Does anyone know of a good way to pull one event of a specific eventcode/type when searching for multiple eventcodes?
It doesn't appear that eventsampling can do something like that.
I was h...
I've been studying and creating several pieces of code to take advantage of the wonders of the HTTP Event Collector and noticed noone published a PowerShell sample, then since I created one I d...
...nd most importantly a column with a sample event from each sourcetype.
I want it to be something like the attached table:
Can someone please help me with the search that provides me with such a...
For the type of data I am trying to extract, EventSampling really speeds up the query. This works fine when executing SPL queries, but I have not been able to figure out how to do this in a d...
I've been through this thread: https://answers.splunk.com/answers/295142/line-breaker-in-single-line-printed-json-doc.html
without any success.
I have JSON data coming in as 1 event, and I n...
Hi people, I wonder whether it is possible to run a query that generates a set of n-sample of events for each sourcetype in an index? In some sense, if the log data has been ingested and c...
The documentation describes how to set the sampling ratio in the Search app and dashboards, but not when using the REST API.
Is sampling possible using the REST API?
From my understanding, the eventsampling works on a ratio basis, so we can have a 1:10 chance of selecting an event. I'd like to integrate this into some dashboards since it takes so long for them t...
Hi all,
I'm searching for a way to treat different events as one. Example: If I'm getting events like this where every field-value pair is in one event, it's easy to deal with it:
event...
If telephone number is present in both Index 1 and Index 2 display the associated device name from the event in index 2 and then display resolution code from index 2. If anyone could point me in t...