×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ndiphe13
Engager
Member since: ‎03-12-2018
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 1
Member Since ‎03-12-2018
Activity Feed
Topics I've Started
View All

Re: How to count from raw lines?

by in Splunk Search
‎03-13-2018 07:37 PM
1 Karma
‎03-13-2018 07:37 PM
1 Karma
Thanks @niketnilay for your great sharing. Ive done some changes in the props.conf and transform.conf. The output is exactly what I am expected. props.conf [syslog] REPORT-fields=commafields transform.conf [commafields] DELIMS = "," FIELDS = date_time, server, sensor, status, remark My Search <MyBaseSearch> | chart count over server by status ... View more

How to count from raw lines?

by in Splunk Search
‎03-12-2018 09:20 PM
‎03-12-2018 09:20 PM
I have a lot of RAW data with this format: date_time,serverA,down date_time,serverB,down date_time,serverA,down date_time,serverA,down date_time,serverA,up date_time,serverB,up How to count that raw data so we can have the following result? server | up | down| serverA | 1 | 3 | serverB | 1 | 1 | Thanks, Andi ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All