Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
07-09-2026
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
05-05-2015
04:45 AM
No, I would like to have something like this:
index=_internal | chart limit=5 useother=t count by host
... View more
05-05-2015
03:08 AM
Hi,
how can I show up the top10 results and the rest as OTHERS in a chart or stats command?
Like it can be done in a timechart:
sourcetype=data
| timechart span=1d count BY event_name limit=10
I tried out useother=t, but without success
BR
Heinz
... View more
05-05-2015
03:00 AM
Hm the documentation says it can be user for this property...
http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/ChartConfigurationReference
charting.legend.labelStyle.overflowMode (ellipsisEnd | ellipsisMiddle | ellipsisNone | ellipsisStart) ellipsisMiddle Determines how to display labels that overflow layout bounds by replacing elided text with an ellipsis (...).
... View more
05-05-2015
12:47 AM
1 Karma
Hi,
I would like to use this type of configuration in a dashboard:
<option name="charting.legend.labelStyle.overflowMode">ellipsisNone</option>
But after that, it is not possible to do changes like changing the cron schedule because of this error:
In handler 'savedsearch': Value of argument 'display.visualizations.charting.legend.labelStyle.overflowMode' must be either 'ellipsisEnd', 'ellipsisMiddle', or 'ellipsisStart'
BR
Heinz
... View more
- Tags:
- charting-options
04-16-2015
01:52 AM
Thanks, that's a good point! But I would still prefer disabling the function in the reports tab, it's much more comfortable.
... View more
04-16-2015
01:29 AM
Hi,
for dashboards it works that way. But when I want to edit a report in the "Reports" tab, it always starts the job automatically.
... View more
04-16-2015
12:18 AM
Hi,
is it possible to avoid the autorun for reports when clicking "open in search"?
BR
Heinz
... View more
04-09-2015
07:29 AM
We decided to adjust the inputformat. Extracting the fields in every search for this sourcetype was way too complicated.
Thanks for your ideas!
Heinz
... View more
03-26-2015
06:00 AM
thanks for your post. unfortunately this approach doesn't show the needed results
... View more
03-26-2015
03:50 AM
Hi,
is it possible to split-up/expand an event like this?
field1=xyz
field2=xyz
action: [ [-]
{ [-]
action_serial: 63
action_start: 1427365806891
action_name: A
params: { [+]
}
}
{ [-]
action_serial: 64
action_start: 1427365812718
action_name: B
params: { [+]
}
}
{ [-]
action_serial: 65
action_start_utc: 1427365813260
action_name: A
params: { [+]
}
}
{ [-]
action_serial: 66
action_start_utc: 1427365813937
action_name: B
params: { [+]
}
}
{ [-]
action_serial: 67
action_start_utc: 1427365831792
action_name: C
params: { [+]
There are 5 actions in the event. I would like to expand this one event into 5 events, where each event includes only one of the actions.
Thanks in advance
... View more
- Tags:
- expand
- multivalue
03-12-2015
09:52 AM
Hi,
I've created time-based lookup definition which I want to use in my search. The example.csv has a time field "timestamp" and the maximum offset is 1800.
sourcetype=A
| lookup example.csv key OUTPUT flag
How is the maximum offset used here? In the results, every event is flagged, not only the events during the maximum offset.
BR
Heinz
... View more
03-12-2015
09:42 AM
Hi,
after updating to 6.2.2 I tried to set up a new automatic lookup. I've created the lookup definition, but I can't select it in the automatic lookup menu afterwards. Only dnslookup, guid_lookup and sis_lookup are available. Before the update I did not have this problem....
BR
Heinz
... View more
12-23-2014
06:19 AM
Thank you!
... View more
12-23-2014
04:17 AM
Thanks, I will keep that in mind!
... View more
12-22-2014
01:32 AM
I've done another check which tells me that the both fields are numeric:
| eval isnum=if(isnum(timestamp), "true", "false") -> true
| eval isnum2=if(isnum(_time), "true", "false") -> true
... View more
12-22-2014
12:41 AM
What about an approach like this:
index="proxy" proxyblock=false [search index="the proxy" "badness" earliest=-1d | dedup hostname | return 1000 hostname]
| stats earliest(_time) AS earliest_time, earliest(eval(if(flag="badness", _time, null()))) AS earliest_badness_time BY hostname
| where earliest_time<earliest_badness_time
The results should only show hostnames with activitiy before flagged as "bad"
... View more
12-19-2014
02:38 AM
1 Karma
Hi,
is the maxout limitation of a subsearch defined as the number of events that can be used or the number of rows in the resulttable of my subsearch ( e.g. after stats or timechart command). I've seen both descriptions in the docs.
BR
Heinz
... View more
12-18-2014
11:52 PM
Hm, why is this not a numeric value? Calculatiions work fine, e.g.
| eval sum=timestamp+_time
... View more
12-18-2014
01:25 AM
1 Karma
Hi,
I'm using a search like this for a timerange of one single day:
sourcetype=A
| lookup lookup.csv id OUTPUT timestamp
| bucket span=1d _time
| eval flag=if(timestamp<=_time, "true", "false")
| stats dc(id) AS ids by flag
true -> 50
false -> 10
I tried out another way to verify the distinct count of ids for flag=true, but the result is different:
sourcetype=A
| lookup lookup.csv id OUTPUT timestamp
| bucket span=1d _time
| search timestamp<=_time
| stats dc(id) AS ids
result -> 60
I can't find the reason for different results here.
Best regards
Heinz
edit:
The "search" command in the second example seems to be the reason. The result is 50 by using "where timestamp<=_time".
Can somebody tell me the difference of search and where here?
... View more
11-27-2014
01:35 AM
2 Karma
Hi Mus,
thanks for your answers, this seems to be a possible solution.
I've found another option in the lookup "definitions" which is easier to use.
Minium matches: 1
Default matches: 100
BR
Heinz
... View more
11-26-2014
12:48 AM
Hi,
I would like to set up an automatic lookup, where a predefined value is used when there is no match in the lookup.
Let's say the lookup input field is Key=A and the lookup output field is amount=250. For events without Key=A the output should always be amount=100.
Using
| fillnull value=100 amount
in every the search would be possible, but including it in the automatic lookup would be much better. Is this possible?
Thanks in advance
Heinz
... View more
11-26-2014
12:32 AM
thanks a lot!
... View more
11-25-2014
01:27 AM
2 Karma
Hi,
is it possible to use a wildcard in the field value pair settings?
This way doesn't work for me:
field value pair: referral=A*
tag name: campaign1
BR
Heinz
... View more
Labels
- Labels:
-
fields
11-06-2014
06:28 AM
Hi,
is it possible to use the delete command after a lookup?
sourcetype=sourceA
| lookup delete_lookup.csv key OUTPUT flag
| search flag="delete"
| delete
Running this kind of search results in the warning "events could not be deleted".
Thanks for your help
Heinz
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2026
07:14 AM
|
Karma given to
