Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunker1981
splunker1981
Path Finder
Member since:
09-09-2015
01-03-2023
Community Statistics
| Posts | 95 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 09-09-2015 |
Activity Feed
- Posted Re: How to get the percentage using values in event over two columns? on Splunk Search. 01-03-2023 09:41 AM
- Posted How to get the percentage using values in event over two columns? on Splunk Search. 01-03-2023 08:51 AM
- Posted How do you allow automatically match against lookup file multi-value field on Splunk Search. 11-09-2020 01:17 PM
- Got Karma for How to get event counts for multiple fields grouped by another field?. 06-05-2020 12:48 AM
- Got Karma for Without using fillnull, how to output a default value when any defined sourcetypes in my search do not return any events?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting "Error in 'rex' command...Regex: missing )"?. 06-05-2020 12:47 AM
- Got Karma for What are recommendations for field naming conventions to handle the same field names across different technologies?. 06-05-2020 12:47 AM
- Got Karma for Re: New search using values from first search. 06-05-2020 12:47 AM
- Posted How to edit my search to prevent duplicate values when using replace command on Splunk Search. 07-30-2019 02:44 PM
- Posted How to populate column in results using two indexes? on Splunk Search. 03-11-2019 08:52 AM
- Posted How do you join two fields with dedup? on Splunk Search. 02-08-2019 07:54 AM
- Tagged How do you join two fields with dedup? on Splunk Search. 02-08-2019 07:54 AM
- Posted Re: Joining values from two indexes and returning just specific values on Splunk Search. 11-14-2018 01:28 PM
- Posted Re: Joining values from two indexes and returning just specific values on Splunk Search. 11-14-2018 12:52 PM
- Posted Joining values from two indexes and returning just specific values on Splunk Search. 11-14-2018 12:27 PM
- Posted How do you run the stats count against multiple columns? on Splunk Search. 10-30-2018 09:18 AM
- Posted How do you calculate the average across columns in a table? on Splunk Search. 10-26-2018 02:29 PM
- Posted Re: How do I filter the following data set using a wildcard field name and greater than filter? on Getting Data In. 10-23-2018 12:48 PM
- Posted Re: How do I filter the following data set using a wildcard field name and greater than filter? on Getting Data In. 10-23-2018 10:58 AM
- Posted How do I filter the following data set using a wildcard field name and greater than filter? on Getting Data In. 10-23-2018 10:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-03-2023
09:41 AM
Thanks a bunch! That did the trick
... View more
01-03-2023
08:51 AM
Hello Splunk masters
I am trying to figure out how to get a rate (percent) by looking at two strings within a column, then dividing by values in another column
Sample data below. What I'm trying to do is calculate the rate of "incomplete" by batch week. Rate is calculated by taking the batch week, getting the total = (complete + incomplete) / incomplete. As shown below, I included a sample of what I'd like to get as a final output. This is way beyond my Splunk-fu and hoping someone can help me out here. Thanks for the help in advanced
Sample Data
site batch_status batch_week status_count
2506 complete 16 7
2506 incomplete 16 4
2506 complete 17 5
2506 incomplete 17 3
2506 complete 18 2
2506 incomplete 18 4
What I'd like to get back
2506 incomplete 16 36%
2506 incomplete 17 38%
2506 incomplete 18 -66%
... View more
11-09-2020
01:17 PM
Hello experts - I'm scratching my head trying to figure out if there's something at the low level configuration side that needs to be done to allow lookup matches against a multi valued field. I have two environments, with relatively same data, where I'm able to run a lookup and get back data on one but not the other using a similar approach. See sample search below | makeresults
| eval uid= "1017"
| lookup cust_uid.csv po_id as uid OUTPUT region, customer The contents of the lookup files is relatively the same on both but when I run the same command I get a match on one splunk instance but not the other. Below is a snippet of the lookup contents - 3 sample entries customer,region,po_id
XXX,US - West,"0
19263
129888
locale-39488"
YYY,US - East,"1299
3453"
UUU,BRZ,1017 Again, I'm not quite sure why I can't do a simple lookup against the multi valued field po_id and get back the 2 fields I call out in the output, thoughts?
... View more
Labels
- Labels:
-
lookup
07-30-2019
02:44 PM
Hello fellow Splunkers
Not sure the best way to approach the following problem. I use replace to update values within a fields. I'm running into an issue when I replace the 2 different strings values with the same string which ends up resulting in duplicate values for each of the renamed strings
| searchHere
| stats count(product_id) as total_product_id by assest_tag, product_version
| replace "storeX" with "local" in asset_tag
| replace "storeY_NZ" with "local" in asset_tag
| where asset_tag == local
| eventstats sum(total_product_id) as total_in_inventory
| eval perc = round( total_product_id * 100 / total_in_inventory, 1 )
| table product_version, total_in_inventory, perc
Part of the issue that I'm having is that I'm getting duplicate production versions. My guess is because of the replace. How can I resolve this?
