What is the Splunk equivalent of an SQL IN clause. I want to run a query where some field has a value which is present in a list of values.
For example, suppose I have a list of car types, such a...
It's possible to assign the result of a subsearch to a field with the eval command as can be seen in the following snippet: | makeresults
| eval blahblah = [
| makeresults
| eval s...
It's been a while since we implemented Splunk Enterprise, and user engagement has stalled a bit. We also have a lot of people who are new to Splunk. Do you have any recommendations for how we can e...
I'm trying to create a search form that can take a comma separated list. In sql I would use the 'IN' command.
If the form allowed for a comma separated list like "Honda,Chevorlet,FORD,TOYOTA"
I...
Hi I tried to search as below, with where in(VALUELIST) function as described in: http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions
sourcetype=foo T...
...age_duration_seconds":32.808} However, when I try to use an example like example #1 given for json_extract in the splunk docs, source="/path/to/json/logfile" message.path="/ws/ws_metrics/p...
Hello,
Here is my dashboard before using the transpose command
index=oit_printer_monitoring AND type=Printer
| eval timeConvDate=strftime(_time,"%a %m-%d-%Y")
| eval timeConvTime=s...
...acros and learn how to use them It can also be used as a quickreference table for unit conversions. Conversion of units Drill down (click on the table) to open a sample SPL in a search....