Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About maxmukimov
maxmukimov
Explorer
Member since:
07-06-2020
05-05-2021
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 07-06-2020 |
Activity Feed
- Posted Re: How to split count by product by another value? on Splunk Search. 05-04-2021 10:44 AM
- Posted Re: How to split count by product by another value? on Splunk Search. 05-04-2021 07:31 AM
- Posted Re: How to split count by product by another value? on Splunk Search. 05-03-2021 01:33 PM
- Tagged Re: How to split count by product by another value? on Splunk Search. 05-03-2021 01:33 PM
- Posted How to split count by product by another value? on Splunk Search. 05-03-2021 01:01 PM
- Posted Re: stats count for different days in separate fields on Splunk Search. 07-10-2020 10:02 AM
- Posted Re: stats count for different days in separate fields on Splunk Search. 07-09-2020 11:09 AM
- Posted Re: stats count for different days in separate fields on Splunk Search. 07-09-2020 10:53 AM
- Posted stats count for different days in separate fields on Splunk Search. 07-08-2020 08:26 AM
- Posted Re: replace String issue on Splunk Search. 07-06-2020 10:50 AM
- Karma Re: replace String issue for efavreau. 07-06-2020 10:50 AM
- Posted replace String issue on Splunk Search. 07-06-2020 09:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
05-04-2021
10:44 AM
From original query I’m getting something like this : I want to get something like this:
... View more
05-03-2021
01:33 PM
Getting the same results when I added | mvexpand product
... View more
- Tags:
- mvexpand
05-03-2021
01:01 PM
Hi, I have the following query: | bin _time span=1d | stats count as ProductCount by applysourcetype, product, _time
| where _time=relative_time(now(), "-d@d") or _time=relative_time(now(), "-8d@d")
| eval when = if(_time=relative_time(now(), "-d@d"), "(Yesterday)", "(7 Days Ago)")
| eval "Products Ordered {when}" = ProductCount
| fields - _time ProductCount when
| stats values(*) as * by product , applysourcetype and I'm getting following output: How can make product filed one row for unique product?
... View more
07-10-2020
10:02 AM
@bowesmana There was a typo, instead of: | stats count as ProductCount by product, _time I typed | stats count as "Product Count" by product, _time Thank you!
... View more
07-09-2020
11:09 AM
Thank you @bowesmana First option seems to be working, however, I'm not getting separate columns for Yesterday and Last week. Results for both days are getting displayed in one column. Attached the screenshot.
... View more
07-08-2020
08:26 AM
Hi, I’m trying to get product count for yesterday and 7 days ago from yesterday in two separate fields, results are coming back correct for yesterday but for the second field all the results are zero. I wanted to know if my logic is correct. Here is what I have: index = something host = something
| where ResponseCode = “Success”
| stats count as “Product Count Yesterday”,
count (eval (relative_time(now(), “-8d@d”))) as “Product Count 7 days ago” by product
| sort product desc Thank you.
... View more
07-06-2020
10:50 AM
Thank you @efavreau ! I wasn’t able to use mvexpand but the link you advised suggested See Also split function. I realized that “A1 | A2” coming as one String and that’s why |replace “A1” with “Apple” wasn’t recognizing “A1 | A2”, what I did was, I added | eval product=split(product, “ | “) And now I’m getting the result I wanted. Apple Grape Apple Grape Now I have to figure out how to add “Multiple products” text if there are more than one product, but I’ll open separate question. Thank you again!
... View more
07-06-2020
09:08 AM
Hello! I’m trying to replace product codes with product names like | replace “A1” with “Apple”, “A2” with “Grape”, “A3” with “ Watermelon” I’m getting what I want except when there are more than one value in Product code field. Apple Grape A1 | A2 How can I fix the row with multiple values? Thank you.
... View more
Labels
- Labels:
-
regex
