Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nits
nits
Explorer
Member since:
10-02-2020
03-03-2021
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-02-2020 |
Activity Feed
- Posted Filter records from Table based on a column value as a number on Splunk Search. 03-03-2021 10:36 AM
- Got Karma for Re: How to exclude the results from subsearch. 02-18-2021 10:59 PM
- Posted How to exclude the results from main search that matches with sub search on Splunk Search. 10-08-2020 11:29 AM
- Posted Re: Can I exclude results from a subsearch from my main search? on Splunk Search. 10-08-2020 10:52 AM
- Posted Re: How to exclude the results from subsearch on Splunk Search. 10-08-2020 10:02 AM
- Posted Re: How to exclude the results from subsearch on Splunk Search. 10-08-2020 08:25 AM
- Posted Re: How to use where clause with table containing fields within quotes on Getting Data In. 10-07-2020 02:29 PM
- Tagged How to exclude the results from subsearch on Splunk Search. 10-07-2020 02:28 PM
- Tagged How to exclude the results from subsearch on Splunk Search. 10-07-2020 02:28 PM
- Tagged How to exclude the results from subsearch on Splunk Search. 10-07-2020 02:28 PM
- Posted How to exclude the results from subsearch on Splunk Search. 10-07-2020 01:52 PM
- Tagged How to exclude the results from subsearch on Splunk Search. 10-07-2020 01:52 PM
- Tagged How to use where clause with table containing fields within quotes on Getting Data In. 10-02-2020 01:59 PM
- Tagged How to use where clause with table containing fields within quotes on Getting Data In. 10-02-2020 01:59 PM
- Posted How to use where clause with table containing fields within quotes on Getting Data In. 10-02-2020 01:58 PM
- Tagged How to use where clause with table containing fields within quotes on Getting Data In. 10-02-2020 01:58 PM
- Tagged How to use where clause with table containing fields within quotes on Getting Data In. 10-02-2020 01:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-03-2021
10:36 AM
Here is my Splunk Query: index=test "Entry Done for Id=" | rex field=_raw Id=(?<Id>.*?)# | rex field=_raw UserID=(?<UserId>.*?)# | rex field=_raw Amount=(?<Amount>.*?)# | rex field=_raw PercentageAmount=(?<PercentageAmount>.*?)# | stats list(Id) as "Unique Id" list(UserID) as "User ID" list(Amount) as "Given Amount" list(PercentageAmount) as "Override Amount" | table "Unique ID" "User ID" "Given Discount" "Override Amount" I want to filter those records from this table which has Given Amount>50.00 OR Override Amount>90.00 Note: Given Amount and Override Amount can be in decimal.
... View more
Labels
- Labels:
-
field extraction
-
fields
-
lookup
-
stats
10-08-2020
11:29 AM
Here is my problem statement: 1st Query: index=test "TestRequest" | dedup _time | rex field=_raw "Price\":(?<price>.*?)," | rex field=_raw REQUEST-ID=(?<REQID>.*?)\s | rex field=_raw "Amount\":(?<amount>.*?)}," | rex field=_raw "ItemId\":\"(?<itemId>.*?)\"}" | eval discount=round(exact(price-amount),2) , percent=(discount/price)*100 , time=strftime(_time, "%m-%d-%y %H:%M:%S") | stats list(time) as Time list(itemId) as "Item" list(REQID) as X-REQUEST-ID list(price) as "Original Price" list(amount) as "Test Price" list(discount) as "Dollar Discount" list(percent) as "Percent Override" by _time | join X-REQUEST-ID [search index=test "UserId=" | rex field=_raw UserId=(?<userId>.*?)# | dedup userId | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time] Sample Output: Time User Id Item X-REQUEST-ID Original Price Test Price Dollar Discount Percent Override 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 2nd Query: search index=test "Remove Completed for" | rex field=_raw UserId=(?<userId>.*?)# | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time Sample Output: User Id 4 3rd Query: search index=test "Clear Completed for" | rex field=_raw UserId=(?<userId>.*?)# | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time Sample Output: User Id 5 I want the final output as Time UserId Item X-REQUEST-ID Original Price Test Price Dollar Discount Percent Override 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 The above output is excluding the results of 2nd Query and 3rd Query from main search query result (1st Query) based on the field value of "User Id". So if "User Id" found in 1st Query also found in either 2nd Query and 3rd Query then exclude that "User Id" row from main result 1st Query.
... View more
Labels
- Labels:
-
join
-
lookup
-
search job inspector
-
stats
-
subsearch
10-08-2020
10:52 AM
@splunkoverflow @pcombs001 @kamlesh_vaghela Can anyone answer to this. I have problem on similar pattern. Here is my problem summary with sample queries and outputs: My 1st query will return: 1st Query: index=test "TestRequest" | dedup _time | rex field=_raw "Price\":(?<price>.*?)," | rex field=_raw REQUEST-ID=(?<REQID>.*?)\s | rex field=_raw "Amount\":(?<amount>.*?)}," | rex field=_raw "ItemId\":\"(?<itemId>.*?)\"}" | eval discount=round(exact(price-amount),2) , percent=(discount/price)*100 , time=strftime(_time, "%m-%d-%y %H:%M:%S") | stats list(time) as Time list(itemId) as "Item" list(REQID) as X-REQUEST-ID list(price) as "Original Price" list(amount) as "Test Price" list(discount) as "Dollar Discount" list(percent) as "Percent Override" by _time | join X-REQUEST-ID [search index=test "UserId=" | rex field=_raw UserId=(?<userId>.*?)# | dedup userId | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time] Sample Output: Time User Id Item X-REQUEST-ID Original Price Test Price Dollar Discount Percent Override 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 2nd Query: search index=test "Remove Completed for" | rex field=_raw UserId=(?<userId>.*?)# | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time Sample Output: User Id 4 3rd Query: search index=test "Clear Completed for" | rex field=_raw UserId=(?<userId>.*?)# | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time Sample Output: User Id 5 I want the final output as below: Time User Id Item X-REQUEST-ID Original Price Test Price Dollar Discount Percent Override 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 The above output is excluding the results of 2nd Query and 3rd Query from main search query result (1st Query) based on the field value of "User Id". So if "User Id" found in 1st Query also found in either 2nd Query and 3rd Query then exclude that "User Id" row from main result 1st Query.
