About pm771

pm771 · ‎03-11-2025

I've been offered to replace searchmatch() with match(). | makeresults 1 | eval _raw="ONE TWO THREE" | eval result=if(searchmatch("ONE THREE"), 1, 0) | eval garbage=if(searchmatch("ONE WHATEVER THREE"), 1, 0) | eval matching=if(match(_raw, "ONE THREE"), 1, 0) Seems to be more readable than escaped quotation marks.

pm771 · ‎03-11-2025

The original problem was discovered with Splunk alert that had all proper fields. I created this small script just to demonstrate the issue without a need for real data.

pm771 · ‎03-11-2025

We use Enterprise Splunk Version: 9.1.6 I have noticed a strange behavior of searchmatch() function. | makeresults | eval fieldstring="ONE TWO THREE" | eval result=if(searchmatch("THREE TWO"), 1, 0) After the run result equals to 1. Why is it not looking for complete literal string and performing "THREE" AND "TWO" instead?

pm771 · ‎02-08-2023

I tried index= earliest=-600@m | stats max(_time) as maxT min(_time) as minT | eval maxtime=strftime(maxT,"%Y-%m-%dT%H:%M:%S.%Q"), mintime=strftime(minT,"%Y-%m-%dT%H:%M:%S.%Q") and got back 10 min of events as expected based on your explanation.

pm771 · ‎02-08-2023

Because of a typo we had the following in our query: earliest=-1@d Since Splunk query actually ran I assumed that some kind of default value had been used. I could not find such details in docs.

pm771 · ‎01-11-2023

Hello I have a Splunk query that looks like following: index=something "*abc*" OR "*def*" OR "*hig*" These substrings do not belong to particular fields. Is there a way to put them in a lookup table? If they were field values, I would've done something like: index=something [| inputlookup My.csv | fields FieldName | format]

pm771 · ‎07-28-2022

@richgalloway I understand that. My question was specific to search field that that is a part of REST call return. Is REST call similar to sub-search in regards to the special meaning of search field? Like something similar to https://community.splunk.com/t5/Splunk-Search/Subsearch-fields-quot-query-quot-quot-search-quot-How-do-I-know/m-p/62422?

pm771 · ‎07-28-2022

This is my 2nd follow-up regarding this solution: https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/m-p/... My question now is about the search field (that contains the actual Splunk query behind each alert). Does this field require any special handling? If I need to use this field for filtering purposes inside a search command, would it be different than using any other field like title. Or can I simply use something like following: |rest/servicesNS/-/-/saved/searches | search alert.track=1 AND title="prefix*" AND search="index=someindex*"

pm771 · ‎07-27-2022

When I have used the first query (all Apps) I got the desired result. Not sure why since all alerts belong to the same app and my URL included it.

pm771 · ‎07-27-2022

Hello @gcusello , I was referring to in-built filtering into "Alerts" interface.

pm771 · ‎07-24-2022

Hello @gcusello , Yes, I can get to Alerts listing. I was not able to apply a compound filter there. Something with AND / OR expressions with various fields. Is it even possible? Thank you.

pm771 · ‎07-22-2022

My question is about this solution: https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/m-p/288846#M9051 I do not have Admin rights. When I run this query I get the following warning: "Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability". In the result I get only a partial listing. Anything I can do besides engaging admins to run the query for me? We use Splunk Enterprise Version: 8.2.1

pm771 · ‎06-30-2022

@HappySplunker Your solution simplifies OP's requirements. You made an assumption that name="count" for every event. This is not the case.

pm771 · ‎11-09-2021

@richgalloway I understand ID=* part. Why would I needs fields before stats? Can you please explain?

pm771 · ‎11-08-2021

We have a relatively small set of devices that emit daily in the vicinity of a million events each. Each device has unique ID (Serial #) which is included in events. What would be an efficient method of collecting a list of unique IDs? index=abc | stats count by ID index=abc | stats values(id) as IDs | mvexpand IDs index-abc | fields ID | dedup ID Anything else?

pm771 · ‎08-21-2021

Hello, I noticed that ... WHERE somefield = string1 OR string2 works the same way as ... WHERE somefield = string1 OR somefield=string2 Why is it so? How OR works with strings?

