Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
1,000 results
Sort by:
03-02-2018
02:15 AM
Hi everyone,
I'm trying to get my head around this foreach statement but no luck so far ...
Foreach seems like the most obscure command ever ....
foreach * means everything ... but e...
- Tags:
- splunk-enterprise
02-22-2023
02:35 PM
How come this doesn't work given indexers.csv is a list of Splunk servers with role Indexer?
| inputlookup indexers.csv| rename splunk_server as Indxr| foreach Indxr [search index=_introspection s...
Labels
- Labels:
-
subsearch
09-30-2022
06:02 AM
...enerated fields but not having any luck on the foreach section. Any pointers would be much appreciated.
| rest splunk_server=local /servicesNS/-/-/configs/conf-props
| table title EVAL-a...
Labels
- Labels:
-
using Splunk Enterprise
Show results in replies (5)
-
@andrew_nelson Can you please try this in foreach? [ eval eval_fields= if(isnotnull('<&l...
-
You're a legend KV ! Thanks a million. Been annoying me all day trying to figure out this.&n...
-
😊😍
-
...ields title EVAL-a* | eval eval_fields="" | foreach EVAL-* [ eval eval_fields=if(isnotnull('&l...
-
Thanks Rich. I was thinking along the lines of putting anything in double quotes would be interpret...
10-28-2022
09:09 AM
...s there a more succinct way of doing this? Can one create this list with | foreach to a foreach to create this list? How in splunk can one calculate a list of permutations and force an A...
Show results in replies (9)
-
If you want any 2 groups with a common position: | inputlookup position_group_lookup.csv | rename ...
-
Does this help? | stats values(group) as groups by position | eval groups=mvjoin(groups,",") | sta...
-
If you're trying to figure out the common groups and % intersect between any 2 positions, here's a ...
-
Would it be possible to do this as a subsearch and a join as well instead of a lookup?
-
Thank you both for your feedback. Perhaps my request needs to be a bit more specific. T...
-
If I understand correctly, you want to find the groups which have the same positions in? | stats v...
-
More specifically, pairs unique pairs groups.
-
Which group have the same list of positions?
-
what two groups in combination show up in various positions.
07-27-2021
07:39 AM
...6): argc=2 a0="sendmail"" | foreach a* [ eval test = test + '<<FIELD>>' ] No result, I need you help please.
- Tags:
- foreach
Show results in replies (5)
-
| foreach a* [| eval test=if(isnull(test),'<<FIELD>>',if(isnull(<<FIELD&g...
-
You could try something like: | foreach a* [| eval test = if(isnull(test),'<<FIELD>&g...
-
...pace between each field | foreach a* [| eval test = if(isnull(test),'<<FIELD>>',t...
-
Sorry for my english... Maybe I should not use foreach for my search because I would like for x e...
-
| makeresults | eval a0="sendmail", a1="-t" | foreach a* [| eval test=if(isnull(test),'<&l...
02-27-2019
11:15 PM
Hi, I wonder whether someone can help me please.
I've put together the query below using the foreach command, which, although I've read a lot of posts, I've not really used, or if truth be known u...
Show results in replies (5)
-
The foreach command repeats the commands in its subsearch for each field (not value) that m...
-
...equest-ID','requestID') | eval header="" | foreach clientHeaders.test* [eval header=header+test<<M...
-
...o not have much logic when framing this with the foreach command | makeresults | eval c...
-
...oalesce('request.tags.X-Request-ID','requestID') | eval header="" | foreach clientHeaders.test* [e...
-
...-Request-ID','requestID') | eval header="" | foreach clientHeaders.test* [eval header='<<F...
04-05-2019
02:15 AM
...yField>.*)\)"
| makemv myField
| mvexpand myField
| makemv delim="," myField
| eval wibble {myField}=myField
| eval header=""
| foreach wibble* [eval header=header+'<<MATCHSTR>>']
| chart s...
08-04-2020
11:45 PM
Hi for some reason fieldformat didn't work with foreach x,y,z. Sometimes it works mostly didn't. Here is same which didn't work in at least our Splunk 7.3.3 or 8.0.5. Any hints is welcome. &n...
Labels
- Labels:
-
other
Show results in replies (4)
-
Interesting, it looks as though fieldformat does not work inside the foreach, e.g. | eval xx=1...
-
...ike a bug if it used to work, as the most basic case, of not even using any of the foreach X v...
-
...xx.yy. Works earlier like charm for 10+ fields with foreach + fieldformat. Other option is change t...
-
I've just reproduced this and logged it to Engineering (SPL-194199, not in the release notes yet) b...
03-26-2019
08:10 AM
...olumn2!= "$drilldown$" OR (Column1= "$single$" AND Column2= "$drilldown$")
| outputlookup Lookup.csv
I have tried to use foreach but it doesn't really work.
Can someone help me with t...
10-26-2015
07:34 AM
Hi,
Can FOREACH commnad can read text value ? I am having issue to create new columns
foreach IM_* [eval TYPE='<<FIELD>>']
So if columns name are A, B ,C .... I would like to c...
Show results in replies (4)
-
...ileds FLAG, TYPE eval TYPE= "" | foreach IM_* [eval TYPE= TYPE.if(isnotnull('<<MATCHSTR&g...
-
...ield. Perhaps you meant this? eval TYPE= "" | foreach IM_* [eval TYPE= TYPE.if(isnotnull('<&l...
-
If you have fields called 'A', 'B', and 'C', then foreach IM_* ... will not match on them. P...
-
...very column. ) Previous version also works but second FOREACH statement did not do anything- all job i...
