Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
07-09-2026
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
05-20-2014
07:02 AM
Hi,
there are two sourcetypes A & B which I want to use a search. Both them have a field userid.
Let's say sourcetype A tells us userId=1 is from country=US. In sourcetype B the field country does not exist. Is there a possibility to do a lookup in search time, that the country is added for all events of userid=1 in sourcetype B as well?
It would be possible to run a search for sourcetype A and create a lookup.csv.
col1,col2
userid,country
And use this csv in a next step:
sourcetype=A OR sourcetype=B | lookup lookup.csv userid OUTPUT country
But I think there is a better/easier way which I don't know 🙂
BR Heinz
... View more
- Tags:
- lookup
- sourcetypes
05-20-2014
06:38 AM
Hi,
I've got ~15.000 events where FieldA exists (in total there are 20.000.000 events). I want to filter out these events and I'm wondering about the performance of different approaches.
Why is
sourcetype=X AND FieldA=*
so slow compared to this
sourcetype=X AND FieldA
BR
Heinz
... View more
05-15-2014
05:35 AM
Hi lguinn,
I've adjusted your approach to this and it seems to work fine:
| bucket span=1mon _time
| lookup lookup.csv userid OUTPUT first_appearance
| bucket span=1mon first_appearance
| eval month0=relative_time(first_appearance,"@mon")
| eval month1=relative_time(first_appearance,"+1mon@mon")
| eval month2=relative_time(first_appearance,"+2mon@mon")
| eval month3=relative_time(first_appearance,"+3mon@mon")
| eval month4=relative_time(first_appearance,"+4mon@mon")
| eval month5=relative_time(first_appearance,"+5mon@mon")
| eval month6=relative_time(first_appearance,"+6mon@mon")
.
.
.
| eval month_after_appearance=case(_time=month0, "0",
_time=month1, "1",
_time=month2, "2",
_time=month3, "3",
_time=month4, "4",
_time=month5, "5",
_time=month6, "6",)
.
.
.
| stats dc(userid) by month_after_appearance
Thanks a lot!
... View more
05-14-2014
08:31 AM
After some adjustments in my search, it works like expected. Thanks a lot 🙂
... View more
05-14-2014
04:52 AM
Hi MuS,
I'm not using inputlookup, the table is just called lookup.csv.
The inputfields are existing in the lookuptable and the event. It is an "and" combination of the inputfields, correct? So the lookup should work and add fieldA for an event, when this combination "User/Country" exists in the lookuptable as well.
... View more
05-14-2014
03:30 AM
4 Karma
Hi,
is it possible to use more than one input field within a lookup command?
The lookuptable looks like this:
User | Country | FieldA
I tried it like this, but it didn't work:
| lookup lookup.csv User, Country OUTPUT fieldA
BR
Heinz
... View more
05-14-2014
12:55 AM
Thanks for your suggestion.
Unfortunately this approach will cause problems, if month_of_current<=month_of_first_appearance.
... View more
05-13-2014
08:12 AM
Hi,
I'm doing an analysis about users whose first event was in January 2014. I want to know, what they did in month 1,2,3 after their first appearance. For these users the January would be month "0". Feb would be "1", March "2" and so on...
So the goal is to add a field to every event: "month afer first appearance" with a numeric value.
Is it possible to calculate to month after the first appearance?
I already did something like this for the "day after first appearance". It looked like this:
| bucket span=1d timestamp_of_first_appearance
| bucket span=1d timestamp
| eval day=(timestamp-timestamp_of_first_appearance)/86400
But I can't do this for a monthly perspective, because the duration for the months varies
BG
Heinz
... View more
05-13-2014
07:50 AM
Hey, thanks for your answer.
Yes, the user is allowed to view them. And everything works fine, when the cache is refreshed once again after setting the permissions for this user.
... View more
05-06-2014
06:39 AM
Hi,
I've changed the permissions of a dashboard, to allow user A to have a look at it. The included reports are scheduled every night.
When user A opens the dashboard no cache is used and all reports start searching from scratch. Is there a way to avoid this? It's a bit uncomfortable to wait for the next schedule or rerun the cache manually, everytime I change read permissions for new users.
BR
Heinz
... View more
04-16-2014
12:14 AM
Sounds good, I'll get some admin support and have a look at this. Thanks!
... View more
04-14-2014
04:25 AM
Hi,
I've added several single value visualizations to a dashboard. Is it possible to adjust the font size for each panel in the xml view?
BR
Heinz
... View more
03-26-2014
08:49 AM
thanks a lot!
... View more
03-26-2014
08:49 AM
thanks a lot!
... View more
03-26-2014
08:19 AM
Hi,
I'm using several scheduled and non-scheduled reports in a dashboard. Everytime I reload the dashboard the colors of the graphs are changing. One time graph 1 is red, next time graph 1 is green.
Is there a way to avoid this?
BR
Heinz
... View more
03-14-2014
06:31 AM
Unfortunately I don't have an unique identifier for each event like your proposed session_id
... View more
03-13-2014
04:07 AM
I've got two additional questions regarding this topic:
How can I search for the count of events that have duplicates?
How can I search for the total number of duplicates?
BR
Heinz
... View more
03-12-2014
06:50 AM
2 Karma
Hi,
what is the easiest way to filter out event duplicates without adding every field in the dedup command?
Is
| dedup _raw
the correct approach?
BR
... View more
02-28-2014
05:05 AM
Adjusting the limits.conf did not solve the problem... Searches using the lookup command still fail randomly, so I would still be happy about additional hints.
BR Heinz
... View more
02-25-2014
12:22 AM
1 Karma
Hi,
is it possible to run a scheduled report in verbose mode? I've got some saved reports in verbose mode, when I open the cached results it's always showing fast mode.
BR
Heinz
... View more
02-23-2014
11:08 PM
I tried to change this value in the limits.conf as a first workaround, so that the lookup is not indexed.
[lookup] max_memtable_bytes = 50000000
I'm not sure whether this works. Is it possible to run a search thats shows the folder & size of the .csv (and the index if it exists)?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2026
07:14 AM
|
Karma given to
