Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ziegfried
ziegfried
Influencer
Member since:
11-17-2009
01-26-2022
Community Statistics
| Posts | 668 |
| Solutions | 234 |
| Karma Given | 406 |
| Karma Received | 930 |
| Member Since | 11-17-2009 |
Activity Feed
- Got Karma for Re: What's the difference between where and search in the pipeline?. 01-13-2026 11:36 PM
- Got Karma for Re: Database lookup not returning all matches. 04-21-2025 03:30 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-09-2024 12:24 PM
- Got Karma for Re: Add reports to dashboards. 12-07-2023 11:17 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-18-2023 02:05 AM
- Got Karma for Re: How do you add dummy events to a search result?. 11-06-2022 11:06 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 09-19-2022 02:38 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 05-12-2022 04:02 PM
- Got Karma for Re: IIS FTP LOG TIMEZONE PROBLEM. 04-28-2022 04:28 AM
- Got Karma for Re: How do I list all active input stanzas in all apps?. 03-27-2022 08:43 PM
- Got Karma for Re: How do you add dummy events to a search result?. 01-11-2022 01:42 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 11-11-2021 02:06 AM
- Got Karma for Re: How to format _time field in results email?. 10-19-2021 11:43 AM
- Got Karma for Re: How do I determine my indexing volume by host, source, or sourcetype?. 06-07-2021 08:24 AM
- Got Karma for Re: convert bytes to megabytes in report. 05-19-2021 08:15 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 04-30-2021 10:07 AM
- Got Karma for Re: Terminate User Session. 03-16-2021 08:22 AM
- Got Karma for Re: Splunk DB Connect - dbquery inline search and time filtering not working. 03-02-2021 02:20 PM
- Got Karma for Re: how to find the earliest and latest event in an index?. 12-09-2020 09:22 AM
- Got Karma for Re: Multiple Values per Event - transforms.conf regex. 11-24-2020 06:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 5 |
06-17-2012
09:08 AM
Could be a simple syntax error. Let me know when you know which errors show up.
... View more
06-17-2012
08:47 AM
Are getting any script errors in IE or how can you tell there are restrictions? Jquery runs fine in IE...
... View more
You can query for specific attributes of the jobs. Eg.
Search for Jobs of a saved search "My Search"
/services/search/jobs?search=label%3DMy%20Search
or with a name starting with "My Search"
/services/search/jobs?search=label%3DMy%20Search*
Note that the value of the search parameter needs to be URL-encoded.
label=My Search* ==> label%3DMy%20Search*
... View more
06-15-2012
01:58 PM
11 Karma
The where command allows you to evaluate more complex/structured expressions and is probably a little less efficient. Here's a list of functions you can use with eval and where :
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
In you particular example the ... | where hostname=abc compares the value of the hostname field to the value of the abc field. As opposed to ... | search hostname=abc that compares the hostname field value with the string "abc" similar to ... | where hostname="abc" (with the difference of where being case-sensitive).
You should always try to reduce as much as you can in the first (implicit) search command in terms of efficiency.
ie.
sourcetype=syslog hostname=abc
instead of
sourcetype=syslog | search hostname=abc
... View more
06-13-2012
05:55 AM
I guess the separating comma is missing:
eval new_field=if(field1!="NULL","field1--".value1."field2--".value2, field2)
... View more
06-13-2012
05:50 AM
3 Karma
By doing stats count as Total you're removing all fields from the results stream, so there will be no duration fields you could use in the subpipeline. Probably more reasonable search:
sourcetype="X" (some logic) | transaction keepevicted=true uniqueID | where duration>0 | eval passed=if(duration/60 < 30, "Yes","No") | stats count(eval(passed="Yes")) as Passed count as Total
or simpler
sourcetype="X" (some logic) | transaction keepevicted=true uniqueID | where duration>0 | stats count(eval(duration/60 < 30)) as Passed count as Total
... View more
06-13-2012
05:44 AM
I've slightly changed the search to do the "round" after the aggregation. This is better because it reduces the rounding error.
... View more
06-13-2012
05:40 AM
1 Karma
The question kind-of indicates the 10 greatest values.
