Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About pm771
pm771
Communicator
Member since:
05-26-2016
03-13-2025
Community Statistics
| Posts | 55 |
| Solutions | 1 |
| Karma Given | 44 |
| Karma Received | 7 |
| Member Since | 05-26-2016 |
Activity Feed
- Karma Re: Unexpected behavior of searchmatch function for bowesmana. 03-12-2025 09:46 AM
- Karma Re: Unexpected behavior of searchmatch function for livehybrid. 03-12-2025 09:46 AM
- Got Karma for Re: Unexpected behavior of searchmatch function. 03-12-2025 12:54 AM
- Posted Re: Unexpected behavior of searchmatch function on Splunk Search. 03-11-2025 04:34 PM
- Posted Re: Unexpected behavior of searchmatch function on Splunk Search. 03-11-2025 04:12 PM
- Posted Unexpected behavior of searchmatch function on Splunk Search. 03-11-2025 02:54 PM
- Posted Re: What does <time_unit> default to? on Splunk Search. 02-08-2023 02:41 PM
- Karma Re: What does <time_unit> default to? for ITWhisperer. 02-08-2023 02:41 PM
- Posted What does <time_unit> default to? on Splunk Search. 02-08-2023 07:20 AM
- Tagged What does <time_unit> default to? on Splunk Search. 02-08-2023 07:20 AM
- Karma Re: How to organize search substrings into LookUp tables? for richgalloway. 01-11-2023 01:32 PM
- Posted How to organize search substrings into LookUp tables? on Splunk Search. 01-11-2023 12:11 PM
- Tagged How to organize search substrings into LookUp tables? on Splunk Search. 01-11-2023 12:11 PM
- Karma Re: How can i query to get all alerts which are configured? for woodcock. 07-28-2022 05:58 PM
- Karma Re: How can i query to get all alerts which are configured? for woodcock. 07-28-2022 05:58 PM
- Posted Re: Does a search variable in filter exception within search command require special handling? on Alerting. 07-28-2022 02:43 PM
- Posted Does a search variable in filter exception within search command require special handling? on Alerting. 07-28-2022 09:45 AM
- Karma Re: Follow-up to "How can I query to get all alerts which are configured?" solution for gcusello. 07-28-2022 08:45 AM
- Karma Re: Follow-up to "How can I query to get all alerts which are configured?" solution for gcusello. 07-28-2022 08:45 AM
- Karma Re: Follow-up to "How can I query to get all alerts which are configured?" solution for gcusello. 07-28-2022 08:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
03-11-2025
04:34 PM
1 Karma
I've been offered to replace searchmatch() with match(). | makeresults 1
| eval _raw="ONE TWO THREE"
| eval result=if(searchmatch("ONE THREE"), 1, 0)
| eval garbage=if(searchmatch("ONE WHATEVER THREE"), 1, 0)
| eval matching=if(match(_raw, "ONE THREE"), 1, 0) Seems to be more readable than escaped quotation marks.
... View more
03-11-2025
04:12 PM
The original problem was discovered with Splunk alert that had all proper fields. I created this small script just to demonstrate the issue without a need for real data.
... View more
03-11-2025
02:54 PM
We use Enterprise Splunk Version: 9.1.6 I have noticed a strange behavior of searchmatch() function. | makeresults
| eval fieldstring="ONE TWO THREE"
| eval result=if(searchmatch("THREE TWO"), 1, 0) After the run result equals to 1. Why is it not looking for complete literal string and performing "THREE" AND "TWO" instead?
... View more
Labels
- Labels:
-
other
02-08-2023
02:41 PM
I tried index=
earliest=-600@m
| stats max(_time) as maxT min(_time) as minT
| eval maxtime=strftime(maxT,"%Y-%m-%dT%H:%M:%S.%Q"), mintime=strftime(minT,"%Y-%m-%dT%H:%M:%S.%Q") and got back 10 min of events as expected based on your explanation.
... View more
02-08-2023
07:20 AM
Because of a typo we had the following in our query: earliest=-1@d Since Splunk query actually ran I assumed that some kind of default value had been used. I could not find such details in docs.
... View more
- Tags:
- search
01-11-2023
12:11 PM
Hello I have a Splunk query that looks like following: index=something "*abc*" OR "*def*" OR "*hig*" These substrings do not belong to particular fields. Is there a way to put them in a lookup table? If they were field values, I would've done something like: index=something
[| inputlookup My.csv | fields FieldName | format]
... View more
Labels
- Labels:
-
lookup
07-28-2022
02:43 PM
@richgalloway I understand that. My question was specific to search field that that is a part of REST call return. Is REST call similar to sub-search in regards to the special meaning of search field? Like something similar to https://community.splunk.com/t5/Splunk-Search/Subsearch-fields-quot-query-quot-quot-search-quot-How-do-I-know/m-p/62422?
... View more
07-28-2022
09:45 AM
This is my 2nd follow-up regarding this solution: https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/m-p/...
