...ith identical values in what should be singlevalued fields?
My suspicion is that it could be interplay with a field extraction (or similar)? (As it looks, to me, like certain fields have been e...
...omething like:
I've been messing with CSS files, but that is not a sustainable solution.
Also I've found the Splunk documentation on how to Generateasinglevalue. This give me part of w...
....... This works, though I really don't like having to hardcode exessive values like this. What I would prefer is a way to, based on the fields observed in the base search, generate m...
I have a list of hosts that submit logs periodically. I need Splunk to generatean alert if the last time it received a log from a host on this list is older than a configurable value per host.
T...
Hi, I want to have table of singlevalues (singlevalues with indicator of movement(percentage)). The first column is name and the second is the singlevalue. Name should be loaded from csv, for e...
...ould I add the values of latest(registrations) to provide asinglevalue for all 3 hosts? For example, I would like only the sum of the latest registrations (98) to display in asinglevalue p...
...anceled, failed, and completed. I'd like to group 'failed/canceled' into asinglevalue called 'errors', and then divide errors by total requests to get a error rate percentage.
| eval status=if(IN(i...
Hi Splunkers,
To insert asingle new value into a lookup table, I've been running something like this:
index=_audit earliest=-10s | eval myfield="foo"
| dedup myfield
| table m...
...t;.) and orgId: (?< OrgID>.).""
This will generate the fields "Alias" and "OrgID." Valid aliases should be a 6 digit number. However, due to users scanning the wrong barcode, we see values o...