About IRHM73

IRHM73 · ‎08-27-2015

Hi @Iguinn, thank you once more for taking the time to reply to my post and for the guidance. Many thanks and kind regards Chris

IRHM73 · ‎08-27-2015

Hi @Iguinn, thank you for coming back to me with this and for the link. Many thanks and kind regards Chris

IRHM73 · ‎08-27-2015

Hi Tom, I'm sorry to trouble you but I wonder whether you could help me please. You kindly provided me with the reason why there was a disparity between my two queries, and certainly the inclusion of the 'sort' solved the problem. But I inherited this query initially, so I'm a little unsure what the 'sort 0 detail.input-utr,-_time' actually does. Many thanks and kind regards Chris

IRHM73 · ‎08-27-2015

Hi @chanmi2, thank you once more for helping me out with this. It is greatly appreciated and works fine. Kind regards Chris

IRHM73 · ‎08-27-2015

@chanmi2 Thank you very much for taking the time to reply to my post and for the guidance. Kind Regards Chris

IRHM73 · ‎08-27-2015

Hi, I wonder whether someone may be able to help me please. After reading the Splunk documentation I'm trying to put together a Join query with the following: index="main" auditSource=*auth* auditType=LoginEntitlements detail.EmpRef=* | rename detail.EmpRef AS REF |Join REF [Chris EI-GG] | stats count by REF Where [Chris EI-GG] is the name of the saved search which I want to join to the above. I've clearly done something wrong because I receive the error 'Unknown search command 'chris'. Could someone perhaps explain to me please where I've gone wrong. Many thanks and kind regards Chris

IRHM73 · ‎08-26-2015

Hi, I wonder whether someone could help me please. I've inherited a search with the line sort 0 detail.ref,-_time . From the Splunk documentation, I know that sort 1 -_time means 'return the more recent event', but could someone explain to me please what the zero means. My thought was that the line meant 'don't return the most recent event'. Could someone possibly confirm for me please whether this assumption is correct. Many thanks and kind regards Chris

IRHM73 · ‎08-26-2015

Hi, I wonder whether someone may be able to help please. I'm using the search below to return a given number of statistics. auditSource=preferences auditType=TxSucceeded detail.input-preference-digital=* | replace "true" with "Opted In", "false" with "Opted Out" in detail.input-preference-digital | sort 0 detail.input-utr,-_time |eval inOrOut='detail.input-preference-digital' | stats first(inOrOut) As inOrOut By detail.input-utr | chart count by inOrOut | eval pieSlice=inOrOut + " " + count |fields pieSlice, count The problem I have is that I want to 'Accelerate' the report, but I know, from advice I've been given on this forum, that I can't because of the 'sort' command. Could someone tell me please is there a way to use both the 'Sort' command and 'Accelerate' the report. Many thanks and kind regards Chris

IRHM73 · ‎08-26-2015

Hi Tom, that got it! what a difference a fresh pair of eyes make. Many thanks and kind regards Chris

IRHM73 · ‎08-26-2015

I wonder whether someone could help me please. I initially used the search below with my results for a given day shown as: Opt In = 1696 Out Out = 858 auditSource=preferences auditType=TxSucceeded detail.input-preference-digital=* | sort 0 detail.input-utr,-_time | dedup detail.input-utr | replace "true" with "Opted In" in detail.input-preference-digital | replace "false" with "Opted Out" in detail.input-preference-digital | eval inOrOut='detail.input-preference-digital' | chart count by inOrOut | eval pieSlice=inOrOut + " " + count | fields pieSlice, count I then removed the dedup and changed it to a stats dc as below, but the figures come out as: Opted In = 1695 Opted Out = 859 auditSource=preferences auditType=TxSucceeded detail.input-preference-digital=* | replace "true" with "Opted In", "false" with "Opted Out" in detail.input-preference-digital |eval inOrOut='detail.input-preference-digital' | stats dc(detail.input-utr) first(inOrOut) As inOrOut By detail.input-utr | chart count by inOrOut | eval pieSlice=inOrOut + " " + count |fields pieSlice, count As you can see the figures have changed, but I'm not sure why. I just wondered whether someone could look at this and let me know where I've gone wrong. Many thanks and kind regards Chris

IRHM73 · ‎08-25-2015

Hi thank you for coming back to me with this I really appreciate it. Your assumption is correct in that I'm trying to extract multiple empRef's from a single event, so I ran your script and it works perfectly. But when I tried to run this using my full script i.e. index="main" detail.responseMessage="*empRef*" | rex field=var "\"empRef\":\"(?<empRef>[^\"]*)\"" max_match=0 | stats count by empRef the list of empRef's are not shown. Many thanks for all your help and kind regards Chris

IRHM73 · ‎08-25-2015

Hi @Iguinn, thank you very much for taking the time to reply to my post and for the help. The query works great. May I just ask, is there a list anywhere of the 'Streaming Commands' which I could refer to? Many thanks and kind regards Chris

IRHM73 · ‎08-25-2015

Hi I'm not sure whether this is of help, but I've managed to get the 'Field Extractor' working and have come up with the following: (?=[^e]*(?:empRef|e.*empRef))^(?:[^\\\n]*\\){7}"(?P<REF>[^\\]+) The problem I have is that I'm not sure how to incorporate this into my search. I've tried rex " (?=[^e]*(?:empRef|e.*empRef))^(?:[^\\\n]*\\){7}"(?P[^\\]+)" but I receive a parser error. Many thanks and kind regards Chris

