×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
cjohnk
Explorer
Member since: ‎02-26-2019
‎06-12-2024
Community Statistics
Posts 5
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎02-26-2019
Activity Feed
View All

Multiple operations from a single if condition

by in Splunk Search
‎06-12-2024 04:00 PM
‎06-12-2024 04:00 PM
Is it possible to action multiple operations in a single if condition, like what can be done in other languages? For example, in other scripting languages this can be done:   if(field==1){ group=group+1; groups=groups+","+group; } else { //this is a comment, do nothing }   How can this be done in splunk? ... View more
Labels

Re: How to prevent getting an error using brackets...

by in Dashboards & Visualizations
‎12-02-2019 03:15 PM
‎12-02-2019 03:15 PM
I had to replace less than and greater than signs with the following & l t ; and & g t ; (Without spaces) (?P & l t ; accountname & g t ; .*) https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/OverviewofSimplifiedXML ... View more

Re: Why is my dashboard reporting error "Node sear...

by in Dashboards & Visualizations
‎11-21-2019 05:29 PM
‎11-21-2019 05:29 PM
Can you please expand on that? I am also having this issue, but it's not due to a misspelling, that I can see. The error is on the following line: <search index="windows" Account_Name="$Locked_Out_Account_Name$" EventCode="4624"> If I change the <search index= to <search ref= than it works fine. However, I want to perform a direct search here because I want to reference the previously created variable $Locked_Out_Account_Name$ . Perhaps there's a way to push the variable in a referenced report and search with it there? Here's the full code: <form refresh="60"> <label>Account PC (Test 11.21) Dashboard</label> <description>Blah.</description> <fieldset submitButton="false"> <input type="dropdown" token="Locked_Out_Account_Name" searchWhenChanged="true" depends="$justHideMe$"> <label>Locked_Out_Account_Name</label> <search ref="Account PC (Test 11.21) Report"> <earliest>-1h</earliest> <latest>now</latest> </search> <fieldForLabel>Locked_Out_Account_Name</fieldForLabel> <fieldForValue>Locked_Out_Account_Name</fieldForValue> <selectFirstChoice>true</selectFirstChoice> </input> </fieldset> <row> <panel> <html> <font size="5"> <body1>Last Refresh Time</body1> <body2>$time$</body2> <body3>$Locked_Out_Account_Name$</body3> </font> <style> table thead tr th, td{ font-size:175% !important; } </style> </html> <table> <title>Account PC (Test 11.21) Report</title> <search ref="Account PC (Test 11.21) Report"> <done> <eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval> </done> <earliest>-1h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> ... View more

Re: How to rename unknown field names from inputlo...

by in Splunk Search
‎08-26-2019 10:45 PM
‎08-26-2019 10:45 PM
Running | inputlookup table2.csv gives me a field named "output" with a list of ID's under it. However, I cannot be looking up the field value each time as it will change. I'm creating a dashboard with a basic functionality which is called Merge Lookup Table. A user will enter the name of two tables, one in each input text box, and it should merge the tables into a single column. Everything needs to be done through the input box variables; a user should not need to know the field name. The below will give me the field name |inputlookup table2.csv |fieldsummary | fields field In my dashboard, I changed the table name from above query to the variable from the input box and that also gives me the field name of the table. |inputlookup $mergedtable$ |fieldsummary | fields field But I cannot seem to assign the result of that query as a variable or use it in a function such as: |rename [|inputlookup table2.csv |fieldsummary | fields field] as name I get the following error: Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+ I've tried at least 30 different variations of queries and all receive errors or don't combine the two tables into a single column. ... View more

How to rename unknown field names from inputlookup...

by in Splunk Search
‎08-26-2019 04:51 PM
‎08-26-2019 04:51 PM
I want to merge multiple fields from multiple lookup tables into a single field/column. I only know the name of the field in table1.csv and not the name of the field in the appended table. Unfortunately, the below does not work as rename will not take * by itself. I have no idea what the field name will be in the appended table, though, I will know the table name. | inputlookup table1.csv | append [| inputlookup table2.csv | rename * as name] If table1.csv and table2.csv have the exact field names, then the below works, but that won't be the case in my situation. In my situation, doing so will create two columns and not one merged column. | inputlookup table1.csv | append [| inputlookup table2.csv] ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-12-2024 08:36 PM
Karma given to
View All