About Justin1224

Justin1224 · ‎09-26-2016

Sorry one final question. Why is the as capitalized (AS)? I thought that when "as" is in a search it renames a field as something else. But what does it does when it is capitalized? Thank you again and sorry for all the questions

Justin1224 · ‎09-26-2016

Lastly, is count(All_Assets) just getting a count of the instances of the field "All_Assets" within the data? Or is All_Assets a string?

Justin1224 · ‎09-26-2016

Sorry, one last question. In your original answer you said, "it uses the data model. and, it counts all assets as count." What datamodel is it using? What I mean is, what part of the search query specifies the datamodel? Is it Identity_Management or All_Assets? Or both? Thanks again

Justin1224 · ‎09-26-2016

Ok awesome thank you so much for your help.

Justin1224 · ‎09-26-2016

So to clarify, pivot doesn't change any of the data shown, it's just a different method to search with? Thanks again!

Justin1224 · ‎09-26-2016

Thank you very much for your answer! I'm still a little confused as to what pivot does in this query. I have read the documentation on it but am still unsure. Also, to recap what you said to see if I understand: the query is using the datamodel named "Identity_Management" and counts the instances of the field "All_Assets" and names this count as "count". (I'm unsure of what SPLITROW does.) Then sorts descending by field count. Is that correct? Also, could you explain what the SPLITROW part does in more detail, I'm still unsure of what it does. Thank you!

Justin1224 · ‎09-26-2016

I really appreciate the help, I'm still not understanding what rest is doing, however. Could you provide a little more clarification on that please? Thank you!

Justin1224 · ‎09-26-2016

Thank you very much for answering and for your help! So if my query starts with: tstats summaries=T from datamodel=blah then it is performing the search from accelerated data within the datamodel only? Also, if you were trying to replicate the search in a different search processing language, is there an equivalent to datamodels? What I mean by that is: filtering is standard to all search languages but I've yet to encounter datamodels, or maybe it's because I'm not understanding them right. I see them as sort of a filter, like: datamodel=blah filters to only look in the set of data contained within the datamodel "blah". So you won't see all your data, just the data within the datamodel "blah"? And how does the data get into the datamodel "blah"? Do I have the description for datamodel right? Thank you for your help

Justin1224 · ‎09-23-2016

Thank you for your help. I have no experience with SQL. I've read the Splunk rest documentation but I still don't understand it. And does a null field mean that the field is empty? Thanks again!

Justin1224 · ‎09-23-2016

Hi, here is my search string: | rest splunk_server=local count=0 /services/alerts/correlationsearches | fields title | join type=outer title [| rest splunk_server=local count=0 /services/saved/searches | fields title | eval savedsearch_title=title] | where isnull(savedsearch_title) AND title!="Manual Notable Event - Rule" Hi, I have a few questions regarding my search -What does the rest command do here? - Is splunk_server=local count=0 filtering to only search for events where splunk_server = local and count=0? - What does /services/alerts/correlationsearches do? - What does fields title do? - I know that join combines the results of a subsearch with those of a search from reading the Splunk page on it but how does it do that? And what is it doing in the search I have? -What's the last command doing? Thank you very much, any help will be appreciated!

Justin1224 · ‎09-23-2016

Hey all, I've just encountered the pivot command for the first time and after reading through the Splunk page on it, I am still confused as to what it does. If it helps, here is my search query: | pivot Identity_Management All_Assets count(All_Assets) AS "count" SPLITROW category AS "category" | sort - count Any help would be appreciated!

Justin1224 · ‎09-23-2016

I really need help because I've read through the Splunk documentation on tstats and their datamodel pages and I am still really confused about them. Are they just collections of your available data? Help would be appreciated

Justin1224 · ‎09-23-2016

That helps a lot, thank you!

Justin1224 · ‎09-23-2016

Right, what I'm unsure about though is: Is tstats .....blah...... datamodel=some_blah specifying a certain subset of your data to look through or something else? Like, when you have datamodel=some_blah in your search, is that telling you to only look inside "some_blah" to perform the search? And is that datamodel that you specify preexisting or do you create it?

Justin1224 · ‎09-22-2016

Why do you have to specify certain sets of data every time? What if you want to search in all of your data? Do you have to specify a certain subset of data every time you search?

Justin1224 · ‎09-22-2016

Hey everyone, I'm confused about what the second command in my search does. Here is the whole search: | useraccounts_tracker | search user_category=default | stats max(lastTime) as _time, values(user_category) as user_category, dc(dest) as dc(dest) by user | sort 100 - _time | fields _time,user,user_category,dc(dest) Specifically what I'm unsure about: -What does the search user_category=default command do? -What does the stats max(lastTime) as _time, values(user_category) as user_category, dc(dest) as dc(dest) by user command do? I know when it says "as" it's renaming fields. So other than that, what is it doing? Any help would be appreciated!