IRHM73 · ‎08-25-2015

Hi intially, I received an unbalanced quotes error message, so I inserted a " at the end of the regex which removed the error. I then add | stats count by empRef to the end of the search because I am just wanting to create a list of the empRef field values, and although the search runs and the events are shown, no list is being created. My apologies for the novice type problem. Many thanks and kind regards Chris

IRHM73 · ‎08-24-2015

Hi, I wonder whether someone may be able to help me please. I'm trying to get to grips with 'Report Acceleration' and I've managed to create one, but I think this was more luck than knowledge. I'm trying to accelerate the report below, but for some reason, Splunk tells me that it's unable to do so. index= main tags.transactionName = "Send Email Alert" auditType="TxSucceeded" | eval shortForm='detail.formId'." " | eval shortForm = substr(shortForm, 1, 6) | sort 0 detail.messageId | stats dc(detail.messageId) first(shortForm) as shortForm by "detail.messageId" | chart count by shortForm | eval pieSlice=shortForm + " " + count | fields pieSlice, count I've been reading through the documentation and through a tutorial in a book I have (Splunk Operational Intelligence Cookbook), and I think I have the correct streaming and transforming commands in place, so I'm unsure why this is failing. Could someone perhaps tell me please why I'm unable to accelerate this report? Many thanks and kind regards Chris

IRHM73 · ‎08-24-2015

HI @liorfink, thank you very much for taking the time to come back to me with this. Kind regards Chris

IRHM73 · ‎08-24-2015

Hi @pwmcity, thank you very much for this. I'll be able to work with this. Many thanks and kind regards Chris

IRHM73 · ‎08-23-2015

Hi, I wonder whether someone can help me please. I have multiple events which include the following piece of information "empRef\":\"012/A12345\" in the middle of the event. Could someone perhaps tell me please how it's possible to extract this piece of information from the event data. Many thanks and kind regards Chris

IRHM73 · ‎08-17-2015

Hi @woodcock that's great. Kind regards and many thanks. Chris

IRHM73 · ‎08-17-2015

Hi thank you for coming back to me with this, and my apologies for perhaps not making this clearer, but is there a way by which I can integrate the two because I'd like to include the search the user performed and the username? Many thanks and kind regards Chris

IRHM73 · ‎08-17-2015

Hi @woodcock thank you for taking the time to come back to me with this. I've tried the code snippet you kindly provided, but unfortunately I receive the following error: Error in 'rest' command: This command must be the first command of a search. So I tried to moving this to the beginning of the search but this also doesn't work. Any ideas where I may have gone wrong please? Many thanks and kind regards Chris

IRHM73 · ‎08-17-2015

Hi, I wonder whether someone may be able to help me please. From the answer I found here I'm using the query below to display searches that have been performed index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user Could someone perhaps tell me please is there a way be which I can see how long the search took to run. Many thanks and kind regards Chris

IRHM73 · ‎08-14-2015

Hi, for those who may be intereseted, I've now got this to work. This is the query I use in the scheduled report: index= main tags.transactionName = "Send Email Alert" auditType="TxSucceeded" | eval shortForm='detail.formId'." " | eval shortForm = substr(shortForm, 1, 6) | sort 0 detail.messageId | stats dc(detail.messageId) first(shortForm) as shortForm by "detail.messageId" | sichart count by shortForm And the following is how I retrieve the figures: index=summary source="SA Letters Suppressed Summary Index Test" | chart count by shortForm | eval pieSlice=shortForm + " " + count | fields pieSlice, count I hope this helps. Many thanks and kind regards Chris

IRHM73 · ‎08-13-2015

Hi @woodcock, thank you for taking the time to come back to me with this. In answer to your questions: Original post edited to reflect true name of report. Yes the populating search is enabled. Yes, when I set up the scheduled search I enabled 'Summary Indexing' Yes the index is called "summary" I can confirm that I'm able to see the events so I think but it's just putting this into the chart which appears to be the problem. I must admit I'm not soo sure what the answer is here. All I can say is that using a simple query I've been able to retrieve the 'Summary Index' results, and I've followed the same method. I hope this helps. Many thanks and kind regards Chris

IRHM73 · ‎08-13-2015

Hi Tom, thank you for this, it works perfectly. Thank you also for the guidance on the 'sort' and 'dedup' steps and the steps that they should be introduced. Kind Regards Chris

Posts	554
Solutions	23
Karma Given	58
Karma Received	41
Member Since	‎07-08-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Automatic Role Removal

Summary Indexing Not Updating

PII In Splunk

Extract Area Code From Phone Numbers

Foreach Not Working

Disable Code From Running

How do you create new fields from the current fiel...

Failed to parse templatized search for field....

Foreach in Multisearch

Foreach in Multisearch

Re: Is there a way to use the sort command in a se...

Re: Why I am unable to accelerate this report?

Re: Why did my results change when I replaced dedu...

Re: Unable to Put Together Join Search

Re: Sort 0 -_time

Unable to Put Together Join Search

Sort 0 -_time

Is there a way to use the sort command in a search...

Re: Why did my results change when I replaced dedu...

Why did my results change when I replaced dedup wi...

Re: Extract Data From Event

Re: Why I am unable to accelerate this report?

Re: Extract Data From Event

Re: Extract Data From Event

Why I am unable to accelerate this report?

Re: Extract Data From Event

Re: Extract Data From Event

Extract Data From Event

Re: Search Logs

Re: Search Logs

Re: Search Logs

Search Logs

Re: Summary Index Reports

Re: Summary Index Reports

Re: More Efficient Query Dedup to Stats Distinct C...

Join the Conversation