About Joshie

Joshie · ‎03-18-2013

I have a XML sourcertype that have multi-values dair across different fieldnames: e.g. starttime, stoptime, instruction My problem is that the "instruction" field is really really long. When I do a table starttime, stoptime, instruction, the looks mis-align. e.g. starttime stoptime instruction 0900 0935 First instruction is to 0930 0940 move the cargo to the east 0940 1020 side of the dock. Second instruction appears not align to the 0930 starttime. Third instruction really needs to the 0940 line. I was hoping I can put each instruction align to the correct starttime. Any help much appreciated! Kind Regards, Joshie

Joshie · ‎02-14-2013

Hi Iguinn, thanks for your response. However, what makes me ask the question is if I restrict to a smaller group (resulting in a smaller "product" range, the label came back. So I am more incline to the limitation of the charting function.

Joshie · ‎02-14-2013

I have created a chart (Bar) with the following: chart count(ProductName) over ProductCalss BY StoreZones Therer were quite a numbner of rows, and there was no problem displat them. However, the X-Axis do not show the ProductName at all. The Y-Label shows the count accurately. What could have caused this? Many thanks! J

Joshie · ‎01-29-2013

Hi I have used ldapsearch to narrow down the list of members based on a specific CN: e.g. |ldapsearch domain="mydom" search="(&(objectclass=group)(|(CN=#R1231)(CN=#R31412)))" attrs="member" The above will yield the list of identidies for each of the identified CN. However, I wanted to use the above the pull more information about the individual identidies e.f. telephone, email, department etc. I was hoping I can pipe it to another ldapsearch command but don't have any progress thus far. Anyone has manage to do nested ldapsearch or have done what I was hoping to before? Thanks for any help!

Joshie · ‎07-27-2012

Hi, we are getting a lot of CheckPoint logs, as compare to other sources, so was wondering if there exists any "best practice" in terms of what getting only what is required rather than the entire set of fields. How can we trimmed off these excessive fields? Do we do it at CheckPoint's end or Splunk's end? Any experience in this area really appreciated! Cheers!

Joshie · ‎06-22-2012

Thanks yannK. That would work if there are only 2 URL. However, if there are multiple URLs: URL_Type_03, URL_Type_04, URL_Type_05, URL_Type_06 etc And we need to identify Account_ID that only access URL_Type_01 AND URL_Type_04, and not others, then the above search won't work then? Cheers! Joshie

Joshie · ‎06-22-2012

I have a list of Account ID and URL accessed. So, for an Account ID, there are many URLs being accessed. I want to be able to identify Account ID that 1) ONLY access a certain URL (e.g. URL_Type_01) So, if they have visited other URL then "URL_Type_01", then I would drop the entire Account ID from considerations. I want to be able to asked "Which Account ID has ONLY view Type 1", and "Which Account ID has NEVER used Type 1". To "Show Account ID that would access ONLY URL_Type01 e.g. Exclude from transaction/group: Account_001 URL_Type_01 URL_Type_02 e.g. Exclude from transaction/group: Account_002 URL_Type_02 e.g. Include in transaction/group: Account_003 URL_Type 1 Hope I am being clear... 🙂 Many thanks!

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-18-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

X Axis (x-axis) don't show up in chart

How can I use LDAPSearch to retrieve email based o...

Checkpoint Log "Best Practice" or "Minimum Require...

Transaction - how to exclude entire transaction ba...

Re: How to add spacing between multiple eventdata ...

Re: X Axis (x-axis) don't show up in chart

X Axis (x-axis) don't show up in chart

How can I use LDAPSearch to retrieve email based o...

Checkpoint Log "Best Practice" or "Minimum Require...

Re: Transaction - how to exclude entire transactio...

Transaction - how to exclude entire transaction ba...