About fredclown

fredclown · ‎07-05-2023

I understand that it is by row or cell. I'm clicking on a mv cell and wondering if there is a way to get the index of the cell item I clicked on. My hunch is no ... I've been searching and not finding anything, but thought I would reach out to the experts to see if there might be a trick I'm unaware of.

fredclown · ‎07-05-2023

In a simple XML dashboard is there a way to get the index of a clicked mv field in a dashboard drilldown? For instance, if I click on 5 in the count field of row 1 I would like to also get the user bob into a token. If I know the index of the count that I clicked on I could use $row.user$ and then split it by comma and keep the one with the same index as the count that was clicked. Or maybe there is an even better way to do this ... I'm all ears. host user time count host1 bob joe 2023-07-05 07:36:51 2023-07-05 07:49:32 5 4 host2 steve john 2023-07-05 09:22:02 2023-07-05 06:14:12 4 4 I suppose I could do something like combining values in a field and parsing it on click like the below examples. However, if possible, I would like to have them in separate fields as I think it looks nicer. host user time count host1 bob joe 2023-07-05 07:36:51 2023-07-05 07:49:32 5 {bob} 4 {joe} host2 steve john 2023-07-05 09:22:02 2023-07-05 06:14:12 4 {steve} 4 {john} OR host user | time | count host1 bob | 2023-07-05 07:36:51 | 5 joe | 2023-07-05 07:49:32 | 4 host2 steve | 2023-07-05 09:22:02 | 4 john | 2023-07-05 06:14:12 | 4

fredclown · ‎06-27-2023

Did this get you what you were looking for? If so, please mark the solution as accepted.

fredclown · ‎06-26-2023

The inputlookup command has an append option for it so that you do not have to use a subsearch and the limitations that come with those. index=user | inputlookup lookup.csv append=true | eval fromlookup=if(isnull(source), "true", null()) | eval stripped_email_address = replace(email_address, "@xyz.com.*", "@xyz.com") | stats list(email_address) as email_address list(department) as department values(fromlookup) as fromlookup by stripped_email_address | where mvcount(email_address) > 1 OR isnull(fromlookup)

fredclown · ‎06-26-2023

This should get you what you want. {your base search here} | chart useother=f limit=0 count by serviceName, responseCode

fredclown · ‎06-26-2023

Something like this should work. index="xyz" [ | makeresults count=1 | eval fileName="this.is.my.file.received.on."+strftime(_time, "%Y%m")+".test.json" | fields fileName | format ] | {the rest of your SPL}

fredclown · ‎06-21-2023

Oh, goodness! I was not aware of the time() function. That's what I was looking for. Thanks.

fredclown · ‎06-21-2023

The example I gave is a simplified one to show the behavior. My real SPL has the | rest command inside the map. The | rest command does not return _time. I am trying to figure out the time the rest command started for each iteration of the loop. My hunch is this isn't possible.

fredclown · ‎06-21-2023

I was using makeresults as a simplified example to show the behavior. My real SPL is using the rest command inside the map. There is no _time with results returned from | rest. I'm trying to get the time the rest command was started for each iteration of the loop. My hunch is this is not possible.

fredclown · ‎06-20-2023

It appears that using now() inside of the map command will always return the time that the map was started rather than the time for each loop. The below SPL shows an example of this. Does anyone have any thoughts on how to get the time for each iteration of the loop? | makeresults count=100 | map maxsearches=100 search="| makeresults count=1 | eval outer_time=$_time$ | eval outer_time_formatted=strftime($_time$, \"%Y-%m-%d %H:%M:%S\") | eval now=now()" | table outer_time_formatted outer_time _time now

fredclown · ‎06-08-2023

It's not an error. It is a warning (it has the yellow triangle icon). You will see that ... I see that on my servers. That is unavoidable and is a Splunk issue, but it does not affect the results of the search.

fredclown · ‎06-08-2023

I'm not sure this works any more. The update field that is returned from the REST API is always set to"1969-12-31T16:00:00-08:00" for all my servers. Maybe it's just my environment. Anyway, here is an alternate solution. | rest splunk_server=* /services/search/jobs/export search="| makeresults count=1 | rename _time as time" output_mode=csv | makemv tokenizer="([^\n]+)" value | eval local_time=now() | eval remote_time=mvindex(value,1) | eval local_time_formatted=strftime(local_time, "%Y-%m-%d %H:%M:%S") | eval remote_time_formatted=strftime(remote_time, "%Y-%m-%d %H:%M:%S") | eval delta_secs=abs(local_time-remote_time) | fields splunk_server, local_time_formatted, remote_time_formatted, delta_secs | sort - delta_secs

fredclown · ‎06-08-2023

It works very well on the multiple search heads I've put it on. Also, this is originally not my macro. I've simply made some tweaks to it to account for some bugs in the original. Originally, this comes from a splunk.com blog post and the source has been put on github.

fredclown · ‎06-07-2023

That's not an error. It's a warning and yes, you will see that. That is unavoidable, but it does not affect the results. Also your server "socsiemfe" needs to be set as a search peer on the search head you are searching from ... if you've not done that already. Otherwise, it will not be able to call the REST api for the "socsiemfe" search head. It can be set up in (Settings -> Distributed search -> Search peers).

