Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ramdaspr
ramdaspr
Contributor
Member since:
02-02-2015
06-05-2020
Community Statistics
| Posts | 123 |
| Solutions | 29 |
| Karma Given | 19 |
| Karma Received | 83 |
| Member Since | 02-02-2015 |
Activity Feed
- Got Karma for Re: How to add a first column to number each row in a table so when I export to csv, the results are a list of numbered items?. 04-07-2022 08:12 AM
- Got Karma for Re: Getting multiple stats for a single search. 10-18-2020 08:30 PM
- Got Karma for Re: Getting multiple stats for a single search. 10-18-2020 08:30 PM
- Karma Re: How to edit my search to return one count for each minute that has < 10 events, including minutes where event count is 0? for sideview. 06-05-2020 12:47 AM
- Karma Re: Can you mix Operating Systems in an indexer cluster? for joshd. 06-05-2020 12:47 AM
- Karma Panel not display Description property for zxtdmsoge002. 06-05-2020 12:47 AM
- Karma Re: How to count how many times a field value has changed for a stream of events over a period of time? for musskopf. 06-05-2020 12:47 AM
- Karma Re: How to control the number of top results shown from a search in Splunk 6.1.2? for musskopf. 06-05-2020 12:47 AM
- Karma Re: How to create a table based if condition result? for MuS. 06-05-2020 12:47 AM
- Karma Re: Is _time in UTC or local time? for cpetterborg. 06-05-2020 12:47 AM
- Karma Re: How to calculate multiple durations within a transaction for event pairs? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to create an average on the position for each value in events (ex: Dog = position 1 and 5, Average for Dog = 3)? for aalanisr26. 06-05-2020 12:47 AM
- Karma Re: how to get the total row number of a search result for dwaddle. 06-05-2020 12:47 AM
- Karma Re: If I have a table with daily averages, how do I display the standard deviation of these averages at the bottom of the table as a consolidated result? for acharlieh. 06-05-2020 12:47 AM
- Karma Re: How to edit my search to only show top 5 IPs by Office? for jtrucks. 06-05-2020 12:47 AM
- Karma Re: Replace '&' with ',' for David. 06-05-2020 12:47 AM
- Karma Re: How to extract all values for a single field using rex? for wpreston. 06-05-2020 12:47 AM
- Karma Re: Can I extract the values using 'rex mode=sed' ? for MuS. 06-05-2020 12:47 AM
- Karma Re: Can somone share a simple XML tag to change the Pie Chart label font size? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to pass 2 values at a time in a drilldown when clicking on a row in a table? for somesoni2. 06-05-2020 12:47 AM
Topics I've Started
No posts to display.
04-12-2015
04:52 PM
... | stats max(c84162281) as "Average Seizure Traffic per Line (Trunk Group)" by LABEL,TB_Category
Just add TG_Category to the grouping and it will provide the result by label and category.
... View more
04-08-2015
08:25 PM
My bad, it should be index_B at the start. Basically keep the larger index outside of the subsearch.
... View more
04-08-2015
06:09 PM
The join command might be useful here.
earliest =-7d index=index_A sourcetype=source_B field_B=* | fields field_B,field_C | join type=inner field_B [ search earliest=-7d index=index_A sourcetype=source_A | fields field_A | dedup field_A | rename field_A as field_B ] | fields field_B,field_C
If I understood the question correctly, then an inner join on the larger table B with table A would give the required output.
... View more
04-08-2015
05:09 PM
.. | rex "(?<text>.[a-z A-Z,-]+)" | timechart span=1w count by text
should work.
... View more
04-07-2015
05:27 PM
If you are trying to show it on a dashboard table, you can use the rowNumbers option to display the row numbers which should by default show them leftmost.
AFAIK there arent any other options of explicitly ordering columns, so if you do find any other solutions so post them here..
... View more
It might be useful to just add a comment stating it doesnt work in so-n-so version.. Or retag a post to mention the version.
Downvoting seems a bit harsh.
Might be useful to have some of the Splunk Moderators weigh in on the official stance.
... View more
04-06-2015
09:14 PM
2 Karma
Use the table command at the end and specify row as the first field to force the layout you need.