... View more
10-08-2020
10:02 AM
1 Karma
@ITWhisperer Basically want equivalent of SELECT column_name(s) FROM table_name WHERE column_name NOT IN (SELECT STATEMENT);
... View more
10-08-2020
08:25 AM
@ITWhisperer My 1st query will return: 1st Query: index=test "TestRequest" | dedup _time | rex field=_raw "Price\":(?<price>.*?)," | rex field=_raw REQUEST-ID=(?<REQID>.*?)\s | rex field=_raw "Amount\":(?<amount>.*?)}," | rex field=_raw "ItemId\":\"(?<itemId>.*?)\"}" | eval discount=round(exact(price-amount),2) , percent=(discount/price)*100 , time=strftime(_time, "%m-%d-%y %H:%M:%S") | stats list(time) as Time list(itemId) as "Item" list(REQID) as X-REQUEST-ID list(price) as "Original Price" list(amount) as "Test Price" list(discount) as "Dollar Discount" list(percent) as "Percent Override" by _time | join X-REQUEST-ID [search index=test "UserId=" | rex field=_raw UserId=(?<userId>.*?)# | dedup userId | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time] Sample Output: Time User Id Item X-REQUEST-ID Original Price Test Price Dollar Discount Percent Override 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 2nd Query: search index=test "Remove Completed for" | rex field=_raw UserId=(?<userId>.*?)# | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time Sample Output: User Id 4 3rd Query: search index=test "Clear Completed for" | rex field=_raw UserId=(?<userId>.*?)# | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time Sample Output: User Id 5 I want the final output as Time UserId Item X-REQUEST-ID Original Price Test Price Dollar Discount Percent Override 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 The above output is excluding the results of 2nd Query and 3rd Query from main search query result (1st Query) based on the field value of "User Id". So if "User Id" found in 1st Query also found in either 2nd Query and 3rd Query then exclude that "User Id" row from main result 1st Query.
... View more
10-07-2020
02:29 PM
@ITWhisperer Thanks, this works
... View more
10-07-2020
01:52 PM
I have one query which looks like: Query1: index=test "TestRequest" | dedup _time | rex field=_raw "Price\":(?<price>.*?)," | rex field=_raw REQUEST-ID=(?<REQID>.*?)\s | rex field=_raw "Amount\":(?<amount>.*?)}," | rex field=_raw "ItemId\":\"(?<itemId>.*?)\"}" | eval discount=round(exact(price-amount),2) , percent=(discount/price)*100 , time=strftime(_time, "%m-%d-%y %H:%M:%S") | stats list(time) as Time list(itemId) as "Item" list(REQID) as X-REQUEST-ID list(price) as "Original Price" list(amount) as "Test Price" list(discount) as "Dollar Discount" list(percent) as "Percent Override" by _time | join X-REQUEST-ID [search index=test "UserId=" | rex field=_raw UserId=(?<userId>.*?)# | dedup userId | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time] I have another 2 queries which looks like: Query2: search index=test "Remove Completed for" | rex field=_raw UserId=(?<userId>.*?)# | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time Query3: search index=test "Clear Completed for" | rex field=_raw UserId=(?<userId>.*?)# | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time I want to exclude the results from Query1 that are matching the results from Query2 and Query3 based on column "User Id" which is present in all three queries. How can i do that?
... View more
10-02-2020
01:58 PM
I have a query which looks like: index=test "TestRequest" | dedup _time | rex field=_raw "Price\":(?<price>.*?)," | rex field=_raw REQUEST-ID=(?<REQID>.*?)\s | rex field=_raw "Amount\":(?<amount>.*?)}," | rex field=_raw "ItemId\":\"(?<itemId>.*?)\"}" | eval discount=round(exact(price-amount),2) , percent=(discount/price)*100 , time=strftime(_time, "%m-%d-%y %H:%M:%S") | stats list(time) as Time list(itemId) as "Item" list(REQID) as X-REQUEST-ID list(price) as "Original Price" list(amount) as "Test Price" list(discount) as "Dollar Discount" list(percent) as "Percent Override" by _time [search index=test "UserId=" | rex field=_raw UserId=(?<userId>.*?)# | dedup userId | rex field=_raw X-REQUEST-ID=(?<REQID>.*?)\s | stats list(userId) as "User ID" list(REQID) as X-REQUEST-ID by _time] | where "Dollar Discount">=500.00 OR "Percent Override">=50.00 | table "User ID" Item "Original Price" "Dollar Discount" "Test Price" "Percent Override" Time This query throws error as mismatch type for "Dollar Discount">=500.00 OR "Percent Override">=50.00 Since my fields in the table have "" e.g. "Dollar Discount" or "Percent Override", it doesn't work. If i replace these fields names without quotes as Dollar_Discount and Percent_Override, it works fine. how to use a table field with name listed in quotes in where clause?
... View more
Labels
- Labels:
-
field extraction
-
host
-
index
-
indexer
-
source
-
sourcetype
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-03-2021
02:13 PM
|
