About rupesh_patil20

manidandu · ‎05-24-2021

I want to delete data for a source as we are seeing sensitive information in it. Can I use | delete for that source? Once we fix the maxing issue, we can start pulling logs from that source and we can search it right? Please let me know.

rupesh_patil20 · ‎10-12-2015

Hi Jcoates, thanks for your quick response, I have added comments.. but it seems comments are not displayed. writing the response of last comment here... As per your guidance in the last comment, I have set the serach query as you suggested "> http://screencast.com/t/rUqqTuTx But the data which this query has retrived was found to be very old. You can see the date 15/09/2015. where as I am expecting that it ("_internal" index) should return the data for current date and time. My table and DB name is differnet from the DB and table name which is specifiend in the data which is being retrived in the search. Required Data >> http://screencast.com/t/xzBgBpnq This is my output when I retrived the data from the sql server 2014 in splunk db connect v2 >> DB Input >> see the screen shot: http://screencast.com/t/bexKE3Qh5 Now the issue is, internal index is not running as per the current date and time. Is there is fixing regarding the index. so that we can get the current status of the data which is retrived in the search.

rupesh_patil20 · ‎09-15-2015

Thanks Laserval. I will do the needful as you suggested.

rupesh_patil20 · ‎09-15-2015

Yes I have configured it.

rupesh_patil20 · ‎08-31-2015

Hi Somesoni2, I tried your query and I got the result but the problem arose now is it is giving me repetitive count, for example here there are 7 records for the count = 1, but in the result the count shown as 98550. As I am using REST API for input.. so may be it updates the data continuously. Can you help me with time stamp, like how I can add it in search to get the exact data.

alacercogitatus · ‎08-27-2015

So a simple rename will work. source="rest://mls_number" | rename result{}.EventData.mlsnumber AS MLS_Number result{}.result AS Count But, a caveat here is that the fields are multivalue and won't expand correctly. when you try to do stats on the mls numbers. So after the search above, do this: eval atmp = mvzip(MLS_Number,Count) | mvexpand atmp | eval a=split(atmp,",")|eval Count = mvindex(a,1)|eval MLS_Number=mvindex(a,0) | <other stats> The other stats will allow you to do time based calculations by MLS_Number .

rupesh_patil20 · ‎08-25-2015

Thanks jvarmazis, I will make the changes and will update you..

miteshvohra · ‎09-03-2015

I have updated the answer with path to the directory where the jar file needs to be copied. Hope this helps. Mitesh.

rupesh_patil20 · ‎09-15-2015

Hi .. where to use this command, i have tried in search but it didnt work out

Posts	31
Solutions	0
Karma Given	14
Karma Received	0
Member Since	‎08-25-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Which inbuilt "source type" and "source" should we...

How to setup "Metadata" characteristics in Splunk ...

Getting Error while doing MS Sql connection : Enco...

How to represent data in piechart/Linechart which ...

How I can use the rename command in my search on J...

How to display count of zipcodes that have been vi...

Re: remove source and source types

Re: Which inbuilt "source type" and "source" shoul...

Re: How to setup "Metadata" characteristics in Spl...

Re: Getting Error while doing MS Sql connection : ...

Re: How to represent data in piechart/Linechart wh...

Re: How I can use the rename command in my search ...

Re: How to display count of zipcodes that have bee...

Re: Splunk DB Connect MS SQL DB - Connection refus...

Re: How do I remove Sources?

Join the Conversation