Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About vjverma
vjverma
Explorer
Member since:
07-18-2014
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 07-18-2014 |
Activity Feed
- Got Karma for How to query multiple conditions when the field name has a space. 06-05-2020 12:47 AM
- Posted Re: How to find records that only exist in a particular time range on Splunk Search. 10-29-2014 09:00 AM
- Posted Re: How to find records that only exist in a particular time range on Splunk Search. 10-28-2014 09:07 AM
- Posted Re: How to find records that only exist in a particular time range on Splunk Search. 10-27-2014 12:40 PM
- Posted Re: How to find records that only exist in a particular time range on Splunk Search. 10-27-2014 11:55 AM
- Posted Re: How to find records that only exist in a particular time range on Splunk Search. 10-23-2014 08:35 AM
- Posted How to find records that only exist in a particular time range on Splunk Search. 10-23-2014 07:50 AM
- Tagged How to find records that only exist in a particular time range on Splunk Search. 10-23-2014 07:50 AM
- Tagged How to find records that only exist in a particular time range on Splunk Search. 10-23-2014 07:50 AM
- Posted Re: How to query multiple conditions when the field name has a space on Splunk Search. 07-18-2014 07:18 PM
- Posted How to query multiple conditions when the field name has a space on Splunk Search. 07-18-2014 03:41 PM
- Tagged How to query multiple conditions when the field name has a space on Splunk Search. 07-18-2014 03:41 PM
- Tagged How to query multiple conditions when the field name has a space on Splunk Search. 07-18-2014 03:41 PM
- Tagged How to query multiple conditions when the field name has a space on Splunk Search. 07-18-2014 03:41 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 |
10-29-2014
09:00 AM
Sorry, I wasn't explicit. I ran the query with format turned on as well. If I run the inner query on its own, then it returns accurate data.
However, in following syntax, it seems to have no bearing on the results. The following two queries return identical result (count, format, table, ...)
source=visitors earliest=-1mon@mon latest=@mon NOT [search source=visitors earliest=-4mon@mon latest=-1mon@mon | table name | dedup name]
source=visitors earliest=-1mon@mon latest=@mon
The actual field is "Email Address".
source=emailusers earliest=-1mon@mon latest=@mon NOT [search source=visitors earliest=-4mon@mon latest=-1mon@mon | table "Email Address" | dedup "Email Address"]
... View more
10-28-2014
09:07 AM
These two queries return the same result as a list and count.
source=visitors earliest=-1mon@mon latest=@mon NOT [search source=visitors earliest=-4mon@mon latest=-1mon@mon | table name | dedup name]
source=visitors earliest=-1mon@mon latest=@mon
I did a spot check for some of the results that show up. They exist in the June-aug range as well.
... View more
10-27-2014
12:40 PM
When I run this individually, the result list looks okay. I haven't tried the format that you suggested but I see results come back when I run just "source=visitors earliest=-4mon@mon latest=-1mon@mon | table name | dedup name" with "All time" option.
It is only when I execute "source=visitors earliest=-1mon@mon latest=@mon NOT [search source=visitors earliest=-4mon@mon latest=-1mon@mon | table name | dedup name] | stats count" that the result doesn't look accurate.
Also, I see the following lines above the results window that tell me the timeframe is not being picked up correctly.
[subsearch]: Your timerange was substituted based on your search string
[subsearch]: No matching fields exist
≥ 1 result during September 2014
If I run the sub-query on its own, the timeframe indicated is correct "June through August"
... View more
10-27-2014
11:55 AM
I tried:
source=visitors earliest=-1mon@mon latest=@mon NOT [search source=visitors earliest=-4mon@mon latest=-1mon@mon | table name | dedup name] | stats count
The result is same with or without the NOT clause. It appears that when the query runs, the time frame is set to last month and hence the inner search does not kick in.
... View more
10-23-2014
08:35 AM
Thanks but how should I go about joining the results from two different time ranges.
... View more
10-23-2014
07:50 AM
I need to query the logs to find records with names that only exists in the current month but not in the previous month (or ever).
The SQL equivalent would be something on these lines
select * FROM visitors where datevisit >= '10/1/2014' and datevisit <= '10/31/2014' AS Oct_Visits
Outer join visitors where datevisit >= '9/1/2014' and datevisit <= '9/30/2014' as Sep_Visits
ON Oct_Visits.name = Sep_Visits.name AND Sep_Visits.name = null
Appreciate your help!
Thanks,
Vijay
... View more
07-18-2014
07:18 PM
Thank you. Worked like a charm.
... View more
07-18-2014
03:41 PM
1 Karma
I need to run a query on the following lines:
index=i source=s earliest=-7W@W latest=@W | timechart span=1w count AS Overall count(eval(field1>0 )) AS F1Count count(eval("Field 2">0)) AS F2Count
The "Field 2" results in a syntax error saying "The eval expression for dynamic field '"Field 2">0' is invalid"
I can't rename the "Field 2". Is they any other way to query this data.
I could do
index=i source=s earliest=-7W@W latest=@W "Field 2">0| timechart span=1w count AS F2Count
but this requires me to run this query multiple times for each field.
... View more
