Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
07-09-2026
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
07-30-2014
07:51 AM
2 Karma
Hi,
I'm using a column visualization and the stack mode "100%". It would be nice to have the percentages in the chart instead of total values. Is this possible without calculating the percentages in the search?
BR
Heinz
... View more
07-24-2014
02:57 AM
I just tried out another apporach and it seems to work fine:
...
| eval month=strftime(_time, "%Y_%m")
| stats values(month) AS months by user_id
| stats dc(eval(if(months="2013_11" AND months="2013_12", user_id, null()))) AS users
... View more
07-24-2014
02:28 AM
In the end, I want to have a chart that shows the number of active users in 2013_12, who have been active in 2013_11 as well.
I'm wondering, why it is not possible to use it in the if command? Using it as " | search 2013_01="1" is working, so Splunk seems to know that it is the fieldname here
... View more
07-24-2014
02:24 AM
These are the column names after the chart command. The Stats command should count number the users if the value in both columns is "1"
... View more
07-24-2014
02:04 AM
Hi,
my search looks like this:
...
| eval month=strftime(_time, "%Y_%m")
| chart dc(user_id) as count by user_id, month
| stats dc(eval(if(2013_11="1" AND 2013_12="1", user_id, null()))) AS output
The stats command does not work and I don't know why
"Error in 'stats' command: The eval expression for dynamic field 'eval(if(2013_11="1", account_id, null()))' is invalid. Error='The expression is malformed. Expected ).' "
I've used such a command many times before and Splunk never complained about it.
BR
Heinz
... View more
07-16-2014
07:49 AM
1 Karma
Great, I'm on version 6.1 and it works fine! Thanks a lot.
Is it also possible to create a submit button for every panel? I tried to move the
<fieldset submitButton="true"> ...
to the panel level, but this caused an error.
... View more
07-16-2014
05:15 AM
Hi,
is it possible to create a dashboard and define different input elements for each panel? At the moment all panels in my dashboard react with the input elements at the top. I didn't find any information in docs how to achieve this.
BR
Heinz
... View more
07-15-2014
07:02 AM
Klasse, danke dir
... View more
07-15-2014
06:51 AM
Kannst du mir noch verraten, wie ich einen fest definierten Wert einfüge, sofern es keinen match beim automatic lookup gibt?
Mit einem normalen lookup würde ich es so lösen:
| lookup lookup.csv user OUTPUT country_code
| fillnull valu="N/A" country_code
... View more
07-15-2014
04:19 AM
1 Karma
Klingt gut, dann werde ich es mal mit einem automatic lookup versuchen.
Vielen Dank!
... View more
07-11-2014
05:24 AM
Schon mal vielen Dank für deine Hilfe!
Es sind momentan über 400.000 Einträge im Lookup. Also muss ich wohl die zweite Variante nutzen.
Ein automatic Lookup würde dann in jeder Suche mit dem sourcetype verwendet werden richtig? Wenn er nicht immer benötigt wird, macht es evtl mehr Sinn ihn nur bei Bedarf zu setzen um ansonsten Performance zu sparen.
Welchen Unterschied macht es in obiger Suche eigentlich ob ich
| where country_code="$country_code$"
oder
| search country_code="$country_code$"
Mit "search" könnten ja wildcards genutzt werden.
... View more
07-11-2014
04:42 AM
z.B. so:
Enter an countrycode
*
Today
test1
sourcetype=A country_code=$country_code$
| lookup lookup.csv user OUTPUT country_code
| where country_code="$country_code$"
| stats count "
scheint auf den ersten Blick zu funktionieren.
dann ist allerdings kein ALL, * etc mehr möglich
... View more
07-11-2014
04:34 AM
Super, das funktioniert schon mal.
Aber ist eine subsearch nicht unpraktisch, weil es ein Limit für die Ergebnisse gibt? Außerdem wird die Suche extrem langsam.
Wäre es nicht besser die Events im nachhinein zu filtern, wenn der Lookup schon durch ist?
... View more
07-11-2014
03:39 AM
Hi Martin,
können wir wieder auf Deutsch umschwenken? 🙂
Ich bewege mich grad zum ersten mal auf diesem xml-Terrain und weiß nicht genau was du meinst. Wo könnte ich den lookup command evtl hinschieben?
... View more
07-11-2014
03:12 AM
Hi,
is it possible to add field via lookup and use this as text form input element?
I tried it out by using this xml, but it did not work:
Here is my example:
<fieldset autoRun="true" submitButton="true">
<input type="text" token="country_code" searchWhenChanged="true">
<label>Enter an countrycode</label>
<default>*</default>
<default/>
</input>
<input type="time">
<default>Today</default>
</input>
</fieldset>
<row>
<table>
<title>test1</title>
<searchString>sourcetype=A country_code=$country_code$
| lookup lookup.csv user OUTPUT country_code
| stats count</searchString>"
BR
Heinz
... View more
06-06-2014
03:43 AM
Hi dmlee,
yes, the length is fixed. "new_Heinz" is exaclty what I need 🙂 Thanks a lot!
... View more
06-06-2014
01:49 AM
Hi,
I've got some fieldvalues like this:
field=aaaaaaaabbbbccccddddeeeeeeeeeeee
I would like to add a "-" after character 8,12,16 and 20:
field=aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
Thanks for your help
Heinz
... View more
06-04-2014
03:32 AM
Yes, that's the way I check for my lookups usually. And usually they appear in the app I'm running the search...
... View more
06-04-2014
01:04 AM
Hi,
thanks for your answers. I've always used the command without the createinapp param and everything appeared in the settings...
In this case I tried out createinapp=true, but unfortunately it does not solve the problem. It still doesn't appear in my settings.
... View more
06-04-2014
12:01 AM
Hello,
I'm running a dbquery and would like to save the results as a lookuptable.csv.
| dbquery mysearch | outputlookup lookuptable.csv
After running the search this works:
| inputlookup lookuptable.csv
But I can't find the file in the settings to adjust the permissions, delete the file or something else. What am I doing wrong?
BR
Heinz
... View more
05-21-2014
06:15 AM
Hi MuS,
thanks for this helpful link. It says to "edit panels -> add input". I can't find this add input option...
... View more
05-21-2014
05:48 AM
Hi,
in the license usage dashboard the searches can be adjusted by selecting the "pool" or "split by" menu. Is it possible to achieve something like this in usual reports or dashboards as well?
BR
Heinz
... View more
05-21-2014
01:34 AM
In the end I want to calculate different stats by country. To include data from sourcetype B as well, I need the field country for the userids in this sourcetype.
... View more
05-20-2014
07:15 AM
thanks, this works as well. but in my experience eventstats is veeery slow, so I would like to avoid it if possible
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2026
07:14 AM
|
Karma given to