My question now is about the search field (that contains the actual Splunk query behind each alert). Does this field require any special handling? If I need to use this field for filtering purposes inside a search command, would it be different than using any other field like title. Or can I simply use something like following:
|rest/servicesNS/-/-/saved/searches | search alert.track=1 AND title="prefix*" AND search="index=someindex*"
... View more
07-27-2022
11:59 AM
When I have used the first query (all Apps) I got the desired result. Not sure why since all alerts belong to the same app and my URL included it.
... View more
07-27-2022
10:02 AM
Hello @gcusello , I was referring to in-built filtering into "Alerts" interface.
... View more
07-24-2022
05:33 PM
Hello @gcusello , Yes, I can get to Alerts listing. I was not able to apply a compound filter there. Something with AND / OR expressions with various fields. Is it even possible? Thank you.
... View more
My question is about this solution: https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/m-p/288846#M9051 I do not have Admin rights. When I run this query I get the following warning: "Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability". In the result I get only a partial listing. Anything I can do besides engaging admins to run the query for me? We use Splunk Enterprise Version: 8.2.1
... View more
06-30-2022
02:28 PM
@HappySplunker Your solution simplifies OP's requirements. You made an assumption that name="count" for every event. This is not the case.
... View more
- Tags:
- search
11-09-2021
07:52 AM
@richgalloway I understand ID=* part. Why would I needs fields before stats? Can you please explain?
... View more
11-08-2021
01:55 PM
We have a relatively small set of devices that emit daily in the vicinity of a million events each. Each device has unique ID (Serial #) which is included in events. What would be an efficient method of collecting a list of unique IDs? index=abc | stats count by ID index=abc | stats values(id) as IDs | mvexpand IDs index-abc | fields ID | dedup ID Anything else?
... View more
08-21-2021
09:36 AM
Hello, I noticed that ... WHERE somefield = string1 OR string2 works the same way as ... WHERE somefield = string1 OR somefield=string2 Why is it so? How OR works with strings?
... View more
Labels
- Labels:
-
fields
09-24-2020
07:08 PM
[Following up with my own solution] I ended up with creating a dummy 2nd column. HDate Off 1/1/2020 Y ................... Y And with a slight change (used new column as returned value) my code started working: search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y")
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")
... View more
09-24-2020
06:54 PM
What I meant was: | makeresults
| eval i1=if(null==null, "true", "false")
| eval i2=if(null!=null, "true", "false") The return will be false and false.
... View more
09-24-2020
06:24 PM
1 Karma
Do I understand correctly that NULL is neither equal (==) nor not equal (!=) to any value? I know about isnull() function, but was under (apparently wrong) impression that NULL is not equal to everything else. Illustration: | makeresults
| eval N=null
| eval i1=if(isnull(N), "N", "Y")
| eval i2=if(N != "Y", "N", "Y") Result: i1 i2 N Y Is it fully documented?
... View more
- Tags:
- null
09-09-2020
06:17 AM
It was a typo in my question. Month and day in my table are without leading zeroes. Since the table is going to be maintained via Excel, I had to use the default date format. I will update the question.
... View more
09-08-2020
07:29 PM
I have a lookup CSV table that lists dates of holidays in a single column. HolidayTable.csv: HDate 1/1/2020 ................... I tried to use the following: search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y")
| lookup HolidayTable.csv HDate as currentdate OUTPUT HDate as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y") My expectation was that when the current date matches a row in the table I will get the date string and otherwise - null. It does not seem to work this way. What am I missing here?
... View more
Labels
- Labels:
-
lookup
08-20-2020
05:07 PM
My question is about day and month components of a date without leading zeroes. Python docs provide %-d and %-m respectively. Splunk docs do not show these options. Splunk, however, has %e which seems to be the same as %-d. I did not find any option for decimal month number. I have tried and Splunk seems to accept %-d and %-m Is it standard feature that I can rely on? Is it implementation dependent? Did I miss something in Splunk docs?
... View more
08-11-2020
07:49 PM
@to4kawa , Thank you. It works. Since I'm dealing with relatively large data sets I stumbled into 10,000 limit on sort. So, I used sort 0 _time.
... View more
08-11-2020
04:20 PM
I have an index where each event has unique EventID and Status fields. Each event is progressing through multiple interim statuses until it reaches one of the two terminal statuses: SUCCESS or FAILURE. Each event goes through a subset of all possible interim statuses. I'm trying to build a timechart that would show two counts: All Failed Events and Failed Events with a certain Interim Status. One of the problems is that a preceding interim event could be outside of the span interval. I was thinking something along these lines (not necessarily syntactically correct): index=... sourcetype=... Status IN ("FAILURE", "INTERIM")
| timechart span=5m count by EventId
| untable _time eventCount
| stats count as "All" count(eval(EventCount==2)) as "With Interim" by _time
... View more
08-11-2020
08:26 AM
@sowings , Just wonder why you used 1=1 and not true(). Is one approach better than another?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-13-2025
01:16 AM
|
Karma from
Karma given to
