1:10 chance of selecting an event. I'd like to integrate this into some dashboards since it takes so long for them t...
Hi all,
I'm searching for a way to treat different events as one. Example: If I'm getting events like this where every field-value pair is in one event, it's easy to deal with it:
event...
The documentation describes how to set the sampling ratio in the Search app and dashboards, but not when using the REST API.
Is sampling possible using the REST API?