×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
cfbridgewater
New Member
Member since: ‎06-24-2014
‎06-05-2020
Community Statistics
Posts 5
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎06-24-2014
Activity Feed
View All

Re: dropdown and conditional field value based sea...

by in Splunk Search
‎06-25-2014 06:38 AM
‎06-25-2014 06:38 AM
that worked like a charm. one slight edit is that index="*". i'd like to better understand the usage of the | fields source. is that what pipes the results of the search within the brackets to the field source? ... View more

Re: dropdown and conditional field value based sea...

by in Splunk Search
‎06-25-2014 06:37 AM
‎06-25-2014 06:37 AM
that worked like a charm. one slight edit is that index="*". i'd like to better understand the usage of the | fields source. is that what pipes the results of the search within the brackets to the field source? ... View more

Re: dropdown and conditional field value based sea...

by in Splunk Search
‎06-24-2014 03:38 PM
‎06-24-2014 03:38 PM
index="" sourcetype="delorean-jvmgc" | eval source=case($env$ == "Prod", "/prd/", $env$' == "STAGE", "/data/stage/", $env$ == "DEV", "/home/*") ... View more

Re: dropdown and conditional field value based sea...

by in Splunk Search
‎06-24-2014 03:36 PM
‎06-24-2014 03:36 PM
i've tried the following, but this only overwrites my source ... and the processing comes after the actual indexing of the results (right?): index="" sourcetype="delorean-jvmgc" | eval source=case($env$ == "Prod", "/prd/", $env$' == "STAGE", "/data/stage/", $env$ == "DEV", "/home/") ... View more

dropdown and conditional field value based search

by in Splunk Search
‎06-24-2014 03:31 PM
‎06-24-2014 03:31 PM
i have view that i want to use to filter hosts by development tier (QA, STAGE, PROD). The drop down is configured as such: PROD STAGE DEV PROD The source field has different values based on environment: PRD: source= /prd/logname.log STAGE: source= /data/stage/logs/logname.log DEV: source= /home/qa_env_host/logging/logname.log I want to display results only for the relevant hosts in each tier ... so i think the right way to go is either via IF or CASE, but i'm not sure how to filter my search based on $env$ and the source field. i'm new to more complex searching in splunk and would appreciate guidance on the right way to do this. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM