About zacksoft

zacksoft · ‎05-22-2019

Thanks @Sukisen1981 for your time. The solution helps.

zacksoft · ‎05-07-2019

I haven't created any role for them yet. I am still deciding what roles or capabilities will allow them to see the dashboard output but not able to make any query .

zacksoft · ‎05-07-2019

Sure @Sukisen1981 . If you get time. Following is the link of the new question. https://answers.splunk.com/answers/744080/winsorized-average-calculation.html?minQuestionBodyLength=80

kamlesh_vaghela · ‎04-30-2019

@zacksoft Great!! Can you please upvote and accept the answer to close this question?

zacksoft · ‎04-30-2019

I have put some sample data here along with more description https://answers.splunk.com/answers/742026/creating-buckets-based-a-percentage-of-occurrence.html?minQuestionBodyLength=80

woodcock · ‎04-21-2019

No, it is not possible. Your only options are a specific user (which could be a shared service account) or no-user (e.g. nobody ).

ashajambagi · ‎02-19-2019

You can use chart command : (your search)|chart values(fgcd1) over _time

DMohn · ‎02-13-2019

That's what the community is here for! Have a good day as well.

zacksoft · ‎02-06-2019

Thanks for explaining each step. Now I understand.

kamlesh_vaghela · ‎01-21-2019

@zacksoft I have updated my Answer. Can you please check it?

zacksoft · ‎01-04-2019

Thank you @whrg. This helped.

richgalloway · ‎01-04-2019

Try replacing the where and table commands with timechart span=30m dc(user) .

sdchakraborty · ‎01-03-2019

Cool. Then I will change this as answer. Please accept it. Sid

zacksoft · ‎01-03-2019

Thank you. I am going step by step eradicating small bugs in the data and tuning the commands accordingly. Now I am stuck here. What does the following statement mean ? And how do we implement it? | rename COMMENT as "copy forward the most recent logon to each record, then throw away the logon records."

zacksoft · ‎12-24-2018

Thank you. The transaction command does the job, but I see anomaly. sometimes maxevents = 6 shows the lines but mazevents = 9 doesn't. It's strange..

whrg · ‎12-13-2018

Hello @zacksoft, Try this: BRU Weak Reference,[^,]+,\s+(?<bru_weak_reference>[^\s]+) You can verify here: regex101.com

zacksoft · ‎12-13-2018

@richgalloway ♦ Thank you. This helps.

skoelpin · ‎12-11-2018

Accept the answer if it helped you...

493669 · ‎11-26-2018

try this: |rex "Deploy\sto\s'(?<string2>[^:]+)"

493669 · ‎10-24-2018

field is extracted in fieldname a you can change as per your need to show it in table

jlelli · ‎10-16-2018

host="SERVER_Number_*" "Game Starting..." | timechart span=1d count by host Timechart already groups by _time so there is no need to add it

harsmarvania57 · ‎10-10-2018

Hi @zacksoft, You can metadata for command for this query. MOre information on metadata http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Metadata For example below query will give you all sourcetypes which didn't sent data since last 15 minutes | metadata type=sourcetypes | eval recent_Time=strftime(recentTime, "%d/%m/%Y %H:%M:%S") | eval lag=now() - recentTime | where lag > 900

mstjohn_splunk · ‎10-09-2018

hi @zacksoft Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

harsmarvania57 · ‎09-18-2018

Hi @zacksoft, Please try below query. <yourBaseQuery> | rex mode=sed field=<fieldname> "s/([^\+])(?:\++)/\1 /g" Here is run anywhere search which is generating correct ouput | makeresults | eval testfield="PVOLFEPCL-00515+Berger+Profile+Settings.docx" | append [ makeresults | eval testfield="Intake3++B2N+Lan+07492018.xlsm" ] | rex mode=sed field=testfield "s/([^\+])(?:\++)/\1 /g"

zacksoft · ‎09-10-2018

@mayurr98 You Sir, are a genius ! Accepting your Answer.

Posts	336
Solutions	0
Karma Given	47
Karma Received	5
Member Since	‎09-13-2017

Online Status	Offline
Date Last Visited	‎06-11-2021 07:35 AM

Where is the Location of knoweldge objects in the ...

Subsearch append question !!

How to I save my search query output as a lookup ?

How do I get search start time and end time value ...

How to transpose a table? (without using Transpose...

What is the permissible field value length ?

How to match for a condition for main menu ?

How to refer to a column value ?

How to create an overview/menu dashboard?

How to open an extracted URI field through drilldo...

Re: Winsorized Average Calculation

Re: Restrict Search Terms

Re: Trimmed Average Calculation

Re: Creating buckets based a percentage of occurre...

Re: How to get percentage in stats instead of coun...

Re: How to change ownership of a KO from a person ...

Re: Can you help me plot some data on a chart's X ...

Re: parameterize search from various source types ...

Re: With regex, can you help us extract the first ...

Re: How do you insert a time range inside a query?

Re: Need Help with Timechart

Re: Streamstats help

Re: Can you help me with my regex pattern match?

Re: Can you help me with event time subtraction?

Re: Can you help me with a query using the streams...

Re: Can you help me create a regex to extract a va...

Re: How do I fetch a word along with the next five...

Re: Can you help me find the user count over a cer...

Re: WIll you help me with my string extraction?

Re: Can you help me with the following regex expr...

Re: How do you use the timechart command to see a ...

Re: How do I find when was the last time a particu...

Re: How do I get top 10 values of output based on ...

Re: How to replace a character with blank/space va...

Re: How do you find the number of users logged in ...

Are you a member of the Splunk Community?