Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About aholzer
aholzer
Motivator
Member since:
08-07-2012
04-15-2024
Community Statistics
| Posts | 404 |
| Solutions | 53 |
| Karma Given | 114 |
| Karma Received | 201 |
| Member Since | 08-07-2012 |
Activity Feed
- Got Karma for Re: Why am I unable to multiply two fields fields with my current search syntax?. 06-11-2024 10:44 AM
- Karma Re: Retrieving all fields that have a certain value for aljohnson_splun. 05-19-2023 11:56 AM
- Got Karma for Re: How to find records between 1 year period?. 06-21-2022 02:07 AM
- Got Karma for Re: how to fill null values using another field value. 05-10-2022 02:49 PM
- Got Karma for Re: Why does SPLUNK show Date as a number?. 01-25-2022 12:54 AM
- Karma Re: How to find all the searches having "index=*" in the search or Alert or Reports for alemarzu. 01-06-2022 10:44 AM
- Got Karma for Re: Dealing with hostnames difference and Lookups in Splunk. 04-25-2021 11:58 PM
- Got Karma for Re: stats based on all events and filtered. 12-17-2020 12:26 AM
- Got Karma for Re: How to replace/remove a specific character?. 10-21-2020 07:23 AM
- Karma Re: Does anyone know why /opt/splunk/var/run/splunk/lookup_tmp would fill up to 65GB on a search head? for tkw03. 09-16-2020 02:28 PM
- Got Karma for Re: In a search, how would I get the difference between the primary region and all other regions?. 06-05-2020 12:50 AM
- Karma Re: Why is my bucket not rolling to frozen? for richgalloway. 06-05-2020 12:49 AM
- Karma What is "BatchAdding" status when upgrading? for vr2312. 06-05-2020 12:49 AM
- Karma Re: How to calculate time difference in statistics using another field for woodcock. 06-05-2020 12:49 AM
- Got Karma for Re: Best Way to Implement Logic in Dashboard Timeframe?. 06-05-2020 12:49 AM
- Got Karma for Re: Adjusting earliest/latest for both main search and sub-search. 06-05-2020 12:49 AM
- Got Karma for Re: summing two event counts by source. 06-05-2020 12:49 AM
- Got Karma for Re: How to replace/remove a specific character?. 06-05-2020 12:49 AM
- Got Karma for Re: How to replace/remove a specific character?. 06-05-2020 12:49 AM
- Got Karma for Re: How to calculate time difference in statistics using another field. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 2 | |||
| 2 | |||
| 1 | |||
| 1 | |||
| 2 |
11-11-2015
06:22 AM
3 Karma
Don't know if you can do it with a regex, but what you can do is capture everything from the first "Step=" to the next field value, and then use makemv with delim=" , Step="
Regex would look like this:
... | rex "Step=(?P<steps>.+) ,<following field>"
or if there are no fields after the "step" fields:
... | rex "Step=(?P<steps>.+) , $"
Then use makemv to convert the single string into a list of values:
... | makemv delim=" , Step=" steps
This should result in something like this:
Field1 Field2 steps
A B 11001 11018 12302 ... 15016
Hope this helps
... View more
11-11-2015
05:55 AM
2 Karma
Use the rename function, to rename your fields with spaces to fields without spaces:
... | rename "Total Replies" AS TotalReplies, "Rating Score" AS RatingScore
Then apply your eval (may I suggest you don't use a space in the name of your field in the eval?):
... | eval RatingCalculation = TotalReplies * RatingScore
Once all this is done, you can then rename them back to having the space between words. But I would leave this rename to the very last step in your search, to avoid further issues with fields with spaces:
... | rename Rating* AS "Rating *", TotalReplies AS "Total Replies"
Your full search would look like this:
<your base search> | rename "Total Replies" AS TotalReplies, "Rating Score" AS RatingScore | eval RatingCalculation = TotalReplies * RatingScore | rename Rating* AS "Rating *", TotalReplies AS "Total Replies"
Hope this helps
... View more
11-02-2015
08:19 AM
1 Karma
You could use filldown command. You'd have to sort by host first. The end result would look something like:
... | sort host | filldown country
... View more
11-02-2015
07:26 AM
Do you mean that a single Splunk event can contain multiple lines from which you want to capture said field?
So for example the three samples you have provided above are a single event?
... View more
11-02-2015
07:15 AM
I had a typo. I have edited my comment to remove it.
I had a second close parenthesis.
... View more
11-02-2015
07:02 AM
Try this:
| rex "\s(?<myField>[^\s_]+_[^\s_]+)_"
Based off of @woodcock 's answer
@Abilan1 I had a typo, I have removed the second close parenthesis from my answer
... View more
11-02-2015
06:25 AM
1 Karma
@Abilan1 what @woodcock here has said will work - if you add a close parenthesis after the dollar sign. It will capture everything between the last whitespace and the end as "myField". You can then use substring or further rex to extract just the first parts of that field.
... View more
11-02-2015
06:24 AM
There are exactly 4 whitespaces between the "STD" and the value you want in every one of your samples. That seems pretty consistent.
Also can you clarify what you want to capture? Is it:
R5609811_A0000003_5871713
or
R5609811_A0000003_
or
R5609811_A0000003
... View more
11-02-2015
06:13 AM
Can you provide more samples then?
... View more
11-02-2015
05:53 AM
Are the number of whitespaces between the "STD" and the value you want consistent?
