Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Search
Splunk Community
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
10,000 results
Sort by:
02-03-2023
04:47 AM
Hi ,
I want to rename to Required Parameters Longitude and Latitude are missing or invalid to a new value Required Parameters missing.
index="****" k8s.namespace...
Labels
- Labels:
-
regex
Show results in replies (5)
-
| eval error_msg=if(match(_raw, "Required Parameters Longitude and Latitude are missing or invalid"...
-
Use | rex with SED mode | makeresults | eval error_msg = "Required Parameters Longitude an...
-
...re missing or invalid But since we have renamed it to Required Parameters missing it i...
-
Add a condition to the drilldown so that if the value is "Required Parameters missing" change it to...
-
Thanks , It worked
08-29-2022
09:54 AM
How can i rename the value of the policy name from = to "contains". Instead of saying "index=tenable* sourcetype="*" policyName="*" | eval policyName=if(policyName="93e1da98-656c-5cd5-933b-c...
Labels
- Labels:
-
fields
09-20-2023
05:56 AM
Hi guys,
I need some help trying to rename a specific field on condition that the renamed field is associated with one or more separate fields.
Fields:
D...
Labels
- Labels:
-
stats
Show results in replies (7)
-
Fields have a name and values. They can be renamed. Values do not have names so they c...
-
Hi @JohnEGones, you have to use eval with if or case, something like this: <your_seaRCH&g...
-
The rename command can't use conditions, but eval can. <some query> | eval "This String" = i...
-
...evice_Interface, SomeField | (here I want to rename the field *values* in Device_Interface that match t...
-
Hi @JohnEGones, probably there's a terms misunderstanding: do you want to rename the field n...
-
| eval Device_Interface=case(Device_Name="Value1" AND Device_Interface="Value2" AND SomeField>="...
-
...t is better to say, do this as a lookup, based on the number of potential renames, or whether it is l...
11-13-2024
05:09 AM
Hello, if you are using _TCP_ROUTING and index rename on target platform, logs may go to "last chance index"
Labels
08-01-2024
10:04 PM
Hi, I want to rename the fields while writing to a lookup table using outputlookup command. Is there a way to do it? I intend to use the lookup table in the next run of the same query so want s...
08-31-2023
08:34 AM
...wo events - one for java heap memory usage and one for java heap max memory. Is there any way, how to rename values variable based on the description in a event and join them in one table u...
Labels
- Labels:
-
join
-
metadata
-
search job inspector
01-06-2023
04:31 PM
Hello - I am trying to rename column produced using xyseries for splunk dashboard. Can I do that or do I need to update our raw splunk log? The log event details=
d...
Labels
- Labels:
-
dashboard
06-10-2024
06:09 AM
...outingKey after the count to get the overall total? I tried to rename the routingKey upstream but the query does not add them after renaming. If you have any ideas, I'm interested. Sincerely, Rajaion
Labels
- Labels:
-
eval
12-19-2017
10:25 PM
...emaning Nodes.
Could anyone let me know how i need to modify app agent configuration file for reflecting my node name.This is the line from appDynamic doc ....
"To rename a node, you must c...
Labels
- Labels:
-
Dashboards
04-07-2020
10:36 AM
I have this splunk search:
host=app-dev-001 terminating | convert timeformat="%Y-%m-%d" ctime(_time) AS date | sort term_user | rename term_user AS 'Terminated User'
When I run it I get t...