pm771 · ‎09-24-2020

[Following up with my own solution] I ended up with creating a dummy 2nd column. HDate Off 1/1/2020 Y ................... Y And with a slight change (used new column as returned value) my code started working: search ... | eval currentdate=strftime(now(),"%-m/%-d/%Y") | lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday | eval Holiday=if(isnull(Holiday), "N", "Y")

pm771 · ‎09-24-2020

What I meant was: | makeresults | eval i1=if(null==null, "true", "false") | eval i2=if(null!=null, "true", "false") The return will be false and false.

pm771 · ‎09-24-2020

Do I understand correctly that NULL is neither equal (==) nor not equal (!=) to any value? I know about isnull() function, but was under (apparently wrong) impression that NULL is not equal to everything else. Illustration: | makeresults | eval N=null | eval i1=if(isnull(N), "N", "Y") | eval i2=if(N != "Y", "N", "Y") Result: i1 i2 N Y Is it fully documented?

pm771 · ‎09-09-2020

It was a typo in my question. Month and day in my table are without leading zeroes. Since the table is going to be maintained via Excel, I had to use the default date format. I will update the question.

pm771 · ‎09-08-2020

I have a lookup CSV table that lists dates of holidays in a single column. HolidayTable.csv: HDate 1/1/2020 ................... I tried to use the following: search ... | eval currentdate=strftime(now(),"%-m/%-d/%Y") | lookup HolidayTable.csv HDate as currentdate OUTPUT HDate as Holiday | eval Holiday=if(isnull(Holiday), "N", "Y") My expectation was that when the current date matches a row in the table I will get the date string and otherwise - null. It does not seem to work this way. What am I missing here?

pm771 · ‎08-20-2020

My question is about day and month components of a date without leading zeroes. Python docs provide %-d and %-m respectively. Splunk docs do not show these options. Splunk, however, has %e which seems to be the same as %-d. I did not find any option for decimal month number. I have tried and Splunk seems to accept %-d and %-m Is it standard feature that I can rely on? Is it implementation dependent? Did I miss something in Splunk docs?

pm771 · ‎08-11-2020

@to4kawa , Thank you. It works. Since I'm dealing with relatively large data sets I stumbled into 10,000 limit on sort. So, I used sort 0 _time.

pm771 · ‎08-11-2020

I have an index where each event has unique EventID and Status fields. Each event is progressing through multiple interim statuses until it reaches one of the two terminal statuses: SUCCESS or FAILURE. Each event goes through a subset of all possible interim statuses. I'm trying to build a timechart that would show two counts: All Failed Events and Failed Events with a certain Interim Status. One of the problems is that a preceding interim event could be outside of the span interval. I was thinking something along these lines (not necessarily syntactically correct): index=... sourcetype=... Status IN ("FAILURE", "INTERIM") | timechart span=5m count by EventId | untable _time eventCount | stats count as "All" count(eval(EventCount==2)) as "With Interim" by _time

pm771 · ‎08-11-2020

@sowings , Just wonder why you used 1=1 and not true(). Is one approach better than another?

Posts	55
Solutions	1
Karma Given	44
Karma Received	7
Member Since	‎05-26-2016

Online Status	Offline
Date Last Visited	‎03-13-2025 01:16 AM

Unexpected behavior of searchmatch function

What does <time_unit> default to?

How to organize search substrings into LookUp tabl...

Does a search variable in filter exception within ...

Follow-up to "How can I query to get all alerts wh...

Getting a list of unique IDs from a large data set...

How does OR work with strings?

Comparing with NULL

Using single column Holiday table how do I determi...

strftime day and month: Splunk vs Python

Re: Unexpected behavior of searchmatch function

Re: Unexpected behavior of searchmatch function

Unexpected behavior of searchmatch function

Re: What does <time_unit> default to?

What does <time_unit> default to?

How to organize search substrings into LookUp tabl...

Re: Does a search variable in filter exception wit...

Does a search variable in filter exception within ...

Re: Follow-up to "How can I query to get all alert...

Re: Follow-up to "How can I query to get all alert...

Re: Follow-up to "How can I query to get all alert...

Follow-up to "How can I query to get all alerts wh...

Re: Read a field value which field name is in anot...

Re: Getting a list of unique IDs from a large data...

Getting a list of unique IDs from a large data set...

How does OR work with strings?

Re: Using single column Holiday table how do I det...

Re: Comparing with NULL

Comparing with NULL

Re: Using single column Holiday table how do I det...

Using single column Holiday table how do I determi...

strftime day and month: Splunk vs Python

Re: How to use the existence of a preceding event ...

How to use the existence of a preceding event in t...

Re: case: defaulting to "value" rather than NULL