fredclown · ‎06-07-2023

Simply running this will not work. rest splunk_server=$server$ /services/search/jobs/export search="| inputlookup $lookup$ It is not correctly formatted. It is missing the pipe at the beginning, the quotes are imbalanced, and the $server$ and $lookup$ tokens are not set. A simplified version of the first line that would be returned from the macro would be the below SPL. The $server$ and $lookup$ tokens are replaced by the macro call. Also, the macro SPL does not have the preceding pipe on purpose. It is expected that the pipe will be supplied before the macro call "| `remotelookup(server,lookup)`". Also, if you do not supply the "output_mode=csv" in the "| rest" command you will not see anything. This is required. | rest splunk_server=local /services/search/jobs/export search="| inputlookup geo_attr_us_states.csv" output_mode=csv

fredclown · ‎06-07-2023

I'm not using the v2 endpoint. Yes it is deprecated, but typically that takes a while to be completely removed as they try to support backwards functionality for a while. Like I said hopefully at some point they either add the GET method for the v2 endpoint or they add an option in the "| rest" command to support POST.

fredclown · ‎06-07-2023

That REST endpoint only supports POST right now now and the "| rest" command only supports GET. So, you cannot use that endpoint in the Splunk UI yet. Hopefully, they will add the GET method to it at some point.

fredclown · ‎06-07-2023

It sounds like what you want to do is join two datasets based on a couple common field. Is that correct? There are a few commands in Splunk that let you do this and it depends upon your use case which you would use. Could you post example data (not real data) with the appropriate field names and an example of what you would like to see as the result?

fredclown · ‎06-07-2023

Try this REST endpoint (/services/search/jobs/export). The "v2" is the problem.

fredclown · ‎06-07-2023

Did this get what you want? If so, please accept the solution. If not, let me know and I'll try and fix whatever isn't right in it. Thanks.

fredclown · ‎06-07-2023

Have you set up the remote server as a search peer? If so is it showing as healthy in the search peers UI? Is the remote server a full Splunk install (not a UF)? This does work with 9.x, although I did have to make a tweak yesterday but it should work now. The code above has been updated. However, the tweak I made should not have corrected the issue you are having. In fact when I tried it on 9.x without the tweak I didn't get an error. So, the fix is probably not related to your issue.

fredclown · ‎06-06-2023

What is the error?

fredclown · ‎06-05-2023

That is a good option. I think my way would work as well, but I like the output of something like this better. It looks cleaner.

fredclown · ‎06-05-2023

After thinking about it more for a bit I think this should work and do the same thing as != for each field/value pair but still allows me to use | format. | format "ip=* AND (NOT" "" "" "" "NOT" ")" I think this should give me the same results. Does this look right?

fredclown · ‎06-05-2023

I have a search and in the initial part of the search I have a subquery that returns some IP addresses formatted like this using the | format command. (ip="10.10.10.10 OR ip="1.1.1.1" OR ip="2.2.2.2") I have a different search where I want to negate it. Is there a way to do this? I know that the format command does allow you to do things like this ... (NOT ip="10.10.10.10 NOT ip="1.1.1.1" NOT ip="2.2.2.2") However, NOT ip="value" is not the same as ip!="value" in Splunk land. So, I guess I'm wondering if anyone has a great way in a subquery to pass back the field/value pairs with != rather than =. My hunch is | format can't do it, but maybe there is a different way. Hope that makes sense.

Posts	154
Solutions	10
Karma Given	81
Karma Received	40
Member Since	‎07-17-2013

Online Status	Offline
Date Last Visited	‎08-06-2025 08:00 AM

Is it possible to do search time field extraction ...

Dashboard Studio Input Change Event Handler

Can you still search logs on an indexer that is tu...

Non replicated internal indexes

Remove HTTP Port in Alert Email Link

Prepending String to All Email Subjects

Dashboard Drilldown Get Index of Click MV Field

Any examples of using now() inside map command?

Is it possible to use | format to get !=?

Is there only ones way to Fire JavaScript After Se...

Re: Dashboard Drilldown Get Index of Click MV Fiel...

Dashboard Drilldown Get Index of Click MV Field

Re: Taking Count of Response Codes by Endpoints wi...

Re: How to match email from index with a lookup fi...

Re: Taking Count of Response Codes by Endpoints wi...

Re: How to pass current year and month to search q...

Re: Using now() Inside Map Command?

Re: Using now() Inside Map Command?

Re: Using now() Inside Map Command?

Any examples of using now() inside map command?

Re: How get data lookup from other remote peer?

Re: Where to check the clock skew

Re: How get data lookup from other remote peer?

Re: How get data lookup from other remote peer?

Re: How get data lookup from other remote peer?

Re: How get data lookup from other remote peer?

Re: How get data lookup from other remote peer?

Re: How to merge two very high volume index into o...

Re: How get data lookup from other remote peer?

Re: comparing 2 KV files

Re: How get data lookup from other remote peer?

Re: How get data lookup from other remote peer?

Re: Is it possible to use | format to get !=?

Re: Is it possible to use | format to get !=

Is it possible to use | format to get !=?

Join the Conversation