Hi all i want to get the below highlighted field. "10.123.123.123","VM","??????????","VW_MCMM01_IvsHa","yellow","2016/12/27 04:49:16","False",, "10.123.123.123","VM","???????????","nap1_SeneChrt","yellow","2016/12/26 16:59:20","False",, "10.123.123.123","VM","???????????","VM_search-4-169_Gaw1Hijdas","yellow","2016/12/26 16:59:20","False",, thanks a lot. ... View more

hello! I want to know whether I can get 10% of the data? ...| eventstats count | eval ten_p=floor(count*0.1) | head ten_p... BUT! Error in 'head' command: The argument must be a positive number or a boolean expression. Some people know how to obtain this information? Thanks a lot.m(_ _)m ... View more

hello, i have a log like this: time,type,field1,field3,field3,field4,field5,...... 0102,A,2,3,4,1,3,... 0102,B,2,2,4,1,3,... i want to show the result like below. A B field1_name 2 2 field2_name 3 2 field3_name 4 4 .......... I tried to use apend, but the search is too long. ... type="A" | eval name="field1_name" | stats values(field1) as ta,values(name) as name | append [search ... type="A" | eval name="field2_name" | stats values(field2) as ta,values(name) as name ]| append [search ... type="A" | eval name="field3_name" | stats values(field3) as ta,values(name) as name ]| append [search ... type="B" | eval name="field1_name" | stats values(field1) as tb,values(name) as name | append [search ... type="B" | eval name="field2_name" | stats values(field2) as tb,values(name) as name ]| append [search ... type="B" | eval name="field3_name" | stats values(field3) as tb,values(name) as name ]| stats values(ta) as A,values(tb) as B by name I'm looking to see if there more streamlined command. Thanks a lot. ... View more

Hello, I used two rangemap in my dashboard. They all used this at the end. ...| stats count as Num | eval Num=tostring(abs(Num),"commas") | rangemap field=Num severe=1-1000000000000000 default=low The Num A=359, so it displays red color. The Num B=236,457 , but it is green! What's worng with them? I am so confused. Thanks a lot. 😃 My splunk's version is 4.1.6(89596). ... View more

Hi dears, I have a problem about the data input. I monitored a directory, and found some data didn't be eaten. I don't know what's wrong with it. My server works on Linux. I try to move these file to Windows, and use the same props.conf. Strange thing happened! I can find the data that they can't be searched on the Linux server. I clean the index many times, wait several hours, but all useless. Some people encountered the same situation? Thanks a lot. 😃 ... View more

Hi , I have three sourcetype. It's a complicated question. I'll try my best to let you understand what I mean. sourcetypeA id X Y Z sourcetypeB id keyword sourcetypeC X W V W+V may be equal 'Y' or 'Z'.It depends on the length. X isn't the only value. I want to find the keyword of B is 'success', but the result doesn't exist in sourcetype C, and display 'id'. search A+B ...sourcetype="A" |eval Check_Y=len(Y)|eval Check_Z=len(Z)|where Check_Y>10 OR Check_Z>10 | search [search sourcetype="B" "success" |fields id] But it always show 'The specified search is too large....'. In addition to this, how could I get the id? I ever thought about diff, but 'The diff command should not be used for events that have more than 500 lines, because the results may not be accurate.'. And how could I just let the results of subsearch use the "value" to outsearch, rather than field name and value? I thought I can't use 'Y=XXX' or 'Z=XXX' on sourcetype C. Or any other command can help me to achieve my goals? I am very grateful to have you help. Thanks a lot. 😃 ... View more

Hi,all I want to use "substr" to get what I want. A=1420014 ... |eval A=if(substr(A, 1,2)="14",replace(A, "14", "0"),A) |table A A will become "02000". But it should be "020014". Could anyone tell me what's worng? Can't I use substr by this way? Thanks a lot. 😃 ... View more

Hi all, I use rangemap to show results. Before the search goes done, the range will show [N/A]. Could I make the rangemap show [Loading] before it's search done? Thanks a lot. 😃 ... View more