Hello folks,
I am experiencing problems to use replace to change a field value like "qwerty\foo" to "qwerty\foo".
I am testing it with this query
| makeresults
| eval user="qwerty\f...
I'm trying to understand the functionality of keepevicted. I've read several documentation about it but it's still not clear. I've made a search with transaction. Without keepevicted I get 5...
...ount=0]
But I also need to add text after the distinct count
So I am doing this after the distinct count but I have nothing
| eval dc = if(dc== 0, "no host", tostring(dc) + " hosts")
c...
...he clustering stanza could be longer and more complex. We followed the docs and went to each instances' $SPLUNK_HOME/etc/system/local/server.conf and updated the key in plain text. We restarted the S...
Phantom 4.9 supports Markdown notes and it is possible to add markdown note using GUI. But how to use markdown with the add_task API function? Like phantom.add_task(container=None, name=N...
...ount_Root_Values.The output should look like this
In excel, there is formulla for it :- =IF(COUNTIF(B$2:B2; B2)=1;COUNTIF(B:B; B2);TEXT(;)) .
In Splunk, I am trying to use the eval to g...
...erver will give me a value of 0 if the server is actually of instead of no results are found. I was wondering if its possible to show a text like "Server is off" if the value of 0 is returned and show t...
...'d like a searchWhenChanged="false" functionality for inputs used in conjunction with this button. With my current code, the search still re-runs when the timepicker is updated without the button ever b...