About bradparks

bradparks · ‎04-07-2020

This totally worked for me thanks a ton! For anyone new to this, the fields will look like they've each been merged into a single value in each Parameter, but are still separate values in a way - they're Multivalues now - so to merge 2 multivalues into one, use mkjoin or mkindex(field,0)+mkindex(field,1)

bradparks · ‎01-23-2020

You could also do this rex field=exception "(?<shortmessage>[^\r\n])" which I use with this other bit to get a nice look at "caused by" too: | rex field=exception "(?<shortmessage>[^\r\n])" | eval shorter_msg=substr(shortmessage,1,180) | rex field=exception "Caused by: (?<caused_by>[^\r\n])" | stats count by level,shortmessage,caused_by | sort count desc

bradparks · ‎03-13-2017

i tried that, but found that it doesn't work as expected... You can see here in the Splunk docs themselves, that they suggestion doing it like I was doing it above https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Fields Keep only the host and ip fields. Remove all of the internal fields. The internal fields begin with an underscore character, for example _time. ... | fields host, ip | fields - _*

bradparks · ‎03-13-2017

Great! this does exactly what I want... Much appreciated!

bradparks · ‎03-13-2017

I'm using Splunk 6.3, which supports this feature supposedly.

bradparks · ‎03-13-2017

I've got a query that gives 178 results, and it ends with me filtering down to a single field, which by itself works fine. | fields url I then want to remove the internal fields, like _time and _raw , as I want to both export the data to csv with only this field, and I want to be able to do set intersect comparisons that only compare on the one field. If I try piping this to fields to remove the internal fields, like either of the following, I get zero results | fields url | fields - _* | fields url | fields - _raw,_time I've noticed that if I include _time in the fields parameter, that's when my results go to zero. Any suggestions?

bradparks · ‎03-13-2017

I downvoted this post because this doesnt answer the question - piping to "fields" works only in the search, not in the exported results

Posts	7
Solutions	0
Karma Given	18
Karma Received	0
Member Since	‎02-07-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Why does "| fields - _*" and "| fields - _raw,_tim...

Re: Merge rows in one

Re: How to display only the first line of stacktra...

Re: Why does "| fields - _*" and "| fields - _raw,...

Re: Why does "| fields - _*" and "| fields - _raw,...

Re: Why does "| fields - _*" and "| fields - _raw,...

Why does "| fields - _*" and "| fields - _raw,_tim...

Re: How do I limit the "export results" action to ...