Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About sbsbb
sbsbb
Builder
Member since:
11-05-2012
06-05-2020
Community Statistics
| Posts | 212 |
| Solutions | 5 |
| Karma Given | 40 |
| Karma Received | 45 |
| Member Since | 11-05-2012 |
Activity Feed
- Got Karma for Re: Join - how do I fillnull on a join?. 07-21-2021 03:47 AM
- Karma Re: Is it possible to export data to other formats from the standard export function in splunk web? for aweitzman. 06-05-2020 12:47 AM
- Got Karma for Why am I unable to select and edit elements in Sideview Utils using Chrome browser?. 06-05-2020 12:47 AM
- Karma how to add html in popup window for john. 06-05-2020 12:46 AM
- Karma splunk pricing estimate for orrick. 06-05-2020 12:46 AM
- Karma Can splunk do this? search command -> mvexpand -> with more than one multi value field for lpolo. 06-05-2020 12:46 AM
- Karma Can I define multiple searchTemplate in one view? for philip_wong. 06-05-2020 12:46 AM
- Karma How to bulk delete alerts for responsys_cm. 06-05-2020 12:46 AM
- Karma Create multiple eval fields with wilcards? for jweinstein. 06-05-2020 12:46 AM
- Karma Re: Create multiple eval fields with wilcards? for gkanapathy. 06-05-2020 12:46 AM
- Karma Re: How to see if a search module is working, how to debug ? for sideview. 06-05-2020 12:46 AM
- Karma Re: What is the best way to get list of index in my splunk for Ayn. 06-05-2020 12:46 AM
- Karma Re: splunk pricing estimate for derrierdominiqu. 06-05-2020 12:46 AM
- Karma Re: How to control the width of a panel for sideview. 06-05-2020 12:46 AM
- Karma Re: Fraud detection - how to compare last weeks average count with todays count and send Alert if to far apart for jtrucks. 06-05-2020 12:46 AM
- Karma Re: Does writing to summary index count towards indexing license? for Ayn. 06-05-2020 12:46 AM
- Karma Re: D3 sankey chart without using Django framework for martin_mueller. 06-05-2020 12:46 AM
- Karma Indexing a NetFlow logic - log file. for chimbudp. 06-05-2020 12:46 AM
- Karma Re: Indexing a NetFlow logic - log file. for Ayn. 06-05-2020 12:46 AM
- Karma Re: time.sleep not working in modular input ? for Simon. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 |
04-25-2013
12:33 AM
Is there another way, to search null without "NOT" ?
I user Sideview and Pulldowns with "+OR+" Separator... so the output from the pulldown for the underlying search is key="value OR value" I can't use NOT there...
... View more
04-19-2013
02:03 AM
Hi nick, I've changed the select for simple one, and after that it works... (maybe problem because of the TO_CHAR ?)
... View more
04-18-2013
01:26 AM
I have two search :
- 1. dbquery
- 2. dbquery
I want being able to compare the results in a postprocess , can I do that ?
I guess Postprocess module is not able to have two parent searches, and handle that...
Or should I use a search, with a join or append, and load the searches with there $searchId$s ?
like :
search1: | dbquery k "SELECT * from x"
search2: | dbquery j "SELECT * from z"
search3: loadjob $search1_id$ append [loadjob $search2_id$]
?
... View more
04-17-2013
11:18 PM
Thats my case... so what are the alternatives ?
... View more
04-17-2013
05:53 AM
In the Splunk doc, there is somewhere a documentation that the warm and cold buket have to be on a medium with similar characteristic (not slower for cold...)
So it would be better to move data from a fastIndex to a slow index ... ?
... View more
04-17-2013
04:09 AM
Because the SAN Space is pretty expensive, we are only keeping the Data in Splunk 2 months.
Is it possible to have
- One instance from Splunk on the SAN for normal search (first 2 months)
- One instance on old Hardware, that reuse frozen buckets from the first instance (from 2 until 12 month old)
- The first instance beeing able to search in the two instances...
Or would it be possible to move all frozen bucket from the culstered indexer, to a "slow" indexer withou SAN ? (That would be my favorit solution, if possible)
I guess the drawback from shuttl is that I can't only search on the messages I want to see, I have to reload all the timerange needed in splunk ?
