Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kdwsplunk
kdwsplunk
Explorer
Member since:
02-26-2017
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 02-26-2017 |
Activity Feed
- Got Karma for Is there an SPL command using REST to list the macros contained within a macro?. 06-05-2020 12:49 AM
- Posted Re: Is there an SPL command using REST to list the macros contained within a macro? on Getting Data In. 01-18-2018 10:09 AM
- Posted Is there an SPL command using REST to list the macros contained within a macro? on Getting Data In. 01-05-2018 01:49 PM
- Tagged Is there an SPL command using REST to list the macros contained within a macro? on Getting Data In. 01-05-2018 01:49 PM
- Tagged Is there an SPL command using REST to list the macros contained within a macro? on Getting Data In. 01-05-2018 01:49 PM
- Tagged Is there an SPL command using REST to list the macros contained within a macro? on Getting Data In. 01-05-2018 01:49 PM
- Posted Re: Is there a Splunk search command that will give an organized summary listing of all field alias definitions? on Splunk Search. 01-03-2018 10:25 AM
- Posted Is there a Splunk search command that will give an organized summary listing of all field alias definitions? on Splunk Search. 01-02-2018 02:05 PM
- Tagged Is there a Splunk search command that will give an organized summary listing of all field alias definitions? on Splunk Search. 01-02-2018 02:05 PM
- Tagged Is there a Splunk search command that will give an organized summary listing of all field alias definitions? on Splunk Search. 01-02-2018 02:05 PM
- Posted Re: Why is the TAIL command listing the events in order of ascending time while the HEAD command lists the events in order of descending time? on Splunk Search. 02-27-2017 04:23 PM
- Posted Why is the TAIL command listing the events in order of ascending time while the HEAD command lists the events in order of descending time? on Splunk Search. 02-27-2017 02:30 PM
- Tagged Why is the TAIL command listing the events in order of ascending time while the HEAD command lists the events in order of descending time? on Splunk Search. 02-27-2017 02:30 PM
- Tagged Why is the TAIL command listing the events in order of ascending time while the HEAD command lists the events in order of descending time? on Splunk Search. 02-27-2017 02:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 |
01-18-2018
10:09 AM
Thank you for your suggestion. ...Great approach!
I tried it and found that the REGEX on line #2 above just needs an adjustment because sometimes it grabs more than just the macro name. I'm currently getting up-to-speed on REGEX so that I can post an adjustment. I only have a partial suggestion at the moment. This suggestion grabs the macro name as well as the macro argument:
2. | rex field=definition max_match=0 "\`(?<themacros>[^`]*)\`"
I would like to figure out how to get rid of the argument (that is, the parentheses that follow the macro name, as well as the contents of the parentheses.
For example, the current result is:
macro_name(macro_argument)
But I would like to get the following result:
macro_name
Thank you again for your approach! Very nice!!!
... View more
01-05-2018
01:49 PM
1 Karma
Hello, I see that we can use SPL to get a list of arguments, "args", of a macro using the "rest" command.
| rest /services/configs/conf-macros
It would be great to be able to list all the dependencies of a macro.
In particular, is there a way to use the "rest" command to get a list of macros depended upon by another macro?
For instance, is it possible to get the following output? (See the third column "macros_called_by_macro".)
|---- args ----|---- title ----|---- macros_called_by_macro ---| --- author --- | --- definition --- |
| | macro_01 | macro_02, macro_03 |
| | macro_02 | macro_04 |
| | macro_03 | |
Thanks so much!!!
... View more
01-03-2018
10:25 AM
THANK YOU!!!
Excellent!!! Works very nicely!!!
... View more
01-02-2018
02:05 PM
Hello,
I was wondering if there is an SPL command that will give an organized summary or listing of all field aliases that have been defined. So far it looks like a user has to go into the settings and look at each definition individually. Or an admin has to go into the back end and look into each app's .conf file separately.
It would be nice to have something analogous to the fieldsummary command or the datamodel command.
Thanks!
... View more
02-27-2017
04:23 PM
Thank you very much for your help!
... View more
02-27-2017
02:30 PM
Hello,
I ran a search that had 15,000+ events. The table had the same amount of results. The results were listed in reverse chronological order for the most part.
I wanted to see the last 10 results. So I used the TAIL command. But the last 10 results were in chronological order. It was counter intuitive to me because I thought it would be similar to scrolling down to the bottom of the original list. I was expecting the last 10 results to be in reverse chronological order.
| eval myTime=_time
| eval myTime2=strftime(myTime,"%Y-%m-%d %H:%M:%S:%3Q")
| bucket SPAN=5m _time
| tail
| table _time myTime myTime2
_time ----------------------------------- myTime ---------------- myTime2
2012-03-16T12:30:00.000+0000 1331901000.000000 2012-03-16 12:30:00:000
2012-03-16T12:30:00.000+0000 1331901000.000000 2012-03-16 12:30:00:000
2012-03-16T12:30:00.000+0000 1331901000.000000 2012-03-16 12:30:00:000
2012-03-16T12:30:00.000+0000 1331901000.000000 2012-03-16 12:30:00:000
2012-03-16T12:30:00.000+0000 1331901000.000000 2012-03-16 12:30:00:000
2012-03-16T12:30:00.000+0000 1331901000.010000 2012-03-16 12:30:00:010
2012-03-16T12:30:00.000+0000 1331901000.020000 2012-03-16 12:30:00:020
2012-03-16T12:30:00.000+0000 1331901000.020000 2012-03-16 12:30:00:020
2012-03-16T12:30:00.000+0000 1331901000.030000 2012-03-16 12:30:00:030
2012-03-16T12:30:00.000+0000 1331901000.040000 2012-03-16 12:30:00:040
I then ran the HEAD command to see if that would also change the order. But it did not. The HEAD command put the first 10 events in reverse chronological order as expected.
| eval myTime=_time
| eval myTime2=strftime(myTime,"%Y-%m-%d %H:%M:%S:%3Q")
| bucket SPAN=5m _time
| head
| table _time myTime myTime2
_time ----------------------------------- myTime ---------------- myTime2
2012-03-16T13:25:00.000+0000 1331904442.350000 2012-03-16 13:27:22:350
2012-03-16T13:25:00.000+0000 1331904442.220000 2012-03-16 13:27:22:220
2012-03-16T13:25:00.000+0000 1331904442.100000 2012-03-16 13:27:22:100
2012-03-16T13:25:00.000+0000 1331904442.090000 2012-03-16 13:27:22:090
2012-03-16T13:25:00.000+0000 1331904442.000000 2012-03-16 13:27:22:000
2012-03-16T13:25:00.000+0000 1331904442.000000 2012-03-16 13:27:22:000
2012-03-16T13:25:00.000+0000 1331904442.000000 2012-03-16 13:27:22:000
2012-03-16T13:25:00.000+0000 1331904442.000000 2012-03-16 13:27:22:000
2012-03-16T13:25:00.000+0000 1331904441.960000 2012-03-16 13:27:21:960
2012-03-16T13:25:00.000+0000 1331904441.950000 2012-03-16 13:27:21:950
Why is the TAIL command listing the events in order of ascending time while the HEAD command lists the events in order of descending time?
... View more
