×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
rattyryan
Explorer
Member since: ‎02-27-2013
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 1
Member Since ‎02-27-2013
Activity Feed
View All

Cross referencing to fill in missing details

by in Splunk Search
‎02-06-2014 08:33 AM
‎02-06-2014 08:33 AM
Hi, I have two .csv files. One contains an IP address with associated output data, a second contains the IP address along with the location and building. How do I go about using both as a source and have a single output to contain the IP address with building, location and associated output data? I have looked into the use of lookups. Would this work? If I were to create a lookup for csv1 and manually put in empty field for building and location before uploading. And then source the second csv with lookup for csv1 and use a transaction by IP address? Would that work you think? ... View more

Re: Adding commas to "stats sum"

by in Splunk Search
‎02-06-2014 02:10 AM
‎02-06-2014 02:10 AM
Thanks very much 🙂 ... View more

Re: Adding commas to "stats sum"

by in Splunk Search
‎02-05-2014 10:48 AM
‎02-05-2014 10:48 AM
Yup... at the end I've added | fieldformat TotalPrints=tostring(TotalPrints,"commas") and |fieldformat "sum(TotalPrints)"=tostring(TotalPrints,"commas") no joy. ... View more

Adding commas to "stats sum"

by in Splunk Search
‎02-05-2014 09:47 AM
1 Karma
‎02-05-2014 09:47 AM
1 Karma
Hi, I'm trying to add commas to the TotalPrints field as shown in the code below. I have tried the fieldformat=stringto but it just creates an empty additional TotalPrints field. Can someone please advise? Also a quick one, how can I make the TotalPrints in descending order and limit it top top 10? I have tried sort- and limite=10 but it doesnt appear to do anything.. source="PrinterDemo.csv" | multikv fields "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | addtotals fieldname=TotalPrints "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets" | table "IP Address", "Location", "Black Printed Impressions", "Black Printed Large Sheets", "Color Printed Impressions", "Printed Impressions", "Printed 2 Sided Sheets", TotalPrints | stats sum(TotalPrints) by "Location" ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All