Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About subtrakt
subtrakt
Contributor
Member since:
09-02-2012
06-05-2020
Community Statistics
| Posts | 136 |
| Solutions | 1 |
| Karma Given | 14 |
| Karma Received | 24 |
| Member Since | 09-02-2012 |
Activity Feed
- Got Karma for eval isnull. 11-02-2020 01:51 AM
- Got Karma for Sideview Utils: Is there a way to add an 'arg.earliest' param to the HTML module for a drilldown timerange token?. 06-05-2020 12:48 AM
- Got Karma for default search * being dispatched unintentionally. 06-05-2020 12:48 AM
- Karma Re: How to create a module that has a "+" symbol to expand and display inputlookup results under a chart panel? for sideview. 06-05-2020 12:47 AM
- Karma Re: How to write a search that automatically compares volume for this year against the same day of the week last year? for musskopf. 06-05-2020 12:47 AM
- Karma Re: Are there plans to get autorefresh and hidden post process nested in a hidden saved search module? for sideview. 06-05-2020 12:47 AM
- Karma Re: Query help with search using sum(count) and 2 subsearches using count for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to convert epoch to local time? for ramdaspr. 06-05-2020 12:47 AM
- Karma Re: Rex Question for woodcock. 06-05-2020 12:47 AM
- Karma Re: If summary searches run every 5 minutes, can a non-summary search be merged with the summary to fill-in the most recent 5 minutes? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Make one column in table module have hyperlinks but leave the rest non-link for sideview. 06-05-2020 12:47 AM
- Karma Re: Sideview Utils: How to redirect, but not dispatch a search? for sideview. 06-05-2020 12:47 AM
- Got Karma for How to write a search that automatically compares volume for this year against the same day of the week last year?. 06-05-2020 12:47 AM
- Got Karma for Sideview Utils: How to redirect, but not dispatch a search?. 06-05-2020 12:47 AM
- Got Karma for Sideview Utils: How to redirect, but not dispatch a search?. 06-05-2020 12:47 AM
- Got Karma for Re: When redirecting from a drilldown, why is testfield in redirect not correct on tables with multiple rows?. 06-05-2020 12:47 AM
- Got Karma for Query help with search using sum(count) and 2 subsearches using count. 06-05-2020 12:47 AM
- Got Karma for Are there plans to get autorefresh and hidden post process nested in a hidden saved search module?. 06-05-2020 12:47 AM
- Got Karma for How to write a search that automatically compares volume for this year against the same day of the week last year?. 06-05-2020 12:47 AM
- Got Karma for autorefreshmodule and hiddensavedsearches. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
12-16-2014
10:35 AM
<module name="Paginator">
<param name="count">10</param>
<param name="entityName">results</param>
<module name="SimpleResultsTable">
<param name="entityName">results</param>
<param name="drilldown">row</param>
... View more
12-15-2014
04:59 PM
Hi,
This below config is not redirecting with the correct field if more than one row exists on the table. I have a feeling I'm missing something simple.
<param name="fields">testfield</param>
<module name="Redirector">
<param name="url">flashtimeline</param>
<param name="popup">True</param>
<param name="arg.earliest">-8h</param>
<param name="arg.latest">$search.timeRange.latest$</param>
<param name="arg.q">index=testindex "$click.value2$" testfield="$testfield$</param>
</module>
</module>
</module>
</module>
</module>
... View more
12-02-2014
08:59 PM
index=hostcheck "host timed out" | appendpipe [| stats count | eval temp=1 | append [search index=hostcheck "host timed out"| rex max_match=1 "(?i)(?<testIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"| lookup dnslookup clientip AS testIP]| eventstats values(count) as count | where count<50 AND temp!=1]
... View more
12-02-2014
08:57 PM
I have tried this but it doesn't seem to resolve the IPs or show the testIP field when the count is < 50. I have tested the base search and it does work. I will play around with it some more tomorrow.
index=hostcheck "host timed out" | appendpipe [| stats count | eval temp=1 | append [search index=hostcheck "host timed out"| rex max_match=1 "(?i)(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| lookup dnslookup clientip AS testIP]| eventstats values(count) as count | where count<50 AND temp!=1]
... View more
12-02-2014
02:26 PM
So if it is < 50 events, the rex + lookup should run. if > 50 the rex+lookup shouldn't run...
