Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
240 results
Sorted by:
12-27-2020
05:34 PM
Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both work exactly the same way and delim parameter in mvcombine doesn't work as e...
05-26-2019
09:16 PM
...uery,
index="default" | stats list(status) as status delim=" - " by task | nomv status
05-21-2013
04:05 AM
1 Karma
...ll the subelements as multivalue.
With nomv, I'm able to convert mvfields into singlevalue, but the content contains all the values...
What I want, is having only the first value from the mvfields....
03-27-2012
12:17 PM
1 Karma
I have an mvfield like contract="C53124 C53124 C67943" and I want to end up with unique values like contract="C53124 C67943".
The field is the result of a lookup table matching multiple contracts...
03-09-2016
10:14 AM
...2016-03-09 01:47:59 id=1234 event=2
2016-03-09 01:47:60 id=1234 event=5
| mvcombine delim=" " event
| nomv event
Output
1 1 1 1 1 3 3 3 1 3 4 5 2 2 1 1 1 1 2 5
I need the time t...
05-17-2017
09:07 AM
1 Karma
Is it possible to combine multiple rows into one row ?
COLUMN
frow1
frow2
frow3
to something like
COLUMN
frow1,frow2,frow3
Mvcombine combined all the rows to one row but they are ...
09-20-2019
09:48 AM
I'm trying to add the hostnames that result from a search to the email subject of an alert but currently I'm only able to have 1 hostname in the subject when I use $result.host$. For example if the s...
02-02-2017
01:17 PM
I'm trying to replicate other threads that show how to replace line breaks with delimiters. This search is not working.
| ldapsearch domain=ED search="(&(objectClass=eduPerson)(weillCornellE...
01-22-2021
03:01 AM
Hello everyone, There is my search : my_severity=error my_app="name" earliest=-48h latest=-24h | stats count as nb_yesterday by my_method limit=0 | appendcols[search my_severity=err...
Labels
- Labels:
-
alert action
-
email
