Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About gnorud
gnorud
New Member
Member since:
12-16-2014
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-16-2014 |
Activity Feed
- Posted Re: How to create a report in Splunk as a configuration management tool to compare all fields for the same object from different dates and display changes made? on Reporting. 10-19-2015 06:42 PM
- Posted Re: How to create a report in Splunk as a configuration management tool to compare all fields for the same object from different dates and display changes made? on Reporting. 10-19-2015 05:46 PM
- Posted How to create a report in Splunk as a configuration management tool to compare all fields for the same object from different dates and display changes made? on Reporting. 10-18-2015 11:39 PM
- Tagged How to create a report in Splunk as a configuration management tool to compare all fields for the same object from different dates and display changes made? on Reporting. 10-18-2015 11:39 PM
- Tagged How to create a report in Splunk as a configuration management tool to compare all fields for the same object from different dates and display changes made? on Reporting. 10-18-2015 11:39 PM
- Tagged How to create a report in Splunk as a configuration management tool to compare all fields for the same object from different dates and display changes made? on Reporting. 10-18-2015 11:39 PM
- Tagged How to create a report in Splunk as a configuration management tool to compare all fields for the same object from different dates and display changes made? on Reporting. 10-18-2015 11:39 PM
- Tagged How to create a report in Splunk as a configuration management tool to compare all fields for the same object from different dates and display changes made? on Reporting. 10-18-2015 11:39 PM
- Posted Re: How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 06:15 AM
- Posted Re: How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 05:59 AM
- Posted Re: How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 05:56 AM
- Posted Re: How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 03:50 AM
- Posted How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 01:54 AM
- Tagged How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 01:54 AM
- Tagged How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 01:54 AM
- Tagged How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 01:54 AM
- Tagged How to extract values from 2 multivalue fields as field names and values and generate new key value pairs dynamically? on Splunk Search. 04-14-2015 01:54 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
10-19-2015
06:42 PM
I've got another issue on the same question..
Some of attributes will take more than one value.
for instance, each vserver will have multiple NICs, the result from the query seems like only take one ip address out of many. Then it will compare the latest result (single value)and result in fieldsChanges on NIC IPs. which consists of array and they are not changed.
I tried to change latest() to values() and sort it by descending on value(). however it still doesn't give me matching results of 2 arrays values for the single fields.
Is there any workaround for it?
... View more
10-19-2015
05:46 PM
its working great. I ve got what I need. Thank you
Is there any reference kb for me to understand this eval ?
if((<<FIELD>> > 1), fieldsChanged . "<<MATCHSTR>>,", fieldsChanged)
... View more
10-18-2015
11:39 PM
I am testing on using Splunk as a configuration management tool so I can compare if there were any configuration changes in my server (in this case, it is netapp filer add, modify, delete). I managed to import all configuration items as multiple objects with attributes into Splunk.
Does anyone know how I can compare ALL fields between dates on some object (essentially 2 events with same KV pair from 2 different dates.) and output results (equal and non-equal ones)? The idea is to track any unauthorized changed, without having to define which fields to compare, and basically compare the whole table.
For Example:
Day - 1
vserver="vs_test"
read_grants_exec="disabled"
smb2_enabled="true"
smb3_enabled="true"
Day - 2
vserver="vs_test"
read_grants_exec="disabled"
smb2_enabled="false"
smb3_enabled="false"
Day-3
I want my reports is able to tell me, without having to define field names, to compare all fields and generate report on: smb2_enabled/smb3_enabled attributes are changed from true to false.
... View more
04-14-2015
06:15 AM
This is my current workaround.
However I need the field name to be created dynamically as well from another fields' multivalued event.
For example: as for a single event, field name = countertype; field value=(Counter1,counter2,counter3).
I need extract from above event and create 3 new fields.
Fields name = counter 1,2,3
... View more
04-14-2015
05:59 AM
Hi
The counts value is from count field. So I don't have to count events. I need to assign counts values to each counter.
... View more
04-14-2015
05:56 AM
Hi
I don't need to extract count value.
The count field in the log is multivalued separated by comma，count event is the number of occurance for each counter, counter name is from another field.
I want a timecharts to show linechart per counter and counts created inline.
... View more
04-14-2015
03:50 AM
The purpose is to create a tabulate output with label as column name, then populate each row by using count values.
Labels are extracted from counter fields by delimiter comma,
Values are extracted and assigned to each label cell.
With the output so I can chart based on _time
... View more
04-14-2015
01:54 AM
I need to extract from 2 fields and compile them into multiple fields.
1st field contains all the counter names.
Example
Event:
label=counter1,counter2,counter3
The label doesn't change. Event is all the same for label type.
2nd field contains all the counts.
Example
Event1= 0,10,20
Event2=2,30,15
...
EventN=x,y,z
I can use split and mv to do the extraction.
How can I compile those counter and counts into key value pairs inline?
I need to use the values from counter field as a new field. Values from count field as the new values. The pair will be position based and split by comma?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