..| streamstats count as row | table row,field1,field2,field3
... View more
03-24-2015
04:19 PM
@premdutt
Use the 'Code Sample' button (5th button on the textbox menu while you write a comment) to paste the xml else the code is stripped out.
... View more
03-23-2015
11:10 PM
1 Karma
Missed something quite important, the suburb name could include a space which the above answer will not accept as a valid input.
rex field=_raw "\<mm\:SuburbName\>(?<suburb>[a-zA-Z ]*)\<.*"
Should work better as a solution there is a space between Z and ] to allow whitespace as an acceptable value in the Suburb Name.
... View more
03-23-2015
09:34 PM
1 Karma
Try with this. Seems to work for the same data you have.
rex field=t "\<mm\:SuburbName\>(?<suburb>\w+)\<.*"
... View more
03-23-2015
09:19 PM
We would need to see the input event so that we can help with the regex query.
... View more
03-23-2015
09:14 PM
Can you share a sample of the data set you are trying to work with?
Please enclose the example within the code sample (5th button on the textbox toolbox) so that the brackets arent removed.
... View more
03-23-2015
08:21 PM
The sample seems to be missing..
... View more
03-23-2015
04:44 PM
timechart avg($metric$) should work just fine if thats what you are looking for.
... View more
03-23-2015
04:06 PM
changed to an answer instead..
... View more
03-22-2015
10:49 PM
1 Karma
You can try with
<drilldown>
<!-- Use set to specify the new token to be created.
Use any token from the page or from the click event to produce the value needed. -->
<set token="metricname">$click.value$</set>
<set token="metricvalue">$row.count$</set>
<!-- If we also set the form.sourcetype the input will get updated too -->
<set token="form.value">$row.($metric$)$</set>
</drilldown>
and sourcetype=access_combined_wcookie host=pr* $metricname$=$metricvalue$| timechart count
I tried something similar in a test dashboard and it seems to work fine.
... View more
03-22-2015
04:40 PM
In which case your only option is to modify the search macro to result in the text "span=xxxxxx" instead of returning only the actual timespan.
An example is provided by martin
http://answers.splunk.com/answers/79779/passing-span-as-argument-to-timechart.html
... View more
03-19-2015
07:45 PM
.. | rex field=_raw "\'Via\'\s\'(?<viavalue>.*)\'"
viavalue would have the text between the single quote after via
... View more
03-19-2015
05:04 PM
one workaround would be to use an eval before the timechart command to resolve the macro and then use it on the span command
bla | eval tspan=`get_timespan("03/17/2015:00:00:00", "03/18/2015:00:00:00")` | timechart span=tchart ..
... View more
03-17-2015
11:05 PM
shouldnt the transforms.conf REGEX be
(?<LocalAdmin>.*\n|.*$)
... View more
03-17-2015
10:45 PM
You should be able to reference any field which is returned as a part of the results of your alerts query.
There is an example setup on the docs
... View more
03-17-2015
09:44 PM
1 Karma
You have most of the solution already implemented. Whats left is to define a token called $field1$ on the chart using the drilldown tag. You can look through the examples and details on the docs.
Set the Search field box token name to $field1$ so that it auto populates when you click on the chart and you already have the other panels updated to include the token so they will fire only when an ip is selected on the chart.
... View more
03-17-2015
05:06 PM
4 Karma
... | stats count(eval(Test_Result="Fail")) as failed, count(eval(Test_Result!="Fail")) as notfailed | eval Final_Result=if(failed>0,"Fail",if(notfailed>0,"Passed","NA")) | table Final_Result
This will give a single row with fail if it finds even a single record of fail and calls them pass otherwise i.e. any not marked Fail are considered passed.
... View more
03-16-2015
10:54 PM
Refer this
Simply put ((?[^:/?#]+):)?(//(?[^/?#]*))?(?[^?#|\s]*)(\?(?[^#|^\s]*))?(#(?.*[^\s]))?
cs_uri_authority is the one you are looking for.
... View more
03-12-2015
09:44 PM
1 Karma
the Like command might be of use.
... View more
