About alexl1

alexl1 · ‎11-14-2019

|makeresults

alexl1 · ‎11-14-2019

I'm trying to use makeresults to test an alert but it doesn't work because "number of events" is always 0, but I thought the point of makeresults is to always make events?

alexl1 · ‎10-09-2017

hi, I want to send an email / run a script one time each for a bunch of ip's in a list, so I was going to iterate over them with the map function with a saved search, instead of setting up a separate saved search for each ip. However I can't get the emails to send. Is the saved search called by the map function allowed to send emails/run scripts? Thanks,

alexl1 · ‎08-28-2017

thanks! ,,,

alexl1 · ‎08-28-2017

hi, I created a lookup file a long time ago but I don't remember where it is, is there a meta command that can find the file if I give it the name of the lookup?

alexl1 · ‎05-18-2016

hi, Did newer versions of Splunk stop renaming fields with periods to underscores? This used to work, but does not work anymore after a couple of upgrades.

alexl1 · ‎04-13-2016

thanks -----

alexl1 · ‎04-13-2016

also not sure the difference between -h@h and -1h@h thanks

alexl1 · ‎04-13-2016

For example, if the time is 8:55 and I look for events -h@h , does that mean 7:00 (8:55-1=7:55, then to @h is 7) or 8:00? (8:55-1=7:55 but closest @h is 8:00) thanks

alexl1 · ‎08-20-2015

if I create an alert in the search app can I move it to another app later?

alexl1 · ‎07-01-2015

hi what is the syntax of the custom condition search I have a search like earliest=-5m heartbeat | stats count I want it to run a script when count=0 I tried "if custom condition is met" then for value I put "|where count=0" but the alert triggered even though count was one I can't find the documentatino about "if custom condition is met" otherwise I would have looked there thanks,

alexl1 · ‎04-13-2015

hi, Say I have a search that returns a list of IP addresses. What is the syntax to check if IPs in a second list do not appear in this result set?

alexl1 · ‎04-07-2015

hi, how do I re-run a search that I typed in previously? Thanks,

alexl1 · ‎12-11-2014

thanks! ..

alexl1 · ‎12-11-2014

(I used to know how to do it but I forgot)

alexl1 · ‎12-11-2014

hi, is there a way to rename a splunk field but that if the field name already exists it won't get clobbered? E.g. let's say some events have a field called oldfield and some already have a field called newfield I want oldfield to get renamed but if newfield exists (and I know old field won't exist if it does) then I want that to be newfield thanks,

alexl1 · ‎08-21-2014

thanks xxx

alexl1 · ‎08-21-2014

hi, I want to create a search that shows results whenever a particular field doesn't exist. I tried isnull but it didn't work. Thanks,

alexl1 · ‎05-19-2014

hello, I was wanting to do something like insert "some test data key=value" | search ... No data would actually be inserted, I would just use in order to test search commands. Thanks,

alexl1 · ‎01-09-2014

hi, what is the syntax for fieldname not equals regex thanks,

alexl1 · ‎12-17-2013

I found it regex _raw="b.g"

alexl1 · ‎12-17-2013

hi, if I want to find events using a regex what is the syntax? e.g if I want all events with either big or bag is there a way to use a regex like b.g thanks,

alexl1 · ‎12-14-2013

hi, can I create saved searches with php sdk like with javascript sdk?

alexl1 · ‎12-02-2013

hi, how can I display the last 20 or so of my previous searches in the web gui? Thanks,

alexl1 · ‎11-27-2013

sometimes I click on something I didn't mean to and it leaves the search results I was looking at. How do I get back to where I was? Thanks,

Posts	47
Solutions	2
Karma Given	5
Karma Received	9
Member Since	‎03-16-2012

Online Status	Offline
Date Last Visited	‎01-03-2022 11:24 AM

I'm trying to use makeresults to test an alert but...

Is the saved search called by the map command allo...

Is there a meta command to find old lookup files?

Did newer versions of Splunk stop renaming fields ...

does snap-to mean snap forward or snap back?

If I create an alert in the Search app, can I move...

what is the syntax of the custom condition search

If I have a search that returns a list of IP addre...

how do I re-run a search that I typed in previousl...

rename clobbers existing field with that name

Re: I'm trying to use makeresults to test an alert...

I'm trying to use makeresults to test an alert but...

Is the saved search called by the map command allo...

Re: Is there a meta command to find old lookup fil...

Is there a meta command to find old lookup files?

Did newer versions of Splunk stop renaming fields ...

Re: does snap-to mean snap forward or snap back?

Re: does snap-to mean snap forward or snap back?

does snap-to mean snap forward or snap back?

If I create an alert in the Search app, can I move...

what is the syntax of the custom condition search

If I have a search that returns a list of IP addre...

how do I re-run a search that I typed in previousl...

Re: rename clobbers existing field with that name

Re: rename clobbers existing field with that name

rename clobbers existing field with that name

Re: How to write a search that shows results whene...

How to write a search that shows results whenever ...

can I insert data from the search field to test se...

what is the syntax for fieldname not equals regex

Re: search using a regex

search using a regex

can I create a saved search with php sdk like with...

how to display more entries from history

is there an equivalent to the back button in a sea...