... View more
03-11-2019
08:52 AM
Hello all -
Trying to figure out how to return the table below when using two index/sourcetypes. I'd like to do some eval by index and then check whether the respective index has an event so I can add yes | no to the respective column. The common field would be IP and either the IP will have both or one or the other defined.
indexA
ip=1.1.1.1 app-id=3.09
ip=3.3.3.3 app-id=2.11
indexB
ip=1.1.1.1 rel=release39
ip=2.2.2.2 rel=release12
Desired Results
IP Release App-id
1.1.1.1 yes yes
2.2.2.2 yes no
3.3.3.3 no yes
... View more
02-08-2019
07:54 AM
Hello folks,
Trying to figure out how to go about joining 2 fields with a dash but only if they don't have the same values. Ideally, if there's a way to dynamically add the - only if 2 strings, that would cool!
string1 string2 string3
string10 string20 string20
string11 string100 string100
index=xyz sourcetype=zzz |table field1 field2 field3
|eval joined = field2 + " - " + field3
|table field1 joined
Results desired for joined field
string1 string2 - string3
string10 string20
string11 string100
... View more
11-14-2018
01:28 PM
Didn't work, that's what I was trying. The contact field always comes back null....
... View more
11-14-2018
12:52 PM
I should've stated that I had this working with join. However, upon further reading it seems like the recommendation is to avoid join AND append when possible. But I couldn't get it working with stats...
... View more
11-14-2018
12:27 PM
Hello fellow Splunkers
I'm trying to figure out how to join values from 2 indexes and return one field (from one of the indexes) based on a match. For example; we have inventory IDs (e_id) in 1 index and contact details in another - both indexes have a unique ID value that's used to group things together (e_id field)
I'd like to run a search that returns just the contact field/value when the ID matches 1 to 1 with the numerical ID coming back in a search.
For example:
indexA
e_length
e_location
e_id
e_category
indexB
weight
last_shipment
e_id
contact
I'd like to join on the e_id field and return only the contact information from indexB when both id fields match.
something like |table e_length, e_location, e_id, e_category, contact
... View more
10-30-2018
09:18 AM
Hi all,
I'm trying to find a way to combine multiple searches into 1, but all efforts have failed. I'd like to run the equivalent of | stats count by column against multiple columns. Sample data and desired results below. Any pointers would be greatly appreciated.
T1 T2 T3 T4
36.650000 16.050000 1.366667 74
44.866667 40.016667 1.366667 74
54.966667 16.050000 1.366667 74
36.650000 57.950000 2.483333 74
36.650000 16.050000 2.150000 74
36.650000 40.016667 2.150000 2.150000
36.650000 16.050000 2.150000 74
Results (desired - layout can be in any format). As mentioned, right now I am doing |stats count by T1, another search with |stats count by T2 and so on.
T1 T2 T3 T4
36.65000 5 16.050000 4 1.366667 3 74 6
44.866667 1 40.016667 2 2.150000 3 2.150000 1
54.966667 1 57.950000 1 2.483333 1
... View more
10-26-2018
02:29 PM
Hello Splunkers
I tried a few of the suggested solutions, but none of them got me where I need to be, so i'm asking the larger group.
I'm trying to get the average across columns. Some of my columns contain null values, so i want to make sure that doesn't throw off my count, which is why i'm not simply adding each and dividing by the column number. With the data below, what's the best approach to getting an average across columns, with some having nulls. Sample data and results shown below. Thanks in advance
location col1 col2 col3 col4 average_here
Florida 7 null_here 0 2 3
New York 3 0 0 2 1.25
Texas 10 23 null_here 3 12
... View more
10-23-2018
12:48 PM
Still not working when I run against my data. I did notice that using your command I get the desired results. when I specifically filter using |search for the 10 results that should match, then the search works. But if I remember the |where I only get 1 match....
... View more
10-23-2018
10:58 AM
Thanks for the response! The problem is that it's adding up all the values which is NOT what I want. I just want to iterate through each of the f_* fields, see if the value for each of those fields is > 1 (independent of one another) and print those rows if any of the f_* have a value > 1
... View more
10-23-2018
10:01 AM
Hello experts,
I'm stuck trying to figure out how to filter the following data set to get the results shown below. Any assistance would be greatly appreciated.
Sample results
c_1 f_1 f_2 f_3 f_4 f_5
x001f 1 0 0 0 0
x0883g 1 0 0 0 0
x8834c 2 0 0 0 0
x8832d 3 0 0 0 0
x883kd n n n
I'd like to do a filter by using a field wildcard f_* and > 1 and have it return the complete matching line; like the one below.
x8834c 2 0 0 0 0
x8832d 3 0 0 0 0
I tried doing the following, but no luck...
| foreach f_*
[ eval total=total + '<<FIELD>>']
|where total > 1
... View more
07-23-2018
08:50 AM
Hello Splunk experts
I'm trying to figure out what the best way to get a jobID or monitor job status for a search executed via the Splunk Web UI which is then piped | to my custom command. I'd like to ensure I am working with completed data/results, so I'm trying to do something similar to the below, which I usually do when kicking-off jobs directly from the API. I am not sure how to pull job status/job id information for a job that is being executed within the UI then piped | to a custom command.
while not job.is_done():
sleep(.2)
Sample of what my search would look like
index=_internal
|eval x=blah
|stats count by x, y
| table y
| customCommandHere
... View more
06-29-2018
09:37 PM
That worked, thanks!
