About rojyates

rojyates · ‎06-01-2023

That's a nice trick!

bowesmana · ‎09-13-2022

and there is of course the flow map viz by @chrisyounger https://splunkbase.splunk.com/app/4657/ if you are looking for transactional volume flow between the servers

rojyates · ‎10-24-2019

An alternative to | eval country_scheme = country . ":" . scheme is to use strcat: | strcat country ":" scheme country_scheme | timechart count BY country_scheme

wrangler2x · ‎06-22-2018

searchmatch will not allow a field to be used in place of string. However, the match function of eval will, and match can be made to behave like searchmatch very easily! | eval searchHits=if(match(_raw,"Type=Error"),1,0) is the same as: | eval searchHits=if(searchmatch("Type=Error"),1,0) Further, match will support the regex pipe, so you can OR as well. Here's an example of both: ... | eval typeField = "Type=Error|Type=Warning" | eval searchHits=if(match(_raw,typeField),1,0) | stats count as EventCount sum(searchHits) AS searchHits by Type

rojyates · ‎08-05-2018

Here's a more generic approach: The following refinement of @martinh3's approach will remove all namespace prefixes (leaving the namespace declarations, which will simply do nothing) in one hit: rex field=_raw mode=sed "s/(<\/?)([\w\d-]+):(\w+)([ \/>])/\1\3\4/g" This will remove all namespace prefixes made up of word characters, numbers or "-". If you are simply applying this to the whole raw message, then you can actually leave out 'field=_raw' or if you have extracted your XML into a field as part of a search, the replace 'field=_raw' with 'field=yourfieldname'.

Posts	5
Solutions	0
Karma Given	31
Karma Received	1
Member Since	‎05-02-2018

Online Status	Offline
Date Last Visited	‎02-27-2024 09:02 PM

Re: How to present a readable time value when epoc...

Re: How to generate a flow diagram from sequence o...

Re: How do you Timechart by multiple fields?

Re: Use a field as the search in searchmatch

Re: XML File with namespaces parsing