About Khuzair81

Khuzair81 · ‎01-25-2023

Hi, in the CSV file in there is a field. Brand : Puma, Adidas SplunkEvents Brand : Puma, Adidas, Nike, Gucci, LV I want the result as Brand : Nike, Gucci, LV

Khuzair81 · ‎01-25-2023

Please help with the query on how to compare CSV data with Splunk event and get those data in result which is not available in csv. Thanks

Khuzair81 · ‎08-29-2022

status=Auto, Manual car= BMW, Honda, Audi index * | stats count(status) as Total by car Is there anyway I can get the results as shown in attached picture.

Khuzair81 · ‎08-10-2021

@scelikokThankyou

Khuzair81 · ‎08-10-2021

Hi All, Please help me to solve this. desc="Trigger App : Search [Abc_[qwert] asd] number" I want to fetch the "[Abc_[qwert] asd]" from the above string Thanks

Khuzair81 · ‎07-18-2021

@ITWhisperer thanks for the help. Is there any doc where i can get these for all type visualization. It will be really helpful.

Khuzair81 · ‎07-17-2021

@ITWhisperer any help.

Khuzair81 · ‎07-15-2021

Sorry @ITWhisperer. I posted the wrong one PFB <row> <panel> <html> <style> #test g[transform] { font-size: 15px !important; font-weight: bold !important; } </style> </html> </panel> </row>

Khuzair81 · ‎07-13-2021

Hi All, I have a dashboard with chart which is representing Count by Dates. I have increased the font size of count value but need help in increasing the font size of Date. Below XML I'm using currently. <row> <panel> <html> <style> #test th{ font-size: 15px !important; font-weight: bold !important; } </style> </html> </panel> </row> Thanks

Khuzair81 · ‎06-08-2021

Hi @gcusello there is field value in events like every day there are new events and some of them is updating from past few days so i just wanted the new events that came in yesterday. So i want to compare a field value with yesterday

Khuzair81 · ‎06-08-2021

I want to get the data only from yesterday Date is there anyway to write it in Query Can i use | where Date=-1d@d I'm trying | eval today=strftime(now(), "%d") | where Date=Today-1

Khuzair81 · ‎06-08-2021

@richgalloway i want to get the data only from yesterday is there anyway to write it in Query Can i use | where Date=-1d@d

Khuzair81 · ‎06-07-2021

How to convert the below the time field from GMT to EST. time=Jun 7, 2021 10:24:33 AM GMT i tried below | eval t=strftime(strptime(time, "%m %d, %y %H:%M:%S %Z"), "%H:%M:%S") I'm not getting the result

Khuzair81 · ‎05-29-2021

c= US Language = abcdENGLISH123qw ..... | rex fields=Language "\w{4}(?<myval>)\d{4}" | eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c Result ans = NA myval = English c = US I want the ans = English

Khuzair81 · ‎05-28-2021

@richgalloway c= US Language = abcdENGLISH123qw ..... | rex fields=Language "\w{4}(?<myval>)\d{4}" | eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c Result ans = NA myval = English c = US I want the ans = English

Khuzair81 · ‎05-28-2021

@richgalloway Please help in the below Query c=US, UAE Lang=English, Arabic ........... | rex fields=Lang "(? <myval>)" | eval ans=case(c="US",myval) | table ans, myval I'm getting the 'ans' field as blank while 'myval' field has the Value.

Khuzair81 · ‎05-28-2021

c1 = US, c2 = UAE L1 = English, L2 = Arabic I want to get the answer in "ans" like, If c1= US, then ans= L1 elseif c2 = UAE, then ans= L2

Khuzair81 · ‎05-28-2021

@ITWhisperer Got one more Question field2 = word[abcdefg_123]word I want to get answer as : [abcdefg_123]

Khuzair81 · ‎05-27-2021

field1=abcdCheck:123456wxyz, sdfCheck:234567qwe I want get the result as Check:123456

Khuzair81 · ‎05-16-2021

DROPDOWN - I want to create one dashboard. While creating Country Dropdown I want only those countries in dropdown which my team support(US, UK, AUSTRALIA ETC.) but we are getting data for All countries. Query - index=* country="US" OR country="UK" OR country="AUSTRALIA" | table country | dedup country The above Query give me the perfect result in dropdown. But I want to add one more option "All" in the dropdown which gives me the above mentioned country data only. Is there anyway?

Khuzair81 · ‎09-02-2020

Hi @richgalloway There is one thing common in both event but the column name is different. Event1 : Ticket_no - username123, Event2 : Ticket_no. - TKT123, UserId - username123

Khuzair81 · ‎08-31-2020

Event1 - Ticket_no = username*, id=111 Event2 - Ticket_no = TKT123, Id =0 Is there any way to merge this 2 events to get stats as : Ticket_no= TKT123, id=111

Posts	25
Solutions	0
Karma Given	12
Karma Received	0
Member Since	‎08-31-2020

Online Status	Offline
Date Last Visited	Tuesday

How to compare CSV data with Splunk data?

How to display field value into column?

Regex

Font size

Date

Timezone

Eval

Condition

Rex

Drop-down

Re: Compare CSV data with Splunk Data

How to compare CSV data with Splunk data?

How to display field value into column?

Re: Regex

Regex

Re: Font size

Re: Font size

Re: Font size

Font size

Re: Date

Date

Re: Timezone

Timezone

Eval

Re: Condition

Re: Condition

Condition

Re: Rex

Rex

Drop-down

Re: Merge 2 events

How to merge two events?

Join the Conversation