About Nikita_Danilov

Nikita_Danilov · ‎07-02-2014

Does match(,) have better performance than lower() ?

Nikita_Danilov · ‎07-02-2014

Martin, thanks, but what about count(eval(log_level=info)) ? I need to use everywhere lower() ? Where I can find information about this "exceptions"? This case surprised me, because in other Answers people say that "Splunk is case InSensitive".

Nikita_Danilov · ‎07-02-2014

What Splunk's version are you using? Try it: | where field="FOO"

Nikita_Danilov · ‎07-02-2014

Hi all, I need to make by default all searches in Splunk 6.1.1 as case InSensitive. For example, this search are case InSensitive: index=_internal log_level=info But this search are case Sensitive: index=_internal | where log_level=info Hm, strange... Why? Maybe it's bug and I need to report about it? How can I set default case InSensitive search everywhere? I know about function lower() , but it's just particular solution. Thanks.

Nikita_Danilov · ‎06-11-2014

Ok, thanks! Unfortunately, AdvancedXML it's not acceptable for me, because TimePicker in AdvancedXML has not so handy style as in SimpleXML (http://answers.splunk.com/answers/139525/can-i-apply-default-style-for-timerangepicker-in-advancedxml).

Nikita_Danilov · ‎06-11-2014

Thanks! But as I understand, it's not PostProcess, it's just shared base search string?

Nikita_Danilov · ‎06-11-2014

Hi all! How can I declare few different SearchTemplate's in one Dashboard with SimpleXML? I need it for optimization. Or I can do it only with AdvancedXML? In documentation (http://docs.splunk.com/Documentation/Splunk/6.1/Viz/PanelreferenceforSimplifiedXML) I found that can be declared not only in Form, in Table/Chart/Events/... too. But, I need to declare in and use results in few Charts (maybe as PostProcess). Thanks!

Nikita_Danilov · ‎05-05-2014

In the end, we decided to create an internal cumulative index and accumulate therein summary statistics using scheduled search (http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing). Thank you all for your help!

Nikita_Danilov · ‎05-05-2014

This example works only for cases when the "error" has been corrected in adjacent periods. With a larger gap in time, it will not work. However, the example is useful for another task, thank you!

Nikita_Danilov · ‎04-29-2014

Martin, if there are functions "len" and "substring", why not add another one function for strings as "indexof".

Nikita_Danilov · ‎04-28-2014

yannK, thanks, but I need it in basic search, not only in Forms. I've used Martin's solution.

Nikita_Danilov · ‎04-28-2014

Martin, it works fine for me: | eval replaced = replace(haystack, "(.*?)".needle.".*", "\1") | eval position = if(match(haystack, needle), length(replaced), -1) Thanks! Strange to me that there is no special built-in functions.

Nikita_Danilov · ‎04-28-2014

Hi all! As I understand, Splunk doesn't have any special functions for normal work with string. I need to get index of a not constant char/substring in another string. Substring is not constant, it's value from another field. Solution for constant substring: http://answers.splunk.com/answers/66496/how-to-get-index-of-a-particular-letter-in-string But, it has not work for dynamic substring. I tried to form regular expression: index="b2b_integration_oss" | eval string="Some long string" | eval regExString=".*(?<substring>\b" + searchField + "\b).*" | rex field=string regExString Then, I got next error: Error in 'rex' command: The regex 'regExString' does not extract anything. It should specify at least one named group. Format: (?<name>...). Why doesn't exist in Splunk any analogs for SQL CHARINDEX function? Anyone can guide me please on this? Thanks!

Nikita_Danilov · ‎04-24-2014

Somesin2, thanks for this question, I forgot to say about this case: "Success" it's a final Status for each ID. If already exists event with Status=Success and ID=1, then new event with Status=Error and ID=1 will not be added.

Nikita_Danilov · ‎04-24-2014

More detailed example. Events in index: ID Status StatusDateTime -------------------------------------- 1 Error 0:30 2 Success 0:30 1 Success 1:30 3 Error 1:30 4 Error 2:30 3 Success 3:30 4 Success 4:30 5 Error 4:30 6 Success 5:30 Required overall result: Slice Success Error ------------------------------------ 1:00 1 1 2:00 2 1 3:00 2 2 4:00 3 1 5:00 4 1 6:00 5 1 Main issue - correctly calculate total Error's count. If added new event, with the same ID and status "Success" (that before then had "Error"), total Error's count must decrease. "Success" it's a final Status for each ID. If already exists event with Status=Success and ID=1, then new event with Status=Error and ID=1 will not be added. I have to get this result in one search, is it realizable? Thanks!

Posts	21
Solutions	1
Karma Given	9
Karma Received	0
Member Since	‎04-23-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to make case InSensitive search everywhere by ...

Few SearchTemplate's in Dashboard for optimization...

How to get position of a not constant char/substri...

Cumulative counters with "slice" logic

Re: How to make case InSensitive search everywhere...

Re: How to make case InSensitive search everywhere...

Re: How to make a search case-sensitive?

How to make case InSensitive search everywhere by ...

Re: Few SearchTemplate's in Dashboard for optimiza...

Re: Few SearchTemplate's in Dashboard for optimiza...

Few SearchTemplate's in Dashboard for optimization...

Re: Cumulative counters with "slice" logic

Re: Cumulative counters with "slice" logic

Re: How to get position of a not constant char/sub...

Re: How to get position of a not constant char/sub...

Re: How to get position of a not constant char/sub...

How to get position of a not constant char/substri...

Re: Cumulative counters with "slice" logic

Re: Cumulative counters with "slice" logic