×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
davidgogogo
Explorer
Member since: ‎07-13-2019
‎10-08-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 2
Member Since ‎07-13-2019
Activity Feed
View All

Re: Duplicate Values in REST API

by in Splunk Enterprise
‎10-08-2020 12:15 AM
2 Karma
‎10-08-2020 12:15 AM
2 Karma
@richgalloway  we met the same problem on Splunk Enterprise 7.2.6. if we added the savedsearch like this index=my_index | dedup name | table name value and assume the savedsearch result is like this name value aa 1 bb 2 but if we use splunk export API, we will get the result like this {"preview":false,"offset":0,"result": {"name": "a", value:"1"} {"preview":false,"offset":1,"result": {"name": "b", value:"2"} {"preview":false,"offset":0,"result": {"name": "a", value:"1"} {"preview":false,"offset":1,"result": {"name": "b", value:"2"}   ... View more

Re: How to get the most recent event with specific...

by in Splunk Search
‎12-05-2019 01:51 AM
‎12-05-2019 01:51 AM
Thanks for your answer! it's really helpful. We have considered using stats before, but there were two reasons why we use dedup rather than stats performance aspect if dedup command only searchs the first matching event, does that mean the performance will be much better than stats ? query complexity if we have to deal with many fields, such as 2019-12-04 12:00:00, machine=A, field1=x1 field2=x2 field2=x2 field3=x3......field100=x100 2019-12-04 12:00:00, machine=A, field1=x1 field2=x2 field2=x2 field3=x3......field100=x100 2019-12-03 12:00:00, machine=A, field1=x1 field2=x2 field2=x2 field3=x3......field100=x100 2019-12-03 12:00:00, machine=A, field1=x1 field2=x2 field2=x2 field3=x3......field100=x100 we can just use a very simple query to get the most recent result per day per machine | dedup _time machine 2019-12-04 12:00:00, machine=A, field1=x1 field2=x2 field2=x2 field3=x3......field100=x100 2019-12-03 12:00:00, machine=A, field1=x1 field2=x2 field2=x2 field3=x3......field100=x100 on the other hand, it will be more complected if we use stats to deal with each field, such as |stats latest(field1), latest(field2)... by _time machine I'm not sure our consideration making sense or not, do you have any advice for this case? ... View more

How to get the most recent event with specific fie...

by in Splunk Search
‎12-03-2019 08:07 PM
‎12-03-2019 08:07 PM
Our purpose is to get the most recent event with specific fields by "dedup" command in indexer cluster We have read a similar case according to this link, but still confused about the usage of dedup.: https://answers.splunk.com/answers/323510/how-to-keep-all-most-recent-events-for-a-specific.html The following is our case Event sample (index=myIndex) conditions: (1) 1 search-head + 2 indexer instances (we use index cluster) (2) each event have one duplicated record (marked "duplicated event") 2019-12-04 12:00:00, machine=serverA, result=pass # duplicated event 2019-12-04 12:00:00, machine=serverA, result=pass 2019-12-04 12:00:00, machine=serverB, result=pass # duplicated event 2019-12-04 12:00:00, machine=serverB, result=pass 2019-12-03 12:00:00, machine=serverA, result=fail # duplicated event 2019-12-03 12:00:00, machine=serverA, result=fail 2019-12-03 12:00:00, machine=serverB, result=fail # duplicated event 2019-12-03 12:00:00, machine=serverB, result=fail We want to get the most recent server's result per day, such as Taget result 2019-12-04 12:00:00, machine=serverA, result=pass 2019-12-04 12:00:00, machine=serverB, result=pass 2019-12-03 12:00:00, machine=serverA, result=fail 2019-12-03 12:00:00, machine=serverB, result=fail SPL query index=myIndex | dedup _time machine Question: Does "dedup" command "always" return the most recent events based on the specific fields crossing multiple indexers? According to our case, If we apply the spl query based on our condition, can we always get the target result? ... View more

How to pass environment variables to db_connection...

by in All Apps and Add-ons
‎07-13-2019 07:13 PM
‎07-13-2019 07:13 PM
Hi, my Splunk DBconnect version is 3.1.4 I would like to pass the environment variable to the db_connections.conf but it seems can't work Passing environment variable is normal when I do the same way in other apps is it the DBconnet app limitation? The following is my format: ## splunk-launch.conf ... SPLUNK_ENV_DB_CONN_ENABLE=1 SPLUNK_ENV_DB_CONN_HOST=localhost ## splunk_app_db_connect/local/db_connections.conf [myConnection] connection_type = postgres database = mydatabase disabled = $SPLUNK_ENV_DB_CONN_ENABLE host = $SPLUNK_ENV_DB_CONN_HOST identity = test jdbcUseSSL = false localTimezoneConversionEnabled = false port = 5432 readonly = true ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎10-08-2020 05:01 AM
Karma from
View All