Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About paulkrier
paulkrier
Engager
Member since:
02-13-2015
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 02-13-2015 |
Activity Feed
- Karma Re: How can I select the maximum X values in a field based on another field? for thambisetty. 06-05-2020 12:49 AM
- Posted Re: How can I select the maximum X values in a field based on another field? on Splunk Search. 07-24-2018 11:09 AM
- Posted Re: How can I select the maximum X values in a field based on another field? on Splunk Search. 07-24-2018 11:04 AM
- Posted Re: How can I select the maximum X values in a field based on another field? on Splunk Search. 07-24-2018 11:02 AM
- Posted How can I select the maximum X values in a field based on another field? on Splunk Search. 07-24-2018 09:54 AM
- Tagged How can I select the maximum X values in a field based on another field? on Splunk Search. 07-24-2018 09:54 AM
- Tagged How can I select the maximum X values in a field based on another field? on Splunk Search. 07-24-2018 09:54 AM
- Tagged How can I select the maximum X values in a field based on another field? on Splunk Search. 07-24-2018 09:54 AM
- Tagged How can I select the maximum X values in a field based on another field? on Splunk Search. 07-24-2018 09:54 AM
- Posted Re: Why don't I see match_type in Lookup Definition Advanced options on Knowledge Management. 07-12-2018 08:23 AM
- Posted Re: Why don't I see match_type in Lookup Definition Advanced options on Knowledge Management. 07-12-2018 05:41 AM
- Posted Re: Why don't I see match_type in Lookup Definition Advanced options on Knowledge Management. 07-11-2018 03:13 PM
- Posted Why don't I see match_type in Lookup Definition Advanced options on Knowledge Management. 07-11-2018 12:06 PM
- Tagged Why don't I see match_type in Lookup Definition Advanced options on Knowledge Management. 07-11-2018 12:06 PM
Topics I've Started
07-24-2018
11:09 AM
Brilliant! I didn't know dedup took the number of dups to keep. Thanks.
... View more
07-24-2018
11:04 AM
top returns the most common values not the max values. If you add additional 2:4 to the test data then 2:4 replaces 2:8 in the results. Thanks though. The code to create the test table is really useful.
... View more
07-24-2018
11:02 AM
I don't think the sort command supports the by keyword. At least not in 6.5.4 which is what I am on.
... View more
07-24-2018
09:54 AM
I have a data set that looks like this:
X Y
1 5
1 4
1 3
1 2
1 1
2 10
2 9
2 8
2 4
I would like to select the maximum 3 values in Y for each value of X:
X Y
1 5
1 4
1 3
2 10
2 9
2 8
I'm looking at sort and top, sort allows me to sort on each field, but the count argument seems to only work on the total number of results returned. Top is looking for the most common values, not the maximum values. Am I missing something?
Thanks,
pk
... View more
07-12-2018
08:23 AM
Thanks so much for the info. At least I know where I stand. I have also found through a little experimenting in the UI that the match_type parameter is not preserved when I clone a definition where it is set. That seems like a bug to me...
... View more
07-12-2018
05:41 AM
So the only way to do this in versions prior to 7 is to manually edit that transform.conf file? Is a match_type of CIDR supported in 6.5 and just not available via the UI or is the feature absent altogether?
... View more
07-11-2018
03:13 PM
Power User
... View more
07-11-2018
12:06 PM
I'm running Splunk 6.5. I see Min Matches, Max Matches, and Default Matches. I would like to define a lookup table that uses CIDR ranges. Is this a permissions issue, a version issue, or a configuration issue? I've see screen shots that suggest their should be match_type field in advanced options. I don't have access to modify transforms.conf directly.
Thanks.
pk
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