... View more
06-29-2018
04:08 PM
Hello all,
What's the best way to use a NOT statement in an if statement. I'm trying to accomplish something similar to the below.
| eval x_height=if(isnull(x_height) AND NOT (sourcetype=mysourcetypeHere),"Not Defined",x_height)
... View more
06-29-2018
03:01 PM
I'm starting by searching two indexes/sourcetypes
(index=1 and sourcetype=1) OR (index=2 and sourcetype=2)
Both have a few fields in common but I need to pull values from each sourcetype specifically.
sourcetype1 and sourcetype2 have 2 fields in common which I was using to join build_idx uqIDX.
Data always exists in the build sourcetype (sourcetype1) but only if the process has made it out of phase1 will it exist in sourcetype2. When I use stats to print fields from both sourcetypes, if an event does not exist in the second sourcetype then I get zero results.
Something like the below
index=1 sourcetype=1 OR index=2 sourcetype=2
|eval joinOn=coalesce(uqIDX,buildIDX)
|eval sourcetype1_value=if(isnull(sourcetype1_value),"0_no_build",sourcetype1_value)
|eval sourcetype2_value=if(isnull(sourcetype2_value),"Manual",sourcetype2_value)
|stats values(sourcetype1_value), values(sourcetype2_value), values(sourcetype2_valueB), values(sourcetype2_value3) by joinOn
... View more
06-29-2018
02:52 PM
That worked but only if both tests matched. What I'd like to do is make the where statement fail if the sourcetype doesn't exist. Might be a better way to rewrite what I am trying to do which is essentially not use a join statement and use | stats instead
... View more
06-29-2018
01:48 PM
Hello experts,
I have a search that I am trying to add a where statement to which compares fieldvalueA to fieldvalueB. where statement works great but I'd like to only hit the where statement only if a specific field does not exist. Hope that makes sense
My search that currently works looks something like this
searchHere (index=xyz sourcetype=xxx) OR (index=yyy sourcetype=tttt)
|stats values(x) values(y) by fieldY
|where test1=test2
What I'd like to do is; if the second sourcetype does not return in the result-set then don't execute the where statement.
searchHere (index=xyz sourcetype=xxx) OR (index=yyy sourcetype=tttt)
|stats values(x) values(y) by fieldY
|where test1=test2 if(exists(sourcetype=ttt)
Pretty sure there's a better way to do that, hoping someone can point me in the right direction.
Cheers and thanks for the help!
... View more
05-15-2018
08:58 AM
Hello Splunkers,
I'm trying to figure out how to apply an if statement to check the count of an index before adding a value to it. For example, the code below does partially what I need but in cases where split is indexing more than 2 values, that's where I run into issues.
| eval accountInfo=split(content,"/"), user=mvindex(accountname,0), domain=mvindex(accountname,-1)
What I'd like to do is something like;
index=0 will always be correct
index=1 will change depending on items in the index - if there's 3 items based on the split, item 2 will be domain and item 3 will be record
index=2 will be record if there's more than 2 items that were split
Example of what I am looking to eval after splitting
userA/domainB/recordZZ ===> user=userA domain=domainB record=recordZZ
userA/recordC ===> user=userA domain= record=recordC
... View more
04-24-2018
12:01 PM
Hello Splunk experts,
Not sure if I'm going about this the right way, but I'd like to store contents of multiple fields in 1 field using an eval statement. I will be testing one of the fields against a specific string and the two other fields (json) I'd like to just store the current values if the they aren't null. Meaning I just want them to be added to the analysis_proposal field. Again, not sure if case is the best way to achieve this but any help would be really appreciated.
| eval analysis_proposal =
case(
isnotnull(field1) and field1=="my field 1 test.", "legacy",
isnotnull(field10.contents), field10.contents,
isnotnull(field20.contents{}), field20.contents{})
... View more
11-30-2017
12:00 PM
Figured out a better way to do this using streamstats
| streamstats count as counter
| stats values(*) as * by counter
| fields - counter
... View more
11-30-2017
10:50 AM
Hello Splunk experts,
I'm trying to figure out a better way to handle the large number of case statements that I would need to null out values across my fields when the value stored = 001. I'm currently doing something like what I have shown below:
searchHere
| eval field1=case(field1 == 001, null(),1=1, field1)
| eval field2=case(field2 == 001, null(),1=1, field2)
| eval field3=case(field3 == 001, null(),1=1, field3)
.... bunch more here
| stats values(*) by Key
This works as intended but compiling all these evals are a pain. I was trying to loop through all my fields* using the foreach command but I can't seem to get the fields to names to maintain their name
|foreach field* [eval <<FIELD>> = if(<<FIELD>> == 001, null(), 1=1, <<FIELD>>)]
... View more
11-16-2017
09:08 AM
This partially works, I think. rec values populate but the fields and values that should be returned by the script never actually come back when run inside the appendpipe. Is there a way for that?
... View more
