About janitka

janitka · ‎11-02-2020

This one works, but the result is that it creates one line, with host as Machine, and then all DesktopGroupNames next to it. I'm totally dumb and not able to think, because I sorted it once already I want something like bellow, but to have both space and build number on one line for each respective machine. (xendesktop source is not needed necessary, it only provides additional data for Desktop Group Name)

janitka · ‎11-02-2020

Hello, that query is failing on IF "Error in 'eval' command: The arguments to the 'if' function are invalid." Also, I don't need to use "sourcetype="xendesktop:7:machine" " that much, main target is to get data for both Type=Disk Name=C: and Type=Operatingsystem, in same table, as I can get the result on separate lines, when I remove | dedup host. Thanks for your time

janitka · ‎10-29-2020

Hello all, How would I join bellow results by common field -> host? Same index is used. I was able to create advanced and big dashboards / searches, but cannot use join or other stuff lately, because I'm not working with Splunk daily, and forgot almost everything.. My original intention was to add BuildNumber into this search: sourcetype="WinHostMon" Type="Disk" Name="C:" host="*" NOT host="*dc.dhl.com*" NOT host="*czchows*" NOT host="*MYKULWS*" NOT host="*czstlws*" NOT host="*usqasws*" | dedup host | eval FreeSpaceKB = round((FreeSpaceKB/1024/1024),2) | eval TotalSpaceKB = round ((TotalSpaceKB/1024/1024),2) | eval percentage=(FreeSpaceKB/TotalSpaceKB*100) | join host [ search sourcetype="xendesktop:7:machine" | eval host=MachineName ] | table MachineName DesktopGroupName FreeSpaceKB TotalSpaceKB percentage | rename FreeSpaceKB AS "Free Space GB" MachineName AS Machine TotalSpaceKB AS "Total Space GB" percentage AS "% Free Space" | sort Machine

janitka · ‎02-06-2020

Hello, is there simple way how to have everything generated from Dynamic Search selected? I'm searching for MachineName from one source, which is same as host value from different source, used in table search, so I can't use * in variable. Regards, jan

janitka · ‎01-28-2020

Hello, could someone help what to modify in bellow search, as i want to display red/green color if the value is True or False sourcetype="xendesktop:7:machine" MachineName="$MachineName$" | table InMaintenanceMode | rename InMaintenanceMode as Maintenance | replace False with OFF in Maintenance | replace True with ON in Maintenance Why is there no option for text, same as for numerical values? Regards, Jan

janitka · ‎11-25-2019

hello, your search is resulting in bellow https://imgur.com/d6u6Dxm because for the second source, host is used for server names, in first for every machine. When i sort it by MachineName, and not host, i miss DisplayName and DisplayVersion. Regards, Jan

janitka · ‎11-22-2019

Found the solution. index = "windows" sourcetype="Script:InstalledApps" | join host [ search sourcetype="xendesktop:7:machine" | eval host=MachineName ] | table MachineName DesktopGroupName DisplayName DisplayVersion

janitka · ‎11-21-2019

values returned for host are the same and in same format as for MachineName.. so i would like to use host=$variable$ to be passed to the other source, MachineName, to display DesktopGroupName, from xendesktop... joining two searches into one panel, as i can do it for each search alone.

janitka · ‎11-21-2019

Important stuff is in this topic, one search is index = "windows" sourcetype="Script:InstalledApps" host="$MachineName$" | table host DisplayName DisplayVersion other one sourcetype="xendesktop:7:machine" 'xd_index' MachineName="$XXX$" | table MachineName DesktopGroupName

janitka · ‎11-21-2019

Hello, I'm trying to join two searches, and i need to use host in the other one, to be able to table it by DesktopGroupName and installed apps. (| table host DisplayName DisplayVersion DesktopGroupName) host = MachineName, that fields contains same values, in same format. index = "windows" sourcetype="Script:InstalledApps" - host used sourcetype="xendesktop:7:machine" xd_index - MachineName used I can do advanced dashboards, but never tried to do this, any help appreciated. Jan

Posts	10
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎11-21-2019

Online Status	Offline
Date Last Visited	‎11-02-2020 04:25 AM

Search - joining results in table

Checkbox - Select/Tick all by default

Color for text value

How to join two searches and table it?

Re: Search - joining results in table

Re: Search - joining results in table

Search - joining results in table

Checkbox - Select/Tick all by default

Color for text value

Re: How to join two searches and table it?

Re: How to join two searches and table it?

Re: How to join two searches and table it?

Re: How to join two searches and table it?

How to join two searches and table it?

Are you a member of the Splunk Community?