Justin1224 · ‎09-22-2016

Thank you for helping somesoni2. So it is grouping by the field _time and then aggregating those results by the field action? I'm unsure of what is being counted here. From what I understand it is saying it counts from the data model node that is called "Web" and aggregates these results first by _time field and then by action field. Which means it is performing this count for each 10 minute period and then performs that aggregation for each instance of the field action. I don't think my understanding there is correct. That seems like there would be a ridiculous number of results. Also, I'm completely lost as to what the second command does. I guess my questions are: Do I have that description for the first command right, what does the second command do, and what is the first command counting. Thank you for helping

Justin1224 · ‎09-22-2016

Thanks for the help! One thing I don't understand is that useother is supposed to have an = following it correct? So why does the useother in my query have a macro following it? Isn't it just supposed to be either =T or =F? And unfortunately I don't have any more information about the query, other than the query itself. Also, I get that the 'by _time' is grouping by the field '_time', but what is the 'Web.action' directly following it doing? Also, the span=10m groups by the field _time for every 10 minute, correct? If that's the case, when does it stop grouping? There's millions of different 10 minute periods within a few years time, there's no way it can aggregate by each of those. Lastly, I don't understand the description for what timechart minspan does. Could you try to describe it in simpler terms? Thank you for your help

Justin1224 · ‎09-22-2016

A note: what exactly does datamodel = "name" do? I was under the impression that it specified a location: "name", inside all of your available data to perform your search. But I'm not sure that's what it does now. Can anyone give me clarification on this? Thanks!

Justin1224 · ‎09-22-2016

Basically my problem is that I'm switching Splunk queries that I have into queries for a different search language. I don't yet have the capability to transfer the part of the search that specifies where to search, be it datamodel= , or a count by: IDS_Attacks.severity (grouping by the field severity within the parent node IDS_Attacks). So my question is: is datamodel= part of every search? Side question, does anyone who has experience with Elasticsearch know if you can/how to transfer these datamodel specifications to Elasticsearch query language.

Justin1224 · ‎09-22-2016

Hi, I'm having trouble understanding some portions of my search, I was wondering if someone could help me out. Here is my search: | `tstats` count from datamodel=Web by _time,Web.action span=10m | timechart minspan=10m useother=`useother` count by Web.action | `drop_dm_object_name("Web")` Even after reading the Splunk search reference page for timechart, I still don't really understand what it does. Also, I don't understand what span is doing in the first command and what minspan is doing in the second command. Lastly, I also am unsure of what useother is and what it is doing. Any help would be appreciated

Justin1224 · ‎09-21-2016

Great, thank you!

Justin1224 · ‎09-21-2016

Great thank you, you really helped me out!

Justin1224 · ‎09-21-2016

So the new field with name "sum(count" a value equal to the sum of the field count? So if count had values: 1, 2, and 3, then this "sum(count)" field will have a value of 6 (1+2+3)? Thank you for your help!

Justin1224 · ‎09-21-2016

Hey, a really basic question, but I'm unsure of the answer. What does stats sum(count) by do? I'm fairly sure that the -- by field -- part aggregates the results of stats sum(count) by the field given. But what does stats sum(count) do? I've looked for a while and can't figure out what it does.

Posts	84
Solutions	0
Karma Given	62
Karma Received	6
Member Since	‎09-08-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Is sparkline adding any new information to my sear...

Is this search just counting the number of events ...

Why is values(foo) here?

What's the difference between these two searches

What is being counted in this query?

Does tstats use datamodels the same way Pivot does...

Does count(foo) always count from a field?

Question regarding my search string

Clarification regarding pivot command

What does datamodel do?

Re: Clarification regarding pivot command

Re: Clarification regarding pivot command

Re: Clarification regarding pivot command

Re: Clarification regarding pivot command

Re: Clarification regarding pivot command

Re: Clarification regarding pivot command

Re: Question regarding my search string

Re: What does datamodel do?

Re: Question regarding my search string

Question regarding my search string

Clarification regarding pivot command

What does datamodel do?

Re: Clarification regarding search command and sta...

Re: Does tstats always specify a datamodel?

Re: Does tstats always specify a datamodel?

Clarification regarding search command and stats c...

Re: What is span, timechart, minspan, and useother...

Re: What is span, timechart, minspan, and useother...

Re: Does tstats always specify a datamodel?

Does tstats always specify a datamodel?

What is span, timechart, minspan, and useother doi...

Re: Questions regarding datamodel, stats, NOT, and...

Re: What does "stats sum(count) by" do?

Re: What does "stats sum(count) by" do?

What does "stats sum(count) by" do?

Join the Conversation