About splunkton

splunkton · ‎07-19-2016

[|inputlookup trusted_users.csv|table names|rename names as user] replace the names in the table statement with user 🙂

splunkton · ‎07-12-2016

SPL command are the commands to process and parse the data.... To best of my knowledge there is no SPL command to do so....... With the help of script, you can call the dash board in a web page using SDK's...

splunkton · ‎07-11-2016

Logically you can do that by appending.... but practically your report going to end up clumsy state mixing of all the events in a single report. Difficult to understand...

splunkton · ‎07-11-2016

Does the field appears in raw data?

splunkton · ‎07-11-2016

I am not sure.. There is a option PDF schedule delivery. You can save your search as dashboard panel view and in the settings on the top right corner and schedule PDF delivery. When define the CRON scheduler, it runs the dash boards view of the search and email it you. This is the one of the option you can opt for .

splunkton · ‎07-11-2016

Developer license is a liecense with 10 GB of daily indexing Full enterprise features Free trial for 6 months

splunkton · ‎07-11-2016

If you want to use case statement this may helps search | eval newfield=case(field1=field2,1,1=1,0)

splunkton · ‎05-26-2016

Try this index=pupi (some rex extractions)|eval wanted=case(Custome_id=JOHN,"OK" ,Custome_id=JOHN,"OK" ,Custome_id=JOHN,"OK" ,Custome_id=JOHN,"OK" ,Custome_id=JOHN,"OK" ,Custome_id=JOHN,"OK" ,1=1,"notok"|search wanted="OK" |chart count by customer_id, name_EVENTS

splunkton · ‎05-25-2016

solution can be found here Try this

splunkton · ‎05-24-2016

try this | tstats latest(_time) as latest by index |eval converttime=strftime(latest,"%m/%d/%y %H:%M:%S")|fields index converttime

splunkton · ‎05-24-2016

Give a shot hope fully it solves your query index=* | eval latest=now()|table index latest converttime |eval converttime=strftime(latest,"%m/%d/%y %H:%M:%S") |dedup index latest

splunkton · ‎05-23-2016

base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP] --> it returns the results matching with the event and the lookup table to derive city from the lookup table |lookup lookup.csv SubnetIP AS IP OUTPUT CITY The total search query is going to be base search [|inputlookup lookup.csv|rename SubnetIP AS IP|table IP]||lookup lookup.csv SubnetIP AS IP OUTPUT CITY | table Date URL IP City

Posts	12
Solutions	2
Karma Given	3
Karma Received	8
Member Since	‎05-23-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: How to edit my search to display users from my...

Re: SPL command to redirect to a dashboard?

Re: Is it possible to include the output of multip...

Re: How to find where an extracted field was creat...

Re: What is the best way to generate and download ...

Re: Licensing: Difference between Dev license and ...

Re: Can I use an eval if statement to create a new...

Re: How do I only show some fields values in my ch...

Re: How to convert a time field in with the format...

Re: Is there a fast way to search all indexes to l...

Re: Is there a fast way to search all indexes to l...

Re: How to write a search to output results where ...