... View more
04-17-2013
01:52 AM
In fact, it would be nice to have a parameter field order, where you could specify in which order to display the most important field, and the table module should then display other fields (that are not hidden) after it...
Example :
$result[0].Fields(that would be or nice ;)= field1 field2 field3 field4 field5 field6
table_field_order = field3 field1 field4
targeted output from table: field3 field1 field4 field2 field5 field6
... View more
04-17-2013
01:15 AM
Even by changing this, it doesn't work .
I've also similar pb on a groupName from a table, and when I make a copy/paste from the variableName in a html module, it works...(and I see them in Debugmode)
Is it possible that default value, and groupname can't be set with a $foo$, or maybe for groupName, that it can't be set after the page is loaded ? (my groupName is set from a postProcess)
I've posted that code in the description...
... View more
04-16-2013
10:57 AM
For that you have to use spath...
You can spath a specific element, and then with a pipe make a second spath...
Spath input=input_field output=output_field path="path.to.my.container" | spath input=ouputfield path=path.into.my.container
Or simply the second spath without parameter will return all values in fields...
... View more
04-16-2013
04:59 AM
Does this is also supposed to work with a big xml $foo$ value ? I have a 1.3MB xml, I see it it Runtime debug, but I'm not pass it to the results, is it because of the quotes ?
I've tried with $foo$ and $foo.rawValue$...
... View more
04-15-2013
09:25 AM
I've found some possibility in oracle : alter session set NLS_DATE_FORMAT='DD-MON-YY'
But I'm not able to use that command in DBquery
... View more
04-15-2013
09:23 AM
side view provided an answer there
http://splunk-base.splunk.com/answers/83344/conditional-eval-resultsvaluesetter
In fact to add a row without results, we need a workaround by using a count, and hiding the field as :
| stats count | fields - count | eval
... View more
04-15-2013
09:18 AM
Yes one row is selected.
I know it is pretty strange, thats why I'm wondering if it is not linked to the dbquery ?
I'm using drilldown successfully on 10 other places without problem.
I've posted, output from table, and search under the table, as well as the entire code.
... View more
04-14-2013
10:16 PM
I have no event at all, I want to affect a value to a new field, and see it as result ... Is that possible ?
... View more
04-11-2013
11:32 PM
The name is correct, and foo variable is working correctly in html module (see description)
it is downstream , not directly
$foo$ is working on the html module... but not on textfield
I'm not sure to understand why the redirected is needed and how it works ?
... View more
04-11-2013
10:48 PM
1 Karma
![alt text][1]I have an Urlloader, and I'm unable to pass $foo$ value to the default value of a text field (I don't want a pulldown, because the user must be able to enter a value if nothing is coming from the url)
... View more
04-11-2013
09:58 PM
thanks for that.
I have still the problem that a "search eval..." return no row, how can I change this ?
In fact, it is probably the same, as when I want to make an spath on a $foo$ variable, I don't know either how to do it !
... View more
04-11-2013
05:16 AM
I'm trying to do this
You can do this using conditional eval command in the search language to
create one of N different search
language strings, and then a
ResultsValueSetter to pull down that
string-valued field, and plug it into
your search using another Search
module.
I've my main search, and a table
From that table I make a postprocess to build a $varSearch$ with the search String
My Problem is my postprocess seems not to work as desired :
eval varSearch=case($row.fields.H_message_type$=="test","AA",H_message_type=="Ctest","ZZ")
This gives no results, so I'm not able to use it i the underlying search... ?
... View more
04-11-2013
05:12 AM
I have a variable $var$, and want to display it a search result..
Whe I make
eval varSearch="test" | table varSearch
There are "no events found" how can I do that ?
Same problem when having a variable from upstream $var$ how can I use common eval function on that, and display it ?
... View more
04-11-2013
03:52 AM
There is no JS error, html after search is displaying the $search$
But on the html after the table, $row.fields.[fieldname] is not displaying anything... $search$ is also empty
I've but the debug output of the table element in description. After clicking a row, I can't see the debug from the Table element...
Elements under that table, haven't any key from the column of that table
Is there a limitation by dbquery that data cannot be used in underlying elements ?
... View more
04-10-2013
03:47 AM
splunk is still putting events together... _time difference is in ms...
I tried with span=1cs, but doesn't work :
[SimpleResultsTable module] invalid literal for int() with base 10: '0.01'
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
