About srujan9292

srujan9292 · ‎01-02-2019

I have a similar issue. What if my data is something like below: index=a left join filter (index=a join Q (index=xyz|table Q) table filter ) table *

srujan9292 · ‎09-25-2018

Scenario - I have two indexes: index1 and index2. Inner Query: I need to compare two indexes (Index1 and Index2) with Group Number and CORP_ENT_CD combination. If there was a match, i would extract DCN's of those matching columns. Outer Query: I need to compare index1 and the result from above set and need to display unmatched columns. Query: index=index1 | rex "DCN (?<DCN>.*)-SL:(?<ServiceLn>.*)-TS:(?<timestamp>\d+)" |join type=left DCN [ search index=index1 | rex "DCN (?<DCN>.*)-SL:(?<ServiceLn>.*)-TS:(?<timestamp>\d+)" |eval dummy=GRP_NBR + CORP_ENT_CD |join dummy [search index=index2 earliest=-15d@d |rename "Group Number" as Group |search Group=* |eval dummy= Group + CORP_ENT_CD ] |fields DCN |table DCN |eval matched="Yes" ] |fillnull value="No" matched |search matched="No" --------- Is there any other way to increase the performance of this solution?

srujan9292 · ‎09-14-2018

You can schedule the saved search to run 15 minutes earlier. For example, if the time is 8:30.000 AM, schedule the saved search to run from -30min to -15min. in this case, the events will not be missed out.

srujan9292 · ‎08-09-2017

srujan9292 · ‎07-05-2017

Hi martin_mueller, What should be the query if we need to perform the search on same local-field? lookup lookup-table-name lookup-field1 AS local-field1, lookup-field2 AS local-field1 OUTPUT lookup-field1, lookup-field2, lookup-field3 Here lookup-field3 is corresponding field in lookup table. I have tried the above format, but it says no results found!! Thanks in advance.

srujan9292 · ‎07-05-2017

Hi MuS, What should be the query if we need to perform the search on same local-field? lookup lookup-table-name lookup-field1 AS local-field1, lookup-field2 AS local-field1 OUTPUT lookup-field1, lookup-field2, lookup-field3 Here lookup-field3 is corresponding field in lookup table. I have tried the above format, but it says no results found!! Thanks in advance.

srujan9292 · ‎07-05-2017

Try this: search 1 | append [ search2 ] | append [search 3] | Stats values(*) AS * by OBJECT | table OBJECT COUNT Requests Uniuqe

srujan9292 · ‎02-16-2017

Thanks for the reply. Is there a way to extract data from PPT and work on the extracted data. "generate Trends and Analysis out of it" - It means can the data be used in the same format as in CSV file.

srujan9292 · ‎02-15-2017

I have a 5 slide PPT which shows the different recommendations of tools. Can i upload such similar PPT's and generate Trends and Analysis out of it?

Posts	9
Solutions	0
Karma Given	4
Karma Received	3
Member Since	‎02-15-2017

Online Status	Offline
Date Last Visited	‎02-04-2021 07:46 AM

Is there an alternative to JOIN when records are m...

Can we upload PPT into Splunk

Re: How to join large tables with more than 50,000...

Is there an alternative to JOIN when records are m...

Re: Summary index missing random events

Re: Compare two columns in two lookup files

Re: Lookup multiple values

Re: Lookup command - multiple input fields

Re: merge two search results

Re: Can we upload PPT into Splunk

Can we upload PPT into Splunk

Join the Conversation