Hello folks,
I am experiencing problems to use replace to change a field value like "qwerty\foo" to "qwerty\foo".
I am testing it with this query
| makeresults
| eval user="qwerty\f...
I'm trying to understand the functionality of keepevicted. I've read several documentation about it but it's still not clear. I've made a search with transaction. Without keepevicted I get 5...
...ount=0]
But I also need to add text after the distinct count
So I am doing this after the distinct count but I have nothing
| eval dc = if(dc== 0, "no host", tostring(dc) + " hosts")
c...
Phantom 4.9 supports Markdown notes and it is possible to add markdown note using GUI. But how to use markdown with the add_task API function? Like phantom.add_task(container=None, name=N...
...he clustering stanza could be longer and more complex. We followed the docs and went to each instances' $SPLUNK_HOME/etc/system/local/server.conf and updated the key in plain text. We restarted the S...
...ount_Root_Values.The output should look like this
In excel, there is formulla for it :- =IF(COUNTIF(B$2:B2; B2)=1;COUNTIF(B:B; B2);TEXT(;)) .
In Splunk, I am trying to use the eval to g...
...erver will give me a value of 0 if the server is actually of instead of no results are found. I was wondering if its possible to show a text like "Server is off" if the value of 0 is returned and show t...
Hi, I've got a problem with this playbook code block, the custom functions I try to execute seem to hang indefinitely, I also know the custom function works because I've successfully used it f...