About amzar96

amzar96 · ‎09-21-2021

hi, do you know any data limitation if we are using "OUTPUT" in the lookup?

amzar96 · ‎09-21-2021

Hi, does anyone here faces the same issue? Below is my sample query for reference. | makeresults | eval statename= "Selangor" | eval mega="state" | lookup type.csv mega as megas OUTPUT WP_Kuala_Lumpur_list, WP_Putrajaya_list, Johor_list, Kedah_list, Kelantan_list, Melaka_list, Negeri_Sembilan_list, Pahang_list, Perak_list, Pulau_Pinang_list, Sabah_list, Sarawak_list, Selangor_list, Terengganu_list, Perlis_list | eval res= case(statename= "Kuala Lumpur", WP_Kuala_Lumpur_list, statename= "Putrajaya", WP_Putrajaya_list, statename= "Johor", Johor_list, statename= "Kedah", Kedah_list, statename= "Kelantan", Kelantan_list, statename= "Melaka", Melaka_list, statename= "Negeri Sembilan", Negeri_Sembilan_list, statename= "Pahang", Pahang_list, statename= "Perak", Perak_list, statename= "Pulau Pinang", Pulau_Pinang_list, statename= "Sabah", Sabah_list, statename= "Sarawak", Sarawak_list, statename= "Selangor", Selangor_list, statename= "Terengganu", Terengganu_list, statename= "Perlis", Perlis_list) | table res In the lookup, Selangor_list has more than 60 rows. But, when I ran the query it just show me 33 rows. then, I figure out if run the query with less OUTPUT it is able to show the correct data. May I know any limitations on this?

amzar96 · ‎12-06-2020

Hi all, I have stuck in this problem a long time ago. I do not know how to fix this since I do not have privilege to check the limit.conf The problem is: When someone who can view & create report/dashboard run the dashboard, can get an accurate result (900K row) When someone who only can view only dashboard/report run the dashboard, the result not showing the same result as number 1 (67K row) I'm not sure this is related or not to the limit.conf. But, do you guys thinks this is make sense? I have changed a lot of XML to fix this. But all same. I have no idea right now. FYI, the load job/savedsearch return around 2M row data with 48M event.

amzar96 · ‎09-07-2020

Hi @ansif , let say in this situation I have different domain-name table 1: domain-name-a table 2: domain-name-b then, how can I do to join the both query? Thanks

amzar96 · ‎09-04-2020

Understand @rnowitzki . However, I can't retrieve any data from the second search (2nd table). when I query, it give me blank row.

amzar96 · ‎09-04-2020

Thanks @rnowitzki , you saved my life! I can run with both query. But, i didn't understand how stats work. | stats values(*) as * by serial_id what meant by this above query?

amzar96 · ‎09-03-2020

Hi everyone, I am new with Splunk but I have a knowledge in SQL. I got a new problem with my search query which is can I use the data from first searching in next searching in the same query? Example: 1) index=abc sourcetype="abc:scanning" status="new_scanning" | table serial_id, action serial_id action 6577 drive 8872 swim 2) index=abc sourcetype="abc:viewing" status="new_viewing" | table serial_id, person_in_charge, total_person serial_id person_in_charge total_person 6577 Tom 45 8872 Giga 23 may I know what is the best way to get this kind of output? serial_id person_in_charge total_person action 6577 Tom 45 drive 8872 Giga 23 swim My idea is to use join or append but I do not know how to "serial_id" in the second searching. Thanks in advance 😀

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎09-03-2020

Online Status	Offline
Date Last Visited	‎09-22-2021 01:49 AM

Limit on LOOKUP when use OUTPUT

loadjob not show all result in dashboard

How do I combine query and use the certain data fr...

Re: Understanding the LOOKUP command

Limit on LOOKUP when use OUTPUT

loadjob not show all result in dashboard

Re: Append search filtering in the second search b...

Re: How do I combine query and use the certain dat...

Re: How do I combine query and use the certain dat...

How do I combine query and use the certain data fr...