Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Mike6960
Mike6960
Path Finder
Member since:
10-10-2017
03-21-2023
Community Statistics
| Posts | 192 |
| Solutions | 0 |
| Karma Given | 12 |
| Karma Received | 2 |
| Member Since | 10-10-2017 |
Activity Feed
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 11:39 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 10:33 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:53 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:32 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:31 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:31 AM
- Posted How to use values from outputlookup file? on Splunk Search. 03-20-2023 04:02 PM
- Karma Re: How to create alternative for subsearch for gcusello. 12-14-2022 06:23 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 06:56 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 05:39 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 04:40 AM
- Posted How to create alternative for subsearch? on Splunk Search. 12-13-2022 03:28 AM
- Karma Re: How to make a field extraction with field with and without ':'? for ITWhisperer. 12-07-2022 05:18 AM
- Posted Re: How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 07:01 AM
- Posted Re: How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 06:51 AM
- Posted How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 04:51 AM
- Posted Is it possible to achieve a column chart with timechart showing days in every column? on Dashboards & Visualizations. 11-10-2022 02:51 AM
- Posted Re: How to create a single value withe panel_depends? on Dashboards & Visualizations. 11-06-2022 06:38 AM
- Posted Re: How to create a single value withe panel_depends? on Dashboards & Visualizations. 11-04-2022 11:22 AM
- Posted How to create a single value with panel_depends? on Dashboards & Visualizations. 11-04-2022 09:24 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-05-2019
07:08 AM
tried your suggestions but it does not work
... View more
06-05-2019
07:08 AM
I have the same in my xml en tried your suggestions but it does not work
... View more
06-05-2019
07:07 AM
No, that doesn't work either
... View more
06-05-2019
05:06 AM
I am using | fillnull totalCount in my search so I get an 0 when there is no result.
The color range I use is from min to 0 is green, from 0 to max is red.
Somehow the '0' is still showing red. Is there any way to change this?
... View more
05-16-2019
12:06 PM
I tried stats list instead but it does not seem to get the results I want
... View more
05-16-2019
12:01 PM
the 'table list 'command does not seem to work when I use it as you describe
... View more
05-16-2019
11:30 AM
Thanks, but with the stats command I got one line per ID and the 'loggers' in columns next to it. With eventstats I get per logger one line. what I need is for every single ID just one line with the other fields in columns next to it
... View more
05-16-2019
11:20 AM
ok, I wonder why I should stats or eventstats at all...... I could just use the search= instead, every tme when I think I understand Splunk I get confused
... View more
05-16-2019
11:08 AM
but if I use eventstats i get all the events back. So also the ones that don't match the conditions in the evals. I only want the event that (for example) where logger= "test1"
... View more
05-16-2019
11:07 AM
but if I use eventstats i get all the events back. So also the ones that don't match the conditions in the evals. I only want the event that (for example) where logger= "test1"
... View more
05-16-2019
04:13 AM
In my search i use a couple of stats counts, the problem is that after these commands I miss other that I want to use. For example _time. I dont need a count for these fields so how can I make sure they are stille available later on in the search?
My search is for example:
index=*
"message.Origin"=blabla
source="something "
| stats count(eval('logger' ="test1")) as "example",
count(eval(logger ="test2)) as "example2" by ID
After the stats I only have the fields, example, example2 and ID
... View more
- Tags:
- splunk-enterprise
03-28-2019
11:48 PM
Thanks, but I dont see how my searches are related to your example. Looks like a totally different search
... View more
03-28-2019
12:02 PM
Hmmm, I get no results found. So somewhere I am doing something wrong
... View more
03-28-2019
09:16 AM
I have two searches that work fine, but I want to show them in one dashboard. I have these two
1-....search....:
|stats count values(Message.DocumentId) as "Doumentid" by cbatchid
2-....search....
| stats count(eval('message.information'="Sent to ESB")) as Sent,count(eval('message.information'!="Sent to ESB")) as NOTSENT by message.x-cak-messageid | eval Status=if(Sent=1,"OK","NOK")
Index, source etc. are the same, the searches only contain which index en source to search in. How can I combine the two ?
... View more
03-26-2019
08:37 AM
I have events which contain batches. There are several batchtypes. For example Batch; A01,A02,A03.
When a batch is started it is stored for example like this: A01-sample-2019-03-20-mm. I want to count the number of batches per batchtype per moment (2019-03-20)
Now I have this: ....search...... | stats distinct_count(batch) as count by batch| table batch count
... View more
- Tags:
- splunk-enterprise
06-19-2018
01:30 AM
@MuS, thanks for your response. Not really what I am looking for I think. Or maybe I don't understand the answer, I guess I have to look for something like makeresults or something
... View more
06-19-2018
12:17 AM
For one of my dashboards I am working with .csv files which are generated every day. these contain certain failures from different processes. When those are solved they will not appear the next day. So, if there are no failures at any one day the file will be empty. Splunk cannot index files which contain only headers.
I want to show a single value withe trendline to show the increase/decrease of failures. I f the file is empty the search shows the number of the last day where there were failures. How can i solve this?
... View more
- Tags:
- splunk-enterprise
06-13-2018
01:47 AM
sadly, still the same error. Don't see a difference between the codes by the way
... View more
06-12-2018
01:59 AM
Hai @Sukisen1981 , if I use the second one I get the message 'Error in 'rex' command: Encountered the following error while compiling the regex 'hard_bounced="+(?.?)"+': Regex: unrecognized character after (? or (?- '
... View more
06-04-2018
08:21 AM
No, I need to extract the values for hard_bounced en for hostname
... View more
06-04-2018
05:02 AM
Ok, I understand what you, but when I use the regex from the editor then I get the message 'unbalanced quotes'
Here is the rex:
^<\?\w+\s+\w+="\d+.\d+"\s+\w+="\w+-\d+"\s+\w+="\w+"\?>\s+<\w+\s+\w+\w+="\w+\w+"\s+\w+="\w+\s+\d+.\d+.\d+-\d+"\s+\w+="\w+.\w+.\w+"\s+\w+="\d+">\s+<\w+\w+\s+\w+\w+="\d+"\s+\w+\w+="\d+"\s+\w+\w+="\d+"\s+\w+_\w+="\d+"\s+\w+="(?P[^*]+)
... View more
06-04-2018
04:26 AM
append max_match=0 ?. Where? In the fieldextraction editor?
... View more
06-04-2018
03:42 AM
My events contain teh same fieldnames multiple times with different values.
I.E.
< active_recip="9" deliv_recip="0" hard_bounced="4" hostname="clnpniv.local *" soft_bounced="0"/>
< active_recip="3" deliv_recip="0" hard_bounced="1" hostname="clnpdmz.local *" soft_bounced="0"/>
I tried a field extraction but then only one value is recognized as a field. How can I solve this? I searched online voor MV etc. but I am a bit stuck
... View more
- Tags:
- splunk-enterprise
04-19-2018
01:25 AM
@niketnilay thank you for your extensive answer and explanation. I am afraid its a bit to complex for me but again thanks anyway
... View more
04-19-2018
01:24 AM
@somesoni2 thanks for your answer. In this case I will try and use the way damien_chillet suggests but the look-up option is surely something i will try/use in the future
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-21-2023
02:13 PM
|
