Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
07-09-2026
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
02-15-2016
02:59 AM
I'm sure there is an easier way, but you could try something like this to build a filter before your calculation:
| eval start_weekday=strftime(strptime(start_time,"%d/%m/%Y %I:%M:%S %p"),"%w")
| eval start_hour=strftime(strptime(start_time,"%d/%m/%Y %I:%M:%S %p"),"%H")
| eval close_weekday=strftime(strptime(close_time,"%d/%m/%Y %I:%M:%S %p"),"%w")
| eval close_hour=strftime(strptime(close_time,"%d/%m/%Y %I:%M:%S %p"),"%H")
| search start_weekday>=1 AND start_weekday<=5 AND start_hour>=9 AND start_hour<=17 AND close_weekday>=1 AND close_weekday<=5 AND close_hour>=9 AND close_hour<=17
... View more
02-10-2016
05:58 AM
Should this issue be fixed by " Moved the infobutton to the left to prevent interference with Splunk alerts and messages" in the version?
... View more
02-09-2016
08:08 AM
Hi,
is it possible to have 2 or more panels in a row when we schedule a PDF delivery? Currently, the PDF simply shows one panel after the other, no matter how the dashboard is arranged.
Thanks in advance
Heinz
... View more
02-01-2016
03:08 AM
1 Karma
You could use this (if StartTime is in epochtime, otherwise you need to convert it into epochtime)
| rename StartTime As _time
And then use the timechart command
| timechart span=1d sum(transaction_time) as total_transaction_time by DutyId
... View more
01-29-2016
05:06 AM
This tells me whether it is scheduled or not, but I can't see any information about the usage in dashboards.
... View more
01-29-2016
02:46 AM
Hi,
Is there a way to find (scheduled) reports that are not used in at least one dashboard?
Thanks in advance
Heinz
... View more
01-26-2016
01:57 AM
Thanks for the fast answer. The possibility to do that would be awesome 🙂
... View more
01-26-2016
01:55 AM
That's a good workaround for now. Thanks!
... View more
01-26-2016
01:39 AM
Hi,
is it possible to adjust the XML code of the infobutton App, so that I can reveal more scheduled reports instead of a html panel?
Thanks in advance
Heinz
... View more
01-26-2016
01:05 AM
Hi,
the infobutton can't be clicked in the infobutton app, when the elapsed time is shown in the top right corner. Is there a way to fix this in the xml code?
Cheers
Heinz
... View more
01-13-2016
11:58 PM
Oh, didn't know that...thanks!
... View more
01-13-2016
07:17 AM
Hi,
how can I define cell colours for a csv in the lookupeditor as shown here?
http://lukemurphey.net/projects/splunk-lookup-editor/wiki
Thanks in advance
Heinz
... View more
01-13-2016
05:01 AM
Awesome, thanks a lot!
... View more
01-12-2016
08:14 AM
Unfortunately the first table would be the result of a csv
... View more
01-12-2016
07:43 AM
1 Karma
Hi,
I would like to do a transformation like this:
Can you help how to achieve this?
Thanks in advance
Heinz
... View more
01-11-2016
08:11 AM
1 Karma
Without transaction it could look like this by using the streamstats command:
| streamstats last(event) AS previous_event current=f window=1
| search event="B" AND previous_event!="A"
... View more
01-11-2016
12:28 AM
Yes, we are working in a cluster. And we are deleting events several times per week...
Can we do some kind of maintenance work to fix this list of hidden events?
... View more
01-08-2016
02:53 AM
Yes, I've checked the indextime. These are definitely old events.
... View more
01-08-2016
01:23 AM
Hi,
we're experiencing that deleted events reappear and are searchable again. It seems to happen randomly from time to time.
What can be the reason for this behaviour?
Thanks in advance
Heinz
... View more
- Tags:
- delete
12-04-2015
06:41 AM
Hi,
I'm uploading multiple CSV files. Unfortunately, they don't have a usable field for the timestamp.
Is it possible to grab a part of the filename (source field) to define _time?
The structure of the filenames look like this:
"random count of signs 2015-11-01-2015-11-30.csv"
I'm thinking of a combination of strptime and substr , something similar to this command:
strptime((substr(source, 1, len(source)-15)), "%Y-%m-%d")
Best
Heinz
... View more
11-25-2015
07:30 AM
What about someting like this:
source="awback.csv" OR source="actback.csv"
| rename "MAC Address" as LAN_MAC_Address, "LAN MAC Address" AS LAN_MAC_Address, "PO Number" AS PO_Number
| stats values(Status) AS Status, values(Group) AS Group, values(Serial) AS Serial, values(PO_Number) AS PO_Number BY LAN_MAC_Address
... View more
11-24-2015
05:48 AM
2 Karma
The documentation says that this is not possible:
When Splunk Enterprise evaluates calculated fields, it evaluates each expression as if it were independent of all of the others. This means you can't "chain" calculated field expressions, where the evaluation of one calculated field is used in the expression for another calculated field.
http://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/definecalcfields
... View more
11-23-2015
11:57 PM
I'm doing this with a saved search:
....
| eval comment="Disclaimer"
| stats values(comment)
This is configured as single value vizualisation and can be added as dashboard panel. To update the displayed information in all dashboards just edit the | eval comment="Disclaimer" in the saved search.
... View more
11-23-2015
06:34 AM
1 Karma
sourcetype=foo NOT [inputlookup hostname.csv | fields+ host]
| stats values(host) AS new_hosts
The subsearch will exclude all known hosts from the list, so only new hosts are shown in the results
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2026
07:14 AM
|
Karma given to
