I have a table of data that is clustered via KMeans, I am trying to filter down to only display the other items in a particular cluster, but since the cluster number is done on the fly, this is proving to be difficult. index=blah | stats count by something, device | fit PCA k=2 h_fields | fit KMeans k=10 PC_* | table cluster PC_* device h_fields This will give the info I am looking for, but I only want to filter to view the other items in a single cluster, I know what device ahead of time, but I don't know the cluster number to look for until after the table renders. Basically want to only find other data in the same cluster. I've been trying to do something like " | search [ search device="myDevice" | return 1 cluster=cluster] " but that does not seem to work.... ... View more

Howdy folks, I've got a saved search that has 4 emails specified in action.email.to. This is correct looking in the saved search edit portion of splunk web, and the advanced edit. If I query for the saved search via the REST API, the addresses are correct. I have a script that grabs the value of action.email.to for the given saved search, and then append another email address, and posts to the appropriate url. This seems to work just fine. If I do a GET against the saved search, it displays 5 email addresses. However in Splunk Web, the saved search only displays the 4 addresses, as well as only 4 addresses in the advanced edit under action.email.to. If I check the savedsearches.conf, it has the 4 addresses....I've tried _bump, debug/reset, and restarting splunk, API still displayed 5 addresses, but 4 everywhere else. What gives? ... View more

Howdy folks, I have a question around using map. I have a large query that essentially generate the the following table: id, title, stuff 1, title-1, stuff-1 2, title-2, stuff-2 3, title-3, stuff-3 I have a macro that takes an id, does some computation and applies a ML (Machine Learning) model and spits out a field, all by itself called "data". Due to the transforms and computations applied in the macro, the id is not retained, solely the "data" field. I'm experimenting with map, to try and pass $id$ to the macro, and append the "data" field to the table. It appears map has a hard time interpreting $id$ unless I use appendpipe to the following tune: \previous search\ | table id title stuff | appendpipe [ map [ search \`myMacro($id$)\`]] which outputs this : id, title, stuff, data 1, title-1, stuff-1, 2, title-2, stuff-2, 3, title-3, stuff-3, , , , data-1 , , , data-2 , , , data-3 So rather than the field being appended to the current row, it seems to be getting appended to the bottom of the table. I realize that if the macro would return the id, that stats would probably fix this, however, this is the challenge.... Any help would be appreciated, I've gone back and forth with trying to make map search=search... vs appendpipe and can't seem to get the return of the macro to append as a column inline as opposed to new rows.... Thanks... ... View more