About mhenrick

mhenrick · ‎07-18-2013

Thanks a lot, I'll try to do a data preview tonight!

mhenrick · ‎07-18-2013

Hi All, I was wondering if any of you knew of a Splunk simulator (where I could upload a CSV and check my searches without having to create an entire testing environment/run tests on production data). Thank you

mhenrick · ‎07-16-2013

Hi Iguinn, I actually think this may work alone. | stats count by a, b, c Also, if I wanted to keep other values, I think I'd do it this way: | stats values(d),count by a,b,c Will this work?

mhenrick · ‎07-16-2013

Hi Iguinn, Thanks for the help, I do need to compare 3 fields at once. I think the best way would be to do a count by the values in a mvfield I can create. I'm a bit confused about your code above because I thought coalesce just takes a number of fields and returns the first one that is not null, not necessarily combining them? Would my code below count all logs that match fields a, b, and c? Also, do you know a better way of making the combinedfield? | eval combinedfield = a.b.c | stats count(combinedfield) Thanks again for the help.

mhenrick · ‎07-15-2013

Hi All, I'm currently trying to test my field structure for dedup, but aren't sure of what best practices are for doing so/how to code them all. As of now, since I'm trying to delete a duplication error in my log system, I'm trying to count the amount of response where three fields are equal across the logs (not within the logs). If the count is above 2, it means that with those 3 fields of some set values I must be counting not only the original and the copy, but also some other log. Do you know how I could potentially code this efficiently? Will I have to merge the 3 fields into one and then compare them with a count, or can I keep them separate? Also, do any of you have any other ideas for how I could check dedup? I'm open to any and all suggestions. Thanks so much for your help!

mhenrick · ‎07-11-2013

Hi Linu1988, I'm not too versed in sub-searches. How would the loaded csv be compared to a multi-valued field? For example, if I set the cvs up like this (don't worry about the values, I had a user-defined mapping originally) CSV: fields are on top |command|val..|val..| |su |12321|12312| |rm |12313|12312| |mv |32134|12352| and I'm trying to check if an excel field that has values like below is in there (all one cell, it's multi-valued): | mv | | cp | | ls | Thanks for the help

mhenrick · ‎07-11-2013

Hi linu1988, I'm not planning on running the Linux, this search is meant to look through collections of Unix logs. My problem is that I'm trying to look at a multivalve field from that search and figure out if any of those values are the input of a lookup table I have. For example, the log could have a field like: cp, mv, rm，and I'm looking to see if rm (or some other commands are in there).. I'm hesitant to do a huge regex, but think it may be my only option.

mhenrick · ‎07-10-2013

Hi Guys, Right now I'm trying to set up a Splunk query to look for a series of Unix commands within either a multi-valued field (with all the commands) or a string that includes the command line. My only problem is that I'm unsure how to do the matching and I was planning on using a lookup table to hold all of the commands that I'm looking for. I've been leaning towards doing a regex implementation, but it just seems sloppy. Any ideas?

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-10-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk Simulator

Counting Occurrences Based Off Multiple Fields

Multi-value Field Help

Re: Splunk Simulator

Splunk Simulator

Re: Counting Occurrences Based Off Multiple Fields

Re: Counting Occurrences Based Off Multiple Fields

Counting Occurrences Based Off Multiple Fields

Re: Multi-value Field Help

Re: Multi-value Field Help

Multi-value Field Help

Are you a member of the Splunk Community?