Hi When I run the command below, it works fine index=toto event_id=4688 |
eval file_name=if(event_id==4688, replace(NewProcessName, "^*\\\\([^\\\\]+)$","\\1"),null) Now I need t...
...rrayName$ by sgname Array_Name Model
|eval SOT=case(Model="ModelA", 94000, Model="ModelB", 104000), PctIOPS=round((sgIOPS/SOT)*100, 2)
| sort - PctIOPS
| head 5
| table Array_Name Model SOT s...
I'm trying to evaluate the date string to a time format sing the strptime() the format I have is: Tue_Oct_25_03:57:49_IDT_2022
the strptime function looks like: strptime(d...
Hi
As you can see, I use a first eval in order to rename the field "site"
From the site renamed, I need to create a new field called "toto" in order to add new information for the field site.
S...
Hi All, I am relatively new to splunk. I am trying to build a search query and below is the condition of the query- | eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="D...
...og a and log b without doing a subsearch, so far I have
index=a, env=a, account=a ("There is a file" OR "The file has been found")|field filename from log b | field filename2| eval Endtime = _...
Hi, I wonder whether someone can help me please.
I'm using number the following as part of a query to extract data from a summary Index
| stats count(eval(repayments_submit="1")) as r...