Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Arnaud1213
Arnaud1213
Explorer
Member since:
11-25-2016
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-25-2016 |
Activity Feed
- Got Karma for Re: How to get the first event from a search AND get 1 event in a timechart by source?. 06-05-2020 12:48 AM
- Posted Re: dynamic option in an input panel on Splunk Dev. 03-10-2017 12:57 AM
- Posted dynamic option in an input panel on Splunk Dev. 03-09-2017 01:13 AM
- Tagged dynamic option in an input panel on Splunk Dev. 03-09-2017 01:13 AM
- Posted Re: How to get the first event from a search AND get 1 event in a timechart by source? on Splunk Search. 11-28-2016 01:09 AM
- Posted Re: How to get the first event from a search AND get 1 event in a timechart by source? on Splunk Search. 11-28-2016 01:06 AM
- Posted Re: How to get the first event from a search AND get 1 event in a timechart by source? on Splunk Search. 11-28-2016 01:00 AM
- Posted How to get the first event from a search AND get 1 event in a timechart by source? on Splunk Search. 11-25-2016 06:52 AM
- Tagged How to get the first event from a search AND get 1 event in a timechart by source? on Splunk Search. 11-25-2016 06:52 AM
- Tagged How to get the first event from a search AND get 1 event in a timechart by source? on Splunk Search. 11-25-2016 06:52 AM
- Tagged How to get the first event from a search AND get 1 event in a timechart by source? on Splunk Search. 11-25-2016 06:52 AM
- Tagged How to get the first event from a search AND get 1 event in a timechart by source? on Splunk Search. 11-25-2016 06:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
03-10-2017
12:57 AM
Hi,
Thank you for your answers.
@Woodcock, I tried your proposition and it works, thank you.
Unfortunately, it takes a long time to get the result. It's not because of your proposition, but because of my query.
So I replaced your initial search by mine " ... | fieldsummary | search field=nb* | dedup field | sort field | table field rename field AS MyField | ...". And it takes a long time because of 'fieldsummary' searching.
Thank you,
Arnaud
... View more
03-09-2017
01:13 AM
HI all,
I would to build a dynamic value for a dynamic option in an 'dropdown' panel for a dashboard (splunk 6.5.2)
For example my query returns x results in a table : Number1, Number2, Number3 (to give an example with 3 values, but the result is always unknown). It allows to select between these 3 values to build a chart with a query like "index=blabla | timechart $myToken$ by myType". If Number1 is selected, the chart's query is "index=blabla | timechart SUM(Number1) by myType" because I need to draw the SUM.
So my dynamic options have a token prefix "SUM(", and a token prefix ")".
My need is to add a x+1 th (here a 4th) dynamic option "All", so that the resulted query for my chart is "index=blabla | timechart SUM(Number1), SUM(Number2), SUM(Number3) by myType".
How can I do that ?
Thank you,
Arnaud
... View more
- Tags:
- splunk-enterprise
11-28-2016
01:09 AM
Thank you for your answer,
Unfortunately it does not work because all the events are returned (despite of using first or earliest...
I think 'dedup is my friend' as sundareshr mentioned.
Arnaud
... View more
11-28-2016
01:06 AM
1 Karma
Thank you, it could help:
If I try my query as yours but by completing with a sort option, it seems working:
index=blabla sourcetype=blabla source=blabla1 "MySpecificFilter" | dedup source sortby +_time | table _time, source, mySpecificValue
--> I get the good result.
Arnaud
... View more
11-28-2016
01:00 AM
Hi Martin,
Thank you for your message. Yes I agree: difficult to visualize the need, sorry.
_time source mySpecificValue
2016-11-15 13:17:04 E:\myLog\2016_1115_1222_3816.log 41497
2016-11-15 13:14:23 E:\myLog\2016_1115_1222_3816.log 41497
2016-11-15 13:11:42 E:\myLog\2016_1115_1222_3816.log 41170
2016-11-15 13:09:01 E:\myLog\2016_1115_1222_3816.log 40889
2016-11-15 13:06:18 E:\myLog\2016_1115_1222_3816.log 42621
2016-11-15 13:03:37 E:\myLog\2016_1115_1222_3816.log 41529
2016-11-15 13:00:54 E:\myLog\2016_1115_1222_3816.log 42501
2016-11-15 12:57:10 E:\myLog\2016_1115_1222_3816.log 103884
2016-11-15 12:24:19 E:\myLog\2016_1115_1222_3816.log 1.8514e+006
2016-11-16 13:17:04 E:\myLog\2016_1116_1222_3816.log 9872
2016-11-16 13:14:23 E:\myLog\2016_1116_1222_3816.log 1645
2016-11-16 13:11:42 E:\myLog\2016_1116_1222_3816.log 41684
2016-11-16 13:09:01 E:\myLog\2016_1116_1222_3816.log 15438
2016-11-16 13:06:18 E:\myLog\2016_1116_1222_3816.log 15879
2016-11-16 13:03:37 E:\myLog\2016_1116_1222_3816.log 1234
2016-11-16 13:00:54 E:\myLog\2016_1116_1222_3816.log 4254
2016-11-16 12:57:10 E:\myLog\2016_1116_1222_3816.log 5442
2016-11-16 12:24:19 E:\myLog\2016_1116_1222_3816.log 123456
Every days I get this type of logs (example of export from splunk with the query above). In one use case, I need to chart only the first event by source because they have a particular meaning, so:
2016-11-15 12:24:19 E:\myLog\2016_1115_1222_3816.log 1.8514e+006
2016-11-16 12:24:19 E:\myLog\2016_1116_1222_3816.log 123456
... View more
11-25-2016
06:52 AM
Hi all,
How to get the first event from a search AND get only 1 event in a timechart by source ? (and not "by source, span interval):
If I try this search:
index=blabla sourcetype=blabla source=blabla1 "MySpecificFilter" | table _time, source, mySpecificValue
I can get for example 10 events in my source blabla1, 15 in the source blabla2, ... I want to select, for each source, the first one and to chart them with a timechart command.
Thank's in advance for help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
