Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About akshaybahetii
akshaybahetii
New Member
Member since:
11-17-2014
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-17-2014 |
Activity Feed
- Posted Join behaving weird on Splunk Search. 12-03-2014 11:38 PM
- Tagged Join behaving weird on Splunk Search. 12-03-2014 11:38 PM
- Tagged Join behaving weird on Splunk Search. 12-03-2014 11:38 PM
- Posted Re: Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-18-2014 06:10 PM
- Posted Re: Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-18-2014 06:09 PM
- Posted Re: Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-17-2014 02:28 PM
- Posted Re: Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-17-2014 02:26 PM
- Posted Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-17-2014 12:26 PM
- Tagged Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-17-2014 12:26 PM
- Tagged Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-17-2014 12:26 PM
- Tagged Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-17-2014 12:26 PM
- Tagged Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-17-2014 12:26 PM
- Tagged Why am I getting errors failing to parse a Unix timestamp with my current configuration? on Getting Data In. 11-17-2014 12:26 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
12-03-2014
11:38 PM
The two queries I believe are similar but still i get very different number of results. I have changed the subsearch and join maxout in limits.conf. "productId" is the only common filed across both tables
sourcetype=all_review earliest=01/01/2012:0:0:0 latest=12/31/2012:23:59:59
| JOIN type=inner productId [SEARCH sourcetype=categories] | where pCategory="Movies"
18000 results returned
sourcetype=all_review earliest=01/01/2012:0:0:0 latest=12/31/2012:23:59:59
| JOIN type=inner productId [SEARCH sourcetype=categories pCategory="Movies"]
221,123 results returned.
I feel a subsearch/join maxout is hard coded in splunk. I need to find a alternative to join here.
... View more
11-18-2014
06:10 PM
Thank you cpetterborg for the help. It worked without any warning on converting "%+" to "%s" as you suggested.
... View more
11-18-2014
06:09 PM
Thank you Martin for the help. It worked without any warning on converting "%+" to "%s".
... View more
11-17-2014
02:28 PM
I just went ahead with the error and indexed data into splunk. Now it works fine. Still dint get the reason for the error.
... View more
11-17-2014
02:26 PM
I have set MAX_DAYS_AGO = -1.
... View more
11-17-2014
12:26 PM
I have unix timestamp in my data file .
review/time: 1182816000
review/summary: Periwinkle...
To parse this timestamp
timestamp/format: "%+"
timestamp/prefix: review/time:
lookahead: 12
the error I am getting is "Could not use strptime to parse timestamp from "1182816000\/n""
I feel splunk is unable to find the end of the timestamp. And when I specific "\d+" in prefix it fails.
I am not sure weather the time stamp is unix. But it feels like unix.
And splunk does recognize the time is 6/25/2007 5pm in the time column. Still get the error strange 😕
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
