×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
bharathk5678
New Member
Member since: ‎02-09-2017
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎02-09-2017
Activity Feed
View All

Re: extract value with matching multiple fields

by in Splunk Search
‎02-09-2017 12:39 PM
‎02-09-2017 12:39 PM
sry given wrong field name. now it's worked perfectly as expected. worked query: your current search giving fields domain, server, status | eval instance="instance".replace(server,"(.+)(\d)$","\2") | chart values(status) over domain by instance Thank you ... View more

Re: extract value with matching multiple fields

by in Splunk Search
‎02-09-2017 09:07 AM
‎02-09-2017 09:07 AM
got partial results. I am getting the output in like below format. but it's not showing two different columns with instance1 and instance2 domain NULL abc running xyz running ... View more

extract value with matching multiple fields

by in Splunk Search
‎02-09-2017 07:29 AM
‎02-09-2017 07:29 AM
If i have events like below, domain=abc, sever=abc_s1,status=running domain=abc, server=abc_s2,status=shutdown domain=xyz, sever=xyz_s1,status=running domain=xyz, server=xyz_s2,status=shutdown I want to create a table like below with new fields instance1 and instance2 , where instance1 should have the value of status for ($domain)_s1 . and instance2 should have the value of status for $domain_s2 can be this achievable? domain instance1 instance2 abc running shutdown xyz running shutdown ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM