Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pratibha0610
pratibha0610
Explorer
Member since:
02-05-2019
01-16-2023
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 02-05-2019 |
Activity Feed
- Karma Re: matching fields from 3 different sources. for ITWhisperer. 01-16-2023 08:02 AM
- Posted Matching fields from 3 different sources? on Splunk Search. 01-16-2023 03:42 AM
- Posted Re: Join using multiple source type. But result is still coming blank on Splunk Search. 08-04-2022 05:02 AM
- Karma Re: Join using multiple source type. But result is still coming blank for ITWhisperer. 08-04-2022 05:02 AM
- Posted Why are results still coming back blank after using join using multiple source type? on Splunk Search. 08-04-2022 02:53 AM
- Tagged Why are results still coming back blank after using join using multiple source type? on Splunk Search. 08-04-2022 02:53 AM
- Tagged Why are results still coming back blank after using join using multiple source type? on Splunk Search. 08-04-2022 02:53 AM
- Tagged Why are results still coming back blank after using join using multiple source type? on Splunk Search. 08-04-2022 02:53 AM
- Posted Re: How do you compare timestamps from two rows? on Getting Data In. 02-06-2019 12:33 AM
- Posted Re: How do you compare timestamps from two rows? on Getting Data In. 02-05-2019 09:35 AM
- Posted Re: How do you compare timestamps from two rows? on Getting Data In. 02-05-2019 09:24 AM
- Posted How do you compare timestamps from two rows? on Getting Data In. 02-05-2019 06:24 AM
- Tagged How do you compare timestamps from two rows? on Getting Data In. 02-05-2019 06:24 AM
- Tagged How do you compare timestamps from two rows? on Getting Data In. 02-05-2019 06:24 AM
- Tagged How do you compare timestamps from two rows? on Getting Data In. 02-05-2019 06:24 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
01-16-2023
03:42 AM
Hi all,
Could some please help me with this query. I have 3 different sources from which i want to match the fields. I am
Source A contains K_user, ID
Source B contains RECID, USER_RESET
Source C contains USER, NAME
i have do the query in 2 steps
1. Join A and B using ID. (RECID=ID) and get USER_RESET
2. Join the result from step 1 with C. Match K_USER and USER_RESET to get the name from source C.
if i explain using example
Source A
K_USER ID
ABN 1
XYZ 2
Source B
RECID USER_RESET
1. MNP
3. IJK
SOURCE C
USER NAME
ABN John
XYZ Mary
MNP Philip
IJK Cathy
Final result should look like
K_USER | ID | USER_RESET | NAME(K_USER) | NAME(USER_RESET)
ABN 1 MNP John Phillip
Can i achieve this without using join.
Thanks in Advance!!
... View more
Labels
- Labels:
-
join
-
search job inspector
-
stats
-
subsearch
08-04-2022
05:02 AM
@ITWhisperer thanks a lot!! my search worked. I also wanted to check one thing for setting up alert to send mail to Email address popped in result. Will the below solution work? Enable send email alert action and in to: field set $result.Email$
... View more
08-04-2022
02:53 AM
Hi team,
I wonder if someone can help me with the below query. I have a to combine my two searches with join. With first search i get the assignement group and with second search i get email of those assigment group to send alert.
i have common values between two sourcetype but field name is different. in the first serach, field is called dv_name and in second it is called name. Therefore i create name variable before using join. However my field email is still coming blank
serach:
index=production sourcetype=call | eval name=dv_name
| join name type=left
[ index=production sourcetype=mail earliest="04/30/2022:20:00:00" latest=now() | dedup name | stats values (dv_email) values (name) by name]
| eval Email=if(isnull(dv_email), " ", dv_email)
| table dv_name Email
... View more
- Tags:
- join
- search
- sourcetype
Labels
- Labels:
-
join
02-06-2019
12:33 AM
hi,
I have below as my records as my search results. Highlighted ones are unique key. I want compare between the record 1 and 3 , 2 and 4 display the incremented count.
Record 1 null - 2019-02-01T12:55:58.270 - Quename- INL_TTI_01 - Inbound - Process - ABCODSC123245678:Record processed Successfully
Record 2 null - 2019-02-01T12:55:59.270 - Quename- INL_TTI_01 - Inbound - Process - ABCODSC123248888:Record processed Successfully
Record 3 null - 2019-02-01T12:55:58.777 - Quename- INL_TTI_01 - Outbound - Process - ABCODSC123245678:Record processed Successfully
Record 4 null - 2019-02-01T12:55:60.270 - Quename- INL_TTI_01 - Outbound - Process - ABCODSC123248888:Record processed Successfully
Record 5 null - 2019-02-01T12:55:62.270 - Quename- INL_TTI_01 - Outbound - Process - ABCODSC123245678:Record processed Successfully
.
.
.
.
.
n
... View more
02-05-2019
09:35 AM
Hi,
Thanks for the reply. Can I also sort the logs based on the unique key?
... View more
02-05-2019
09:24 AM
Hi richgalloway,
Thanks for the response.
I also need to compare the two records.
The search results in many rows. I use the search index= applicationet sourcetype=Rex
... View more
02-05-2019
06:24 AM
Hi all,
I have a requirement where i have to know if the transaction key is processed within 3 seconds. I need to compare two unique references and take the latest timestamp. For e.g., I have two unique references, "ABC1" and "ABC2", and both of them have multiple records in the logs. I have to take the first timestamp from ABC1 and ABC2, and it should be less than 3 seconds.
Can you all please give me some points which i can follow to complete this requirement?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-16-2023
01:33 PM
|
