Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
07-09-2026
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
06-06-2017
02:55 AM
that would mean to much effort 🙂 but thanks anyway!
... View more
06-02-2017
06:47 AM
I'm not sure how this is supposed to look like. I would need a form dashboard and would not be able to use saved searches, right?
... View more
06-02-2017
06:06 AM
Hi,
is there an option to add the runtime of the search to the panel actions?
Thanks in advance
... View more
06-02-2017
05:59 AM
thanks a lot 🙂
... View more
06-02-2017
05:39 AM
to me, it looks like this only includes searches that are used in dashboards. can we add those that are not used in a dashboard? I would like to unschedule them
... View more
06-02-2017
01:35 AM
Hi,
For each app I would like to check whether there are scheduled reports which are NOT used in a dashboard.
Is there a search to do this?
Thanks in advance
... View more
05-19-2017
04:56 AM
This all works, but it does not help to solve my problem. I'm sure it's simply because I not able to describe my problem/need properly. But I found an ugly workaround to answer the problem... 🙂
Thanks anyway for your input!
... View more
05-19-2017
04:56 AM
This all works, but it does not help to solve my problem. I'm sure it's simply because I not able to describe my problem/need properly. But I found an ugly workaround to answer the problem... 🙂
Thanks anyway for your input!
... View more
05-17-2017
04:47 AM
I tried it out on the real data, but without success. So I wanted to test a general example and obviously I did it wrong 🙂
So my real _raw data looks like. Perhaps you can help directly on that:
{"buildersAmount":1,"campLevel":2,"payload":{"hordeComposition":{"Config_Zombie_Chubby":4,"Config_Zombie_Exploder":4,"Config_Zombie_Floater":1,"Config_Zombie_Walker":9}},"timestamp":1495017137}
The bold parts are the ones I want to extract and group by.
... View more
05-16-2017
11:45 PM
Thanks for your answer, but this approach does not work for me. I tried to create a search example to check:
index=_internal | head 1
| eval payload.productName1="A"
| eval payload.productName2="B"
| rex max_match=0 "(?<product>payload\.\S+)"
| table product, payload.productName1, payload.productName2
Unfortunately I'm not familiar with rex commands
... View more
05-16-2017
11:44 PM
Thanks for your answers, but the commands does not work for me. I created an easy search example to check it
index=_internal | head 1
| eval payload.productName1="A"
| eval payload.productName2="B"
| rex max_match=0 "(?<Product>payload\.productName\d+)"
| rex max_match=0 "(?<MV>payload\.productName[^:]*:)"
| table MV, Product, payload.productName1, payload.productName2
Unfortunately I'm not familiar with rex commands
... View more
05-16-2017
05:22 AM
Hi,
let's say we have events with fields like:
Event A:
payload.productName1:
payload.productName2:
Event B:
payload.productName2:
payload.productName3:
How can I get the table below with one single "stats count By"?
product | eventCount
payload.productName1: 1
payload.productName2: 2
payload.productName:3 1
I thought of an approach to create a multivaluefield that includes all fieldnames like payload.productName* (the exact amount and names are unkown so I have to use a pattern) and group by this new MV afterwards
MV={payload.productName1, payload.productName2, payload.productName3}
...| stats count by MV
Thanks in advance
... View more
- Tags:
- group
- multivalue
05-10-2017
08:17 AM
2 Karma
try this:
| eval weight=(S0*1000000 + S1*10000 + S2*100 + S3*1)
| sort 0 - weight
... View more
04-28-2017
07:47 AM
7 Karma
Try to add this at the end of your search
| replace 1 WITH "Walmart" , 2 WITH "WholeFood" , 2 WITH "Costco" IN store_id
... View more
04-24-2017
12:48 AM
Awesome thanks, it there something similar for dashboards as well?
... View more
04-24-2017
12:27 AM
Hi,
Is it possible to write a search that shows all saved searches, reports & lookup tables that are shared globally?
Thanks in advance
... View more
- Tags:
- splunk-enterprise
04-21-2017
07:50 AM
Thanks for your answers.
This approach works fine so far. But you are right, it skips levels where no one fell out, which could be misleading in some cases. Any idea whether this can be fixed in this search?
In my definition of a funnel the users enters it, when he completes the first step. So I don't care about users with zero steps in this kind of analysis.
... View more
04-20-2017
07:17 AM
Hi,
let's say I want to create a 5 step-funnel for customers depending on their max step.
My first approach would be like
...
| stats max(funnel_step) AS max_step BY customer
| stats dc(eval(if(max_step>=1, customer, null()))) AS customers_finished_step1,
dc(eval(if(max_step>=2, customer, null()))) AS customers_finished_step2,
dc(eval(if(max_step>=3, customer, null()))) AS customers_finished_step3,
dc(eval(if(max_step>=4, customer, null()))) AS customers_finished_step4,
dc(eval(if(max_step>=5, customer, null()))) AS customers_finished_step5
When a customer only triggered step5, he should count for all steps before as well. That's why I don't use a simple count by funnel_step.
For funnels with much more steps the approach above would result in very long searches. Is there a better way to avoid all the dc(eval(if(max_step>=x, customer, null()))) parts?
Thanks in advance
... View more
04-05-2017
01:45 AM
to avoid the limit use
| sort 0 _time
... View more
04-04-2017
07:52 AM
works fine, thanks a lot
... View more
04-04-2017
07:03 AM
Hi,
is it possible to use fillnull for fields with a specific pattern? Wildcards are not working, but I want to avoid using fillnull for each and every field.
For example I would like to fillnull all fieldnames that contain "ABC".
Cheers
Heinz
... View more
04-03-2017
05:51 AM
awesome, thanks a lot
... View more
04-03-2017
05:31 AM
Hi,
Is it possible to write a search that shows the selected timeranges for all saved searches? The result table would be like
app | saved search | earliest | latest
Thanks in advance
... View more
- Tags:
- splunk-enterprise
03-22-2017
05:24 AM
Creating a colADup column and using it in foreach works as well. I don't get it 🙂
... View more
03-22-2017
04:23 AM
Hi,
I'm trying to calculate the ratio for all columns of a table compared to a specific column. So in the example below, just divide every column by colA. For some reason this does not work for all columns (colD is wrong), do you have any idea why?
When I decide to write the calculated values into new columns instead of replacing them, it works
Thanks in advance
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2026
07:14 AM
|
Karma given to
