Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About hasham19833
hasham19833
Loves-to-Learn Lots
Member since:
06-25-2019
06-17-2023
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-25-2019 |
Activity Feed
- Posted Re: arrange events into groups and count number of events in each group on Splunk Search. 06-09-2023 07:29 AM
- Posted How to arrange events into groups and count number of events in each group? on Splunk Search. 06-09-2023 06:57 AM
- Posted Re: How to compare two fields from two different searches and display results with matches and mis-matches? on Splunk Search. 06-25-2019 05:46 AM
- Posted Re: How to compare two fields from two different searches and display results with matches and mis-matches? on Splunk Search. 06-25-2019 05:10 AM
- Posted How to compare two fields from two different searches and display results with matches and mis-matches? on Splunk Search. 06-25-2019 01:10 AM
- Tagged How to compare two fields from two different searches and display results with matches and mis-matches? on Splunk Search. 06-25-2019 01:10 AM
- Tagged How to compare two fields from two different searches and display results with matches and mis-matches? on Splunk Search. 06-25-2019 01:10 AM
Topics I've Started
06-09-2023
07:29 AM
i tried transaction but this only includes the 2 imediate events...i want to include all the events between the 2 "will stop adding profiles" messages, not just the immediate before the end.
... View more
06-09-2023
06:57 AM
I have log lines like these:
2023/06/09 13:19:31.245 : AUDIT- INFO: Adding profile with id 00001 to TPT 2023/06/09 13:19:32.245 : AUDIT- INFO: Adding profile with id 00002 to TPT 2023/06/09 13:19:33.326 : Will stop adding profiles from id 00003 as maximum size has been exceeded
2023/06/09 13:19:34.245 : AUDIT- INFO: Adding profile with id 00003 to TPT
2023/06/09 13:19:34.245 : AUDIT- INFO: Adding profile with id 00003 to TPT 2023/06/09 13:19:35.245 : AUDIT- INFO: Adding profile with id 00004 to TPT 2023/06/09 13:19:36.326 : Will stop adding profiles from id 00005 as maximum size has been exceeded
2023/06/09 13:19:37.240 : AUDIT- INFO: Adding profile with id 00005 to TPT 2023/06/09 13:19:37.245 : AUDIT- INFO: Adding profile with id 00006 to TPT 2023/06/09 13:19:38.245 : AUDIT- INFO: Adding profile with id 00007 to TPT 2023/06/09 13:19:39.245 : AUDIT- INFO: Adding profile with id 00008 to TPT 2023/06/09 13:19:40.245 : AUDIT- INFO: Adding profile with id 00009 to TPT 2023/06/09 13:19:41.245 : AUDIT- INFO: Adding profile with id 00010 to TPT 2023/06/09 13:19:42.326 : Will stop adding profiles from id 00011 as maximum size has been exceeded
2023/06/09 13:19:43.245 : AUDIT- INFO: Adding profile with id 00011 to TPT 2023/06/09 13:19:44.245 : AUDIT- INFO: Adding profile with id 00012 to TPT 2023/06/09 13:19:45.245 : AUDIT- INFO: Adding profile with id 00013 to TPT 2023/06/09 13:19:46.245 : AUDIT- INFO: Adding profile with id 00014 to TPT
I want to group the events starting from "Adding profile with ID" and completing the group with "will stop adding profiles", and all messages in one group should be visible...so that i have 3 groups in total, and then the last 4 messages should not be a part of any group ( as their group has not completed yet)
The results should look something like this:
Group 1: profiles total:2 completed Group 2: profiles total:2 completed Group 3: profiles total:6 completed Group 4: profiles total:4 -
... View more
Labels
- Labels:
-
transaction
06-25-2019
05:46 AM
this is not giving out any results. there is nothing common between the 2 events, except the IDs, which are again by different field titles. is there anyway that i can combine the values from 2 fields into one field so that all the ids (even duplicates or common are in the same field)?
... View more
06-25-2019
05:10 AM
See the search query below; So its searching from 2 different indexes, index AS is event based, and the field "eventKey" appears in every result. While the 2nd field is from index DS and is extracted from a large xml file, so im guessing its multivalue field. That field is "availId". Now i want to see which individual values from 'availId' is matching with the values of field eventKey.
(index=DS sourcetype=SCHed source="/archived/ABC.SCH") OR (index=AS sourcetype=ASED "Finished" earliest=-19hr latest=-7hr )
| spath output=availId path=Schedule.Window.Avail{@availId}
| mvexpand availId
| eval results=if(availId==eventKey, "match","not match")
| table availId results
... View more
06-25-2019
01:10 AM
I am running 2 different searches and have to compare the each value in one field with the values in the other field. The display result should show a match or a mismatch against each value.
given data:
Field A:
1111
2222
2424
3333
4444
Field B:
3333
1111
4444
3344
Results should be something like this table:
Field A -- Field B ---- results
1111 --- 1111 ----match
2222---- ---- no-match
3333---- 3333 ---- match
4444---- 44444----match
2424 ---- ---- no match
---- 3344 ---- not match
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-17-2023
12:08 PM
|
