About alc2019

alc2019 · ‎05-10-2019

Thank you very much.

alc2019 · ‎05-10-2019

I was trying to apply the answer from this good post, but I cannot make it work. The coalesce results only one side. I want to count each time a host appears on either source_host or destination_host. https://answers.splunk.com/answers/524250/how-to-search-for-matches-in-two-different-searche.html link text

alc2019 · ‎05-08-2019

My data is from the same source but I would like to count the number of times a host appears on the event based on two fields criteria. How can I do that without hitting search limit? index=my_index source=my_source (source_host=remote* OR dest_host=remote*) | eval name=coalesce(source_host,dest_host) | stats count by name Thank you very much!

alc2019 · ‎05-08-2019

Thank you very much! After some time I was able to convert the time to my desired _time. The only issue is that there is no difference on the data output everytime I use the time picker to search data based on time. | inputlookup MYDATA.csv | rename "Call Start Date" as Call_Start_Date "Call Start Time" as Call_Start_Time | eval cduration_sec = round('Call Duration Minutes'*60, 0) | eval "Call Duration(hh:mm:ss)" = tostring(cduration_sec, "duration") | eval Time_With_TZ=Call_Start_Time+" BST" | eval Date_Time=Call_Start_Date." ".Time_With_TZ | eval _time=strptime(Call_Start_Date." ".Time_With_TZ,"%Y-%m-%d %H:%M:%S%Z") | eval Epoch_Time=_time | convert timeformat="%m-%d-%y %H:%M:%S" mktime(Epoch_Time) | eval Time= strftime(Epoch_Time, "%+") | table _time field1 field2 ... | sort 0 -time

alc2019 · ‎03-23-2019

Hi, How do I convert two fields (date and time) from a lookup table to _time? I would like to use it to create time chart. I tried this, but it doesn't show the correct _time. | inputlookup mylookup.csv | stats count as _time by fieldx | timechart span=1d count(fieldx) Sample data from CSV file: Date,Time 01-01-19,0:03:52 01-01-19,4:15:46 01-01-19,14:11:53 Needed as _time like, 3/24/19 12:25:37.000 AM 01/01/19 00:03:52.000 AM 01/01/19 04:15:46.000 AM 01/01/19 02:11:53.000 PM Thank you very much.

alc2019 · ‎03-14-2019

Perfect - works! Thank you

alc2019 · ‎03-14-2019

Hi Renjith, Thanks for the help but it will not work on my case as those devices register multiple times in a day and I have to count the registration based on their latest registration time. Thanks

alc2019 · ‎03-13-2019

Hi, I'm doing a device count based on device latest time event registration. I'm getting the correct device registration count here on a single value (ex. 1000 count) filed but with no trending: index.... ... earliest=-1mon | stats count latest(_time) as last_update by device_name EventType | search EventType="Registered" | stats count(device_name) as Device_Count by last_update I would like create a single value visualization to show trend of device registration compared to 2 weeks ago count. I tried the following but I'm not getting the same count as my device registration. index.... ... earliest=-1mon | stats count latest(_time) as last_update by device_name EventType _time | search EventType="Registered" | stats count(device_name) as Device_Count by last_update | timechart span=2w count(Device_Count) How can I fix this to show trend of the correct count of registered devices compared to 2-weeks ago?

alc2019 · ‎02-28-2019

Perfect! It works. Thank you very much.

alc2019 · ‎02-28-2019

Thank you! What does the "|" mean?

alc2019 · ‎02-28-2019

Hi Experts, How can I get events on a numeric field where a 7 digit number begins with 11? I tried with ...my search... field=="11*" but it is not matching all the numbers. Sample data: 1166538 1212345 1116934 3331234 6037211,1166000 6037233,6031111 4160309,1118905 7031671,1117162 1186934,7038716 8016102,1187282 1176438,5254111,8925627 1175538,5254112,8925629 5254146,1178001,8925478,8925755 5254125,5268008,8925492,8925785 Events expected to be included containing - any 7-digit-number that begins with 11XXXXX: 1166538 1116934 6037211,1166000 4160309,1118905 7031671,1117162 1186934,7038716 8016102,1187282 1176438,5254111,8925627 5254146,1178001,8925478,8925755 5254125,1168008,8925491,8925755 Thank you very much.

Posts	11
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-28-2019

How to use coalesce without hitting search limit

How do you convert the date field and time field o...

How to create a single value timechart after stats...

How do you get events where the phone number field...

Re: How do you convert the date field and time fie...

Re: How to use coalesce without hitting search lim...