About salpaysog

salpaysog · ‎12-28-2018

This is brilliant thank you Giuseppe! Works well and very fast.

salpaysog · ‎12-27-2018

I have two csv files of email adresses that I want to compare by listing email adresses only available in one (and respectively in the other one). What I want to do is similar to a "minus" operation in SQL. This issue was already solved in many threads such as: -https://answers.splunk.com/answers/56586/list-difference-between-two-csv-files.html -https://answers.splunk.com/answers/386822/how-to-compare-search-and-csv-file.html However, my csv files are huge (300000+). And most of the email adresses are common to both. I just need to extract the few oddities. Subsearches and joins are limited (maxout limit of subsearch 10000 in my enterprise edition). Does anyone have an idea how to use Splunk to solve this? I have tried to use excel or even written a python script but it takes hell of a time and my computer does not support the calculations...

salpaysog · ‎12-13-2018

That's it thank you! I saw some xml with the and tags but I was having trouble to figure out their use.

salpaysog · ‎12-12-2018

Sorry it wasn't clear. I have two different checkboxes for each query and I want to change corresponding search based on checked or unchecked boxes.

salpaysog · ‎12-12-2018

For the first one my query is: index = onelogin sourcetype = onelogin:event app_name != null $excludeX$ $events_app_event_selector$ | rename app_name AS APP_NAME | dedup $events_app_unique$ | stats count by APP_NAME | sort count desc when the checkbox is selected, I want $excludeX$ to become id!=XYZ. When it is not selected I want it to be empty. the second one: I want this search: index="onelogin" sourcetype="onelogin:event" eventtype="onelogin_event_login_to_onelogin_success" | dedup id | timechart count AS Successful_Logins to become: index="onelogin" sourcetype="onelogin:event" eventtype="onelogin_event_login_to_onelogin_success" | dedup id | timechart distinct_count*(user_id)* AS Successful_Logins

salpaysog · ‎12-12-2018

I am really struggling with two checkboxes to change my search queries. I may be losing my time with the wrong input choice. Please tell me if I'm lost. I want to add a checkbox to change my SPL: -For the first one, I just want to add "id!=XYZ" to exclude something from the search -And in another panel, I want my: | timechart count as ABC to become: |timechart dc(id) as ABC Am I the only one not understanding the Token options (prefix/suffix value, delimiter etc)? Any help would be appreciated. Thanks in advance.

Posts	6
Solutions	0
Karma Given	2
Karma Received	2
Member Since	‎12-12-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Comparing two huge csv files

How do I add a check box to change my search?

Re: Comparing two huge csv files

Comparing two huge csv files

Re: How do I add a check box to change my search?

Re: How do I add a check box to change my search?

Re: How do I add a check box to change my search?

How do I add a check box to change my search?