About ryhluc01

ryhluc01 · ‎07-02-2019

Hi, Please select @linu1988 answer. It was the correct fix to the TC other problem.

ryhluc01 · ‎05-10-2019

@lguinn2 Make this a comment so that it can be accepted as an answer. I found this to be correct.

ryhluc01 · ‎05-08-2019

It sounds like splunk is adjusting its timestamp based on the time stamp of your data

ryhluc01 · ‎05-08-2019

Thanks : D

ryhluc01 · ‎05-07-2019

Thanks @woodcock where would I find this to be able to edit it?

ryhluc01 · ‎05-07-2019

Are you talking about the whole dash board or a panel within the dashboard?

ryhluc01 · ‎05-07-2019

Edit what you allow for them to do within the user roles.

ryhluc01 · ‎05-07-2019

Good Morning, I need to do a stat avg on the time difference between results. Problem is all of my fields are both duplicate and multi-value (MV). So, 1) Will the fact that every field is duplicate & MV affect the avg? 2) How can I efficiently make all of the data show up as a single field? This has to be within my search query because its a production environment and I do not have access to change how the data coming in.

ryhluc01 · ‎05-02-2019

They are not actually duplicates so you're going to want to do some research what your data is doing and why. |dedup 1 day sortby day You need to make sure that you specify which field you want your dedup to sort your data by.

ryhluc01 · ‎04-30-2019

Thanks! You guys are so helpful! I am going to try these out this week 😄

ryhluc01 · ‎04-30-2019

Wow thank you! I'll have to give this a try this week 😄

ryhluc01 · ‎04-23-2019

@somesoni2 Apologies, I just re-read my response to you and I can see that I worded that incorrectly : ) I only want the delta between the very first event with a new status and the event that immediately follows it. The result can be output to a new field. So in essence: If the status is new then I want the delta between that event and the event immediately after it (# 1 & 2 in the example)

ryhluc01 · ‎04-23-2019

@somesoni2 Sure. This is how the data currently looks. What I am asking is to only calculate the delta for the events directly after the event with the new status (bolded event). So basically, I want the first modified event directly after the event was first created. Difference.......Difference Duration.........First Createdby Date.........First Modifiedby Date...........Status 0.000...................00:00:00.000.....................1554766782.......................1554766782...................New 66383.000...........18:26:23.000.....................1554766782.......................1554833165..................*(null)* 67674.000...........18:47:54.000.....................1554766782.......................1554834456...................(null)

ryhluc01 · ‎04-23-2019

What are you asking? What should your query or data should look like. Are you trying to locate those patterns (regex or rex)? Replace things (rex)? What do you mean when you say regex variance? Are you trying to test your pattern to see if it will work on your data? Just in case: SSN regex: \d{3}-\d{2}-\d{4} Testing sites I use: https://regex101.com/ https://regexr.com/3f4vo (Engine needs to be changed to PCRE) I need more information before I can help you with your query.

ryhluc01 · ‎04-23-2019

Good Morning Everyone, Is it possible to use delta with a conditional statement? As in: Only give me the delta p=1 if field1=xyz Thank you in advance This is how the data currently looks. I only want the delta between the very first event with a new status and the event that immediately follows it. The result can be output to a new field. So in essence: If the status is new then I want the delta between that event and the event immediately after it (# 1 & 2 in the example) Difference.......Difference Duration.........First Createdby Date.........First Modifiedby Date...........Status 0.000...................00:00:00.000.....................1554766782.......................1554766782...................New 66383.000...........18:26:23.000.....................1554766782.......................1554833165..................*(null)* 67674.000...........18:47:54.000.....................1554766782.......................1554834456...................(null) I only want the delta between the very first event with a new status and the event that immediately follows it. The result can be output to a new field. So in essence: If the status is new then I want the delta between that event and the event immediately after it (# 1 & 2 in the example)

ryhluc01 · ‎04-17-2019

Hello : ) can you select @justinatpnnl 's answer?

ryhluc01 · ‎04-16-2019

The -1 @ the end is recapturing the second result instead of the last. To fix this just remove the "-" in the last eval.

ryhluc01 · ‎04-16-2019

Can you close out this question by choosing @493669 answer?

ryhluc01 · ‎04-11-2019

Did the answer above work for your query?

ryhluc01 · ‎04-09-2019

You're going to have to use a negative assertion. example: (?!.*"fill in the blank here") the quantifier will search for all instances. My response is very late so for more info just respond to this comment. Hope you found an answer.

ryhluc01 · ‎03-07-2019

Thanks Everyone!

ryhluc01 · ‎03-07-2019

I'll give this a shot...one moment.

ryhluc01 · ‎03-07-2019

@woodcock Thank you and you're right! How did I do that 😄 Its fixed. I think I just comb through so many forum posts a day lol.

ryhluc01 · ‎03-07-2019

Hey Everyone, So the corrections from @niketnilay & @woodcock were perfect. Is there anyway to keep my original values for everything else that does not meet the case conditions? That is what I was trying to achieve with the count @ the end of the syntax.

ryhluc01 · ‎03-06-2019

Error in 'eval' command: The expression is malformed. Expected ).

Posts	68
Solutions	3
Karma Given	180
Karma Received	6
Member Since	‎12-19-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

All fields are duplicate & MV. Needs to be single ...

Delta Conditional Statement?

What's wrong with my eval case statement?

What does stats partitions do?

How do I get an Xyseries to display dates in desce...

Grouping field names together from a pivot table w...

How do you return a table of a value by a departme...

Can you help me search to return results even if t...

Alert trigger condition token

Custom alert trigger condition for passing time am...

Re: timechart OTHER column

Re: Merge two fields into one field

Re: Splunkforwarder : System time went forwards by...

Re: All fields are duplicate & MV. Needs to be sin...

Re: All fields are duplicate & MV. Needs to be sin...

Re: Dashboard not loading with default time

Re: Restrict Search Terms

All fields are duplicate & MV. Needs to be single ...

Re: How to remove duplicate events if all data is ...

Re: Delta Conditional Statement?

Re: Delta Conditional Statement?

Re: Delta Conditional Statement?

Re: Delta Conditional Statement?

Re: _audit search for regex's

Delta Conditional Statement?

Re: How do I find the difference in time between t...

Re: mvexpand multiple fields

Re: mvexpand multiple fields

Re: Comparing results of subsearch and main search

Re: Complex Regex, HELP!

Re: What's wrong with my eval case statement?

Re: What's wrong with my eval case statement?

Re: What's wrong with my eval case statement?

Re: What's wrong with my eval case statement?

Re: What's wrong with my eval case statement?