...R d.hash="bbbbbbbbbb" OR d.hash="ccccccccccc" CURRENT SEARCH -- not giving the expected result. index=hashstore
[| makeresults
| rename a.hash{} as hash
| eval a.hash="a...
Hi there: I have the following makeresults query: | makeresults count=3 | eval source="abc" | eval msg="consumed" | eval time_1="2023-11-09T21:33:05Z" | eval time_2="2023-11-09T21:40:0...
Hello experts, I am trying to create a custom macro, from that it will returns a result depends on the argument I pass to it, like this: | makeresults | eval param=1 | eval result=case(p...
Hello,
I need to spoof some data and am using |makeresults for 3 hosts and their port status of "UP" (and eventually "DOWN")
| makeresults
| eval _raw = "host1%UP%UP%UP%#host2%UP%UP%UP%#h...
I wrote an external command in python and the only way I can get it to work is to put a | makeresults prior to it in the search. | makeresults | mycustomcommand | My command just pulls b...
I executed the following SPL with makeresults, but the results only give me the fields for _time and _raw... i don't get parsed fields. Can this be solved?
|makeresults count=100|eval _raw="P...
...ased on the weekday.
Applying this to my specific case of business hours during the business week I get this with a case on the weekday from makeresults, which at least seems like a lightweight s...
I receive the following error while trying to execute a simple "makeresults" command by using REST API call: Used endpoint: https://localhost:8089/servicesNS/nobody/myapp/search/jobs Search e...