... View more
12-02-2014
12:45 PM
Hello -
Any suggestions on how to append a subsearch where count < 50?
...|stats count | where count < 50 | append [search | rex max_match=1 "(?i)(?<testIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | lookup dnslookup clientip AS testIP]
... View more
12-01-2014
04:29 PM
This seems to work! I like it!!
Any suggestions on working dynamics into a timechart that compares today vs last year (on the same day of the week)?
Here's my attempt
[| gentimes start=-1 | eval earliest=relative_time(now(),"-1y@w")+relative_time(now(),"@d")-relative_time(now(),"@w")
| eval latest=relative_time(earliest,"+1d") | table earliest, latest| format "" "" "" "" "" ""] | fields _time count | eval _time=_time+(364*24*60*60) | timechart count
... View more
12-01-2014
01:43 PM
2 Karma
Greetings!
Trying to build a search that automatically compares volume for this year against the same day of the week last year - however, I am having trouble figuring out how to get the same day of the week a year ago...
earliest=1y@(monday last year) latest=1y@(monday last year)
... View more
11-24-2014
09:58 AM
in the lookup column, would there be any restriction on how i have the query formatted?
Currently, the queries would look like this in the testcolumn
index="testindex" app="testapp" "search content"
... View more
11-15-2014
01:42 PM
Is there a way i can have a search look at a lookup that has predefined search queries in each row and then run a search across those search queries?
Here's the Lookup:
testLOOKUP
testcolumn
index=test1 test search content1
index=test1 test search content2
index=test1 test search content3
Here's the search:
search [|inputlookup testLOOKUP | table testcolumn] | stats count by host
Would this roll through content1, content2, content3 and then provide results?
... View more
11-14-2014
05:17 AM
Sure,
2014-11-14 12:52:59:[ INFO]:- batman.java1 length of 25 error :0:
For above scrape 45, 25 and 1 from the field result and have it look like this
"batman.java length of error"
... View more
11-13-2014
04:39 PM
The query needs to be a catch all for multiple log types like Cisco juniper and Unix
... View more
11-13-2014
02:19 PM
Hi
rex "(?i)\].*(?<test1>([^ ]* ){5})"
I want to avoid numbers being returned but i don't want to avoid the results with numbers in them.
I'm thinking i need to put this in the regex somewhere but haven't had any luck so far.
\D+ or [^0-9]
... View more
11-12-2014
06:17 PM
HI,
Working on a query that if one field is null then it uses another field and if that field isnull it uses another. Will case work like that in a linear operation left-to-right or is there a better option?
eval main=case(isnull(test1),test2,test1,isnull(test2),test3,test2,isnull(test3),test4,test3,1=1,"All Test Are Null)
... View more
10-31-2014
02:02 PM
index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL] | timechart count by URL
... View more
10-31-2014
01:47 PM
Thanks I'll give this a shot!
... View more
10-31-2014
01:46 PM
Thanks! Will this work with timechart on the main search?
... View more
10-31-2014
01:29 PM
Did u get a 404 error after letting the dashboard sit idle for a long period of time then attempt to change a tab? Besides that it is working great!
... View more
10-27-2014
11:37 AM
It's working and very quick now. I'm actually using hiddensavedsearch as the main search which seems to help on the initial load. One minor problem is the first tab post process has to be set to usehistory false or auto. Shouldn't it be able to find scheduled search? The other tabs set to true are working.
... View more
10-22-2014
11:53 AM
Summary searches occur every 5 mins but for those who need more immediate results can a non-summary search be merged with the summary to fill-in the most recent 5 mins? Would this make a difference in efficiency for a scheduled search that searches an hour back?
index=weblog_summary latest=-5m@m HTTP_RESPONSE="40*" URL="" | append [|search index="weblog" earliest=-5m@m HTTP_RESPONSE="40" URL="*"]
... View more
10-20-2014
05:02 PM
I am so thankful you did this. I was playing with append=t idea in my head the other day.
I will play around with this as soon as I get a chance!
... View more
10-20-2014
07:59 AM
Hi,
Any recommendations on how I should build out drill-down to a timechart sourced/linked from one column in a table?
The table column in the is testcolumn4.
The drilldown would be sourced from testfield10 in the hiddensavedsearch.
Drilldown To : index=index1 "testfield10" | timechart count by testfield10
Destination: http://testbox:8000/en-US/app/test1/search
True
test1
results
3
results
100
... View more
