Hello Community,
I have defined some tags like:
Field=Value --> TAG
OBJECT_TYPE=*_EMS --> EMS
Now I want to use this Tags within my evalstatement:
|stats
c...
Good Afternoon, So I've recently been hired on as a Splunk admin/analyst. The scope of my job really relies on my being able to know how to look things up in the search box. I real...
The command I am running is:
basesearch | eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2" , number = "3" , "Number 3" , number = "4" , "Number 4" ) | stats count by n...
We useeval command to create new field, and we used this as function ex: |stats count(eval(method="GET")) as get . Can someone explain this example clearly? What is eval doing here?
...The search we have so far is as follows
index="summary" report="bandwidth_by_server"
| eval Duration=info_max_time-info_min_time
| stats sum(NumBytes) as TotalBytes, sum(Duration) as T...
I'm seeing the error below under messages in my Splunk enterprise console:
Missing or malformed messages.conf stanza for TCPOUT:FORWARDING_BLOCKED_Indexer IP ADDress_default-autolb-group DC-Host N...