About drezanka

drezanka · ‎01-19-2022

I was able to use split() to compare two variables rather than having to have a distinct list defined. Solved

drezanka · ‎01-19-2022

It's really a chicken and egg problem. I am trying to use the result of an outer search in an inner search. Working on alternatives.

drezanka · ‎01-19-2022

I am using Splunk Enterprise V8.2.3.2. I am trying to alert when a scheduled search becomes disabled. The problem is that I have four systems using the same app but with different searches enabled and disabled for each of the systems. I need to dynamically determine which system the alert is running on and get the corresponding list of searches that are supposed to be enabled from a lookup table. I have done that. Now I need to see if the disabled search name matches one of the search names in the lookup table list. List is like: Searches that should be enabled(fieldname searches): apple tart,blueberry pie,carrot cake,cupcake Search found to be disabled(fieldname disabled): carrot cake I would like to do something like: eval failed=if(in(disabled,searches),"Failed","Passed") where disabled in(searches) or, search disabled IN searches However, none of these approaches have worked. Any advice? Thanks in advance.

drezanka · ‎02-26-2021

That works! Thank you.

drezanka · ‎02-26-2021

I have an app with dozens of searches that refer to "groupings" of indexes based on several types of criteria. I would like to have one "source of truth" for each grouping so when a index is retired and new ones are added I can just edit one thing instead of dozens of searches. I have tried using a csv lookup but am having problems getting the search to work. Here is a simplified example of the csv file: type,index_list rabbits,index="bunny_index" OR index="jackrabbit_index" stones,index="turquoise" OR index="slate" dogs,index="spaniels" OR index="hounds" all,index="bunny_index" OR index="jackrabbit_index" OR index="turquoise" OR index="slate" OR index="spaniels" OR index="hounds" mammals="bunny_index" OR index="jackrabbit_index" OR "spaniels" OR index="hounds" I have tried running: | inputlookup mycsvfile where type=rabbits | search index_list but I get "No results found." (If I run index="bunny_index" OR index="jackrabbit_index" I do get results). Grabbing that list of indexes to search from a centralized location would be a huge improvement over our current setup so any input would be very much appreciated.

drezanka · ‎02-26-2020

I am running Splunk Enterprise 8.0.1 monitoring files with a universal forwarder and putting info from csv files into a metric index using logs to metrics through props.conf and transforms.conf. Most of the monitored files are working as expected but one is not showing up in the metric index and I cannot find any errors about it in splunkd.log or metrics.log. This file occasionally has the last entry empty. Here is an example of the data: one,1,100 two,2,200 three,3, four,4,400 The value in column three is set to be a dimension for the metric data. It is actually a key variable and I need to be able to track it. Does anyone know if the missing value is causing the data not to import into my metric index and if so, how to fix it? Thanks.

drezanka · ‎02-03-2020

I have several types of metric data going into a metric index. One has 'username' and 'DimA' as dimensions, and 'ValueA' as the metric_name. The second type of metric data has 'DimA' as its dimension and 'ValueB' as the metric_name. I would like to associate the 'username' with 'ValueB'. How can I accomplish this?

Posts	7
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎08-06-2019

Online Status	Offline
Date Last Visited	‎09-28-2022 02:04 PM

Using variables with IN and LIKE functions

One source of truth

Metric Index problem with null values

How to join metric data

Re: Using variables with IN and LIKE functions

Re: Using variables with IN and LIKE functions

Using variables with IN and LIKE functions

Re: One source of truth

One source of truth

Metric Index problem with null values

How to join metric data

Join the Conversation