×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
ssaini5
Explorer
Member since: ‎08-12-2020
‎09-10-2020
Community Statistics
Posts 5
Solutions 0
Karma Given 4
Karma Received 0
Member Since ‎08-12-2020
Activity Feed
View All

Re: Color table on the basis of their values visua...

by SplunkTrust in Splunk Search
‎09-09-2020 06:17 AM
1 Karma
‎09-09-2020 06:17 AM
1 Karma
Edit the dashboard and click on the pen icon in the heading of the table column you wish to color.  Select the Color tab then choose "Values" from the drop-down menu.  Select "Define rules" then create a rule to paint the cells a certain color if the value is zero and another rule to paint the cells a different color otherwise.  Save the dashboard. ... View more

Re: Extracting data from a search table

by in Splunk Search
‎08-17-2020 03:28 PM
1 Karma
‎08-17-2020 03:28 PM
1 Karma
sample: index=_internal |head 1 | fields _raw _time | eval _raw="VM_NAME: vm1 Process Process Count ProcessTestA 0 ProcessTestB 1; VM_NAME: vm2 Process Process Count ProcessTestA 0 ProcessTestB 3;" | rex max_match=0 (?s)(?<vm>.*?); | mvexpand vm | rex field=vm max_match=0 (?<name>\S+?):?\s(?<value>.*) | rex mode=sed field=value s/(.*)/\"\1\"/g | eval tmp=mvzip(name,value,"=") | rename tmp as _raw | kv | table VM_NAME Process ProcessTest*   recommend: index="test_log" source="/var/tmp/logs/test.log" | rex max_match=0 (?s)(?<vm>.*?); | mvexpand vm | rex field=vm max_match=0 (?<name>\S+?):?\s(?<value>.*) | rex mode=sed field=value s/(.*)/\"\1\"/g | eval tmp=mvzip(name,value,"=") | rename tmp as _raw | kv | table VM_NAME Process ProcessTest* REGEX option is useful. ... View more

Re: Regex expression to extract IP from a raw log ...

by SplunkTrust in Splunk Search
‎08-12-2020 12:39 PM
‎08-12-2020 12:39 PM
Great. Up vote is rally appreciated. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎09-10-2020 04:08 PM
Karma given to