... View more
06-13-2012
05:38 AM
But that's probably the most reasonable result for the question.
... View more
06-13-2012
05:34 AM
2 Karma
This is actually incorrect. The top command will deliver the most common values, not the greatest ones.
... View more
06-10-2012
12:42 PM
Yes, the template engine extracts the content of the body tag. The $-function is jQuery. You can use it because it's included by Splunk by default. Here's a link to the relevant API docs: http://api.jquery.com/jQuery/#jQuery3
... View more
06-10-2012
12:19 PM
3 Karma
When using the ServerSideInclude module you should prepare the file to only contain the fragment that should be placed in the dashboard panel. Additionally when including assets (like JS files) should rather use a server-relative url. Here's a little example that should work:
testMap1.html:
<div id="map_canvas" style="width: 1200px; height: 700px;">map div</div>
<script type="text/javascript" src="https://maps.googleapis.com/maps/api/js?sensor=false"></script>
<script type="text/javascript" src="/static/app/myapp/locations.js"></script>
<script type="text/javascript" src="/static/app/myapp/maps.js"></script>
<script type="text/javascript">
$(initialize); // will call intialize on DOM-ready, like <body onload="...">
</script>
(You'd have to replace the app-name (myapp) in the script source URL)
Additionally the IframeInclude module might also suit your needs.
... View more
06-07-2012
06:31 AM
I've added an example on how you could use the eval command to create conditions for a search query.
... View more
06-07-2012
06:26 AM
The where command doesn't "return" anything. It will simply remove those results where the expression evaluates to false. You can use the eval command to create new fields.
... View more
06-07-2012
03:49 AM
1 Karma
As far as I've understood your intention, you could probably do it this way:
... | where if("$click.value$" == "Totals", true(), $click.name$ == "$click.value$")
Edit:
Here's how you could use the eval command to create conditions for a search:
<some search conditions> [ | stats count | eval search=if("$click.value$" == "Totals", "*", "$click.name$=\"$click.value$\"") | fields search ]
The subsearch (within the square brackets) will expand to an additional search condition for the outer search. (The stats count part is just used to great a single result, thats rather hack/workaround)
... View more
06-06-2012
06:31 AM
7 Karma
You can simply use the StaticContentSample and insert a HTML fragment that includes a link to another dashboard:
<module name="StaticContentSample">
<param name="text"><![CDATA[
<a href="myotherdashboard">Link to my other dashboard</a>
]]></param>
</module>
You can use relative links (like in the example above) to link to a view within the same app, or server-relative (eg. <a href="/app/search/myotherdashboard">...</a> ), which allows to link to views in other apps as well.
... View more
06-04-2012
07:40 AM
1 Karma
No, as stated, the app only supports Splunk 4.2.
... View more
06-04-2012
03:17 AM
Nope. If today's value is within 80-120% of yesterday's value, then output range=low (ie. green).
... View more
06-03-2012
02:32 AM
No, rangemap only accepts literal numbers, not fields for the domain values. You can use the eval command, though:
<your query> | eval range=if( Today < Yesterday*1.2 AND Today > Yesterday*0.8 ,"low", "severe")
... View more
05-24-2012
02:25 AM
You could use multivalue fields:
... | stats values(userid) as userids | eval userids=mvjoin(userids,",")
... View more
05-23-2012
06:36 AM
This is because the mac_addr and ip field contain multiple values (ie. they are multivalue field). You can circumvent this by joining the multivalue fields in your search:
... | eval mac_addr=mvjoin(mac_addr,", ") | eval ip=mvjoin(ip, ", ")
See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
... View more
05-23-2012
06:30 AM
2 Karma
You can disable the syslog-host transform for the syslog sourcetype by adding the following stanza to your $SPLUNK_HOME/etc/system/local/props.conf
[syslog]
TRANSFORMS =
... View more
05-22-2012
01:03 PM
1 Karma
You probably need to run this is the cmd.exe instance with administrative privileges. You should be able to do this using Right-click -> Run as Administrator from the start menu.
Or get a more decent OS 😉
... View more
05-22-2012
01:00 PM
Both should work. Be sure to restart splunkweb and clear the browser cache.
... View more
