Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Learn Splunk
- :
- About jyab6z
jyab6z
Path Finder
Member since:
02-21-2019
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 02-21-2019 |
Activity Feed
- Got Karma for Re: Insert one search into other search as a new column. 06-05-2020 12:50 AM
- Karma Re: Could not find all of the specified lookup fields in the lookup table for wanling. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-28-2019
01:03 AM
Hi @somesoni2,
Development_stage and Product_class could contian both types, actually I wanna join those fields, not sum of those. I have checked the lookup as well, the matched results exist in the table.
... View more
03-21-2019
02:10 AM
1 Karma
Oh, solved my problem 🙂
Used appendcols instead of append.
... View more
03-21-2019
12:54 AM
Hi @DMohn,
Thank you for your tips!
Solved my problem with appendcols command.
... View more
03-20-2019
07:37 AM
Thanks! It works!
... View more
03-26-2019
09:27 AM
can you open another question?
this one is marked accepted to the world so less chances other community members will open it and help
... View more
03-05-2019
12:30 AM
Hi David,
It works! Thank you! I had to add | convert timeformat="%H:%M:%S" dur2sec(Time) before your code in search because I don't use _time, thereafter I used stats count in the end to plot my graph instead.
So, following code works for me, Time is defined by myself:
YourBaseSearch | convert timeformat="%H:%M:%S" dur2sec(Time) | stats count first(Time) AS initialTime last(Time) AS endTime by UserID date levelOne | eval x=endTime-initialTime | where x> YourDefinedValue | stats count by levelOne
Thank you again David and I will accept the answer.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