If yes, then this should do the trick:
... | rex "STD\s([^\s]+\s){3}(?P<your_field>([^_]+_){2}))"
It will store this R5609812_S0000001_ as the value of your_field . If you don't want the second underscore in your value, you can do the following:
... | eval your_field = substr(your_field,1,len(your_field)-1)
Hope this helps.
... View more
11-02-2015
05:40 AM
This should do what you need:
... | streamstats sum(column1) AS cum_total | eval cum_total = cum_total - column1| eval column2 = column1 - cum_total | fields - cum_total
Explanation:
streamstats sum(column1) AS cum_total = will calculate the cumulative total including the value of column1
eval cum_total = cum_total - column1 = removes the value of column1 from the cum_total
eval column2 = column1 - cum_total = calculates the value of column2 for you
fields - cum_total = removes the cum_total column from your results
Hope this helps
--- EDIT ---
Just had another thought. You might be able to solve this with the delta command. Go here for details.
... View more
10-30-2015
08:41 AM
You can do this with props.conf and transforms.conf.
Your transforms would look something like this:
[force_sourcetype_x]
#regex that matches events that you want to label as sourcetype x
REGEX = sourcetype_x
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::x
Hope this helps
... View more
10-30-2015
05:59 AM
1 Karma
Use streamstats command:
<your_search> | streamstats count AS tripNo by vehID
Hope this helps
... View more
10-28-2015
08:38 AM
As long as the field is a number this should work:
... | eval CustNo = if(CustNo<10, "0" . CustNo,CustNo)
If it isn't a number then you can do the following:
... | eval CustNo = if(tonumber(CustNo)<10, "0" . CustNo,CustNo)
Hope this helps
... View more
10-28-2015
08:19 AM
Please provide a sample of what your events look like (with the fields of interest highlighted), and what you'd like to see
... View more
10-28-2015
08:18 AM
Make sure you have configured the email settings on the Search Head running the search: Settings > Sever Settings > Email Settings
Hope this helps
... View more
10-28-2015
08:16 AM
1 Karma
I don't think so. But you should look into masking data.
You'll have to define regex, to detect what you are looking for, and provide what you want to replace it with.
Hope this helps.
... View more
10-19-2015
05:50 AM
The indexer needs direct access to the location where you are going to store the data. So if you are in a Linux environment, you'd have to mount the drive from the "DB Servers" on your Splunk indexer server(s). Then make sure you define in indexes.conf the correct paths using the mounts.
Hope this helps
... View more
08-28-2015
06:10 AM
1 Karma
You seem to have a number of extra colons (:) in your regex that you don't need.
Try the following. Use field=_raw unless there is a field that contains everything from "Account:" to "Source Workstation".
eventtype=abcd | rex field=_raw "Account: (?P<account>[^\s]+) Source Workstation"
That should extract everything that isn't a whitespace (\s) between "Account: " and " Source" into a field called "account".
Hope this helps
... View more
06-15-2015
11:58 PM
2 Karma
You want to place the where clause after your stats count. Like so:
eventtype="email_fetching" Fetching | stats count | where count>80
Hope this helps
... View more
We had to do this with an old standalone instance when we purchased hardware for a clustered environment. Here's what you need to do:
Check # of events in the index on a clustered indexer. Example: search index=juniper returns 619 events
Check # of events in the index on a standalone (old) indexer. Example: search index=188961 returns 2798 events
Copy / zip buckets from 188961 index on standalone indexer to some temporary repository on clustered indexer
Put cluster master in maintenance mode
Stop Splunk on clustered indexer
Copy / unzip buckets from 188961 index into the colddb directory of the juniper index on the clustered indexer
Start Splunk on clustered indexer
Take cluster master out of maintenance mode
Confirm search returns sum of both results. Example: search index=juniper on cluster master (returns 3417 events)
Hope this helps
... View more
06-03-2015
10:45 AM
Just like @acharlieh said, just upload it to your license master as if the reset key was a regular license you were uploading.
... View more
06-03-2015
07:27 AM
This should do it:
<base search> | eval SLA = if(secs < 51, 1, 0) | stats count as TOTAL, sum(SLA) as SLA | eval percentage_success = (SLA / TOTAL) * 100
Here's the breakdown:
eval SLA = if(secs < 51, 1, 0) => This will provide an SLA field with a 1 if it's within SLA, and 0 if it's outside SLA
stats count as TOTAL, sum(SLA) as SLA => This will provide the total count of events, by simply counting them, at the same time as "counting" the number of events within SLA. It will also consolidate the data into a single row
eval percentage_success = (SLA / TOTAL) * 100 => This will provide the percentage that you were looking for.
If you are interested in only displaying the percentage value, then you can add | fields percentage_success to the end of the search I gave you.
Hope this helps
... View more
06-03-2015
07:02 AM
5 Karma
Add this below your other "set" tag:
<set token="form.exe_stats">$click.value$</set>
This will set the "exe_stats" form token for you.
Hope this helps.
... View more
06-03-2015
06:18 AM
1 Karma
Definitely NOT data loss from bouncing Splunk.
If you have 5 license warnings in the past 30 days what Splunk does is it locks your searching capabilities. It won't allow any of your searches / dashboards to get data, but it will continue to index data so that when you resolve the problem, all the data that was sent during the license violation period, will be available.
If you have increased the license (which it seems like you have), you need to ask your sale rep to send you a reset key to clean out the license violation warnings. Once that's done your search capabilities will become available again.
Hope this helps
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-15-2024
03:25 PM
|
Karma given to
