About tachifelix

esix_splunk · ‎09-28-2020

You'd be better to start a new thread and ask the community for help in that manner. Also, look at the Cisco IOS and ASA TA's that have all the extractions in place. You most likely can find the solution there.

moiezuddin · ‎04-09-2015

thanks rich, for your brief explanation. i got the result with the below search query index=casm_prod sourcetype=smtrace "Center realm" | bucket _time span=1m |stats count(sso_id) as eventcount by _time, sso_id thanks alot

dfoster_splunk · ‎03-30-2015

It's more reliable to write $footoken|s$ than "$footoken$", as the former will deal with backslashes and quotes in the token value correctly.

moiezuddin · ‎03-19-2015

Not working tried it. thanks for the effort

Ossian · ‎03-25-2015

Finally figured this out. Was filling out a support ticket on this "issue" and one of the answers they linked to was http://answers.splunk.com/answers/23321/field-regex-behaves-differently-for-field-extractions-and-for-rex.html. Apparently you need to add "(?m-s)" to keep "." from matching across newlines when using a regex in a transform. I just wish there was better documentation about the different behavior of regex's in different contexts within Splunk. The following transform now works great for me: [mv_localadmin] REGEX = (?m-s)(.*\n|.*$) FORMAT = LocalAdmin::$1 REPEAT_MATCH = true MV_ADD = true

schose · ‎03-18-2015

HI all, thanks for your answers. For me the main problem was that all values was created in the field "value". It worked much better for me to extract the fieldnames using the <_KEY_1><_VAL_1> Fields. This fields extract the names of the values "dynamic" so i get fields with e.g. running=3 sleeping=105 ... so creating a timechart is quite easy when using search | timechart avg(running) as running avg(sleeping) as sleeping Thx and best regards, Andreas

varunnair26 · ‎03-05-2015

Hi @ppablo_splunk , I have checked the link. The drivers are for MySQL, Oracle, DB2 and Informix. My database is Microsoft SQL server. Is that require any driver ? If yes, which one should I download ? Please suggest.

Murali2888 · ‎06-10-2015

Thanks dturnbull_splunk. By far this is the most efficient query 🙂

tachifelix · ‎12-16-2014

add select command after update like "select Data1, Data2, Status from test_table1, test_table2 where Status='Closed' and Data2='test2' and Data1='test1' "

tachifelix · ‎12-12-2014

this search string doing the work for the following data sample data: partner cost World T Plus 19000 Prix Mono 47500 Prix Mono 19000 Prix Mono 19000 World T Plus 19000 Prix Mono 19000 Prix Mono 38000 Prix Mono 19000 search string: source="C:\tachiFlashDisc\test_firstAnswers.csv" |sort partner|table partner cost | dedup cost result: partner cost Africa Telecom 9500 Africa Telecom 19000 Africa Telecom 47500 Africa Telecom 28500 B and C 0 B and C 4750 B and C 33250 B and C 14250

solarboyz1 · ‎12-15-2014

The field name for the tests need to by dynamic. A simple rename doesn't work, unless I can use the value of the field name. Splunk has confirmed that as of version 6.2 this cannot be done at search time.

chrishenry · ‎12-12-2014

Posting in reply to: tachifelix as forum won't allow me to reply Nope, that doesn't work because of the ':' character.

MuS · ‎12-13-2014

take a look at this: http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html to get an idea how to get this done a different way .... because join should be a last resort .... not the first option to use

lakromani · ‎10-12-2016

You are trying to add it to a dashboard. Instead of "<" and ">" user "<" and ">"

Posts	36
Solutions	0
Karma Given	2
Karma Received	4
Member Since	‎12-11-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: If I have multiple Cisco devices sending syslo...

Re: How to right regular expression for finding fi...

Re: How to pass a token to a panel in the place of...

Re: How to write the REGEX to extract and add new ...

Re: How to extract multiple values in a single eve...

Re: How to group my sample events together for a t...

Re: Splunk DB Connect: How to troubleshoot error "...

Re: How to join two search events that have a comm...

Re: Using DBQuery to update DB table data

Re: How to create a market basket analysis?

Re: How to extract multikv field at search-time wi...

Re: How to graph time values %H:%M on the y-axis a...

Re: How to join two log files with matching string...

Re: How to combine my two search queries using joi...

Join the Conversation