Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Annna
Annna
Explorer
Member since:
10-08-2020
03-29-2021
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 10-08-2020 |
Activity Feed
- Posted Re: how to calculate 2 events with same values difference on Splunk Dev. 03-29-2021 06:30 AM
- Karma Re: how to calculate 2 events with same values difference for ITWhisperer. 03-29-2021 06:29 AM
- Posted how to calculate 2 events with same values difference on Splunk Dev. 03-26-2021 04:48 AM
- Posted Re: For Xml data join 2 tables with different fields on Splunk Search. 03-02-2021 10:09 AM
- Posted Re: Split 2 fields into each rows on Splunk Search. 03-02-2021 06:22 AM
- Karma Re: For Xml data join 2 tables with different fields for ITWhisperer. 03-02-2021 06:21 AM
- Posted Re: For Xml data join 2 tables with different fields on Splunk Search. 03-01-2021 09:45 AM
- Posted Re: For Xml data join 2 tables with different fields on Splunk Search. 03-01-2021 08:17 AM
- Posted Re: For Xml data join 2 tables with different fields on Splunk Search. 03-01-2021 07:10 AM
- Posted Re: For Xml data join 2 tables with different fields on Splunk Search. 03-01-2021 06:31 AM
- Posted Re: For Xml data join 2 tables with different fields on Splunk Search. 03-01-2021 06:10 AM
- Posted Re: For Xml data join 2 tables with different fields on Splunk Search. 03-01-2021 01:53 AM
- Posted Split 2 fields into each rows on Splunk Search. 02-27-2021 10:25 PM
- Posted For Xml data join 2 tables with different fields on Splunk Search. 02-26-2021 10:10 AM
- Posted Re: Xml path extract field on Splunk Search. 02-25-2021 09:27 AM
- Posted Xml path extract field on Splunk Search. 02-23-2021 06:45 AM
- Posted Re: Need help on rex on Splunk Search. 12-30-2020 04:47 AM
- Posted Need help on rex on Splunk Search. 12-30-2020 04:33 AM
- Posted Re: How can i split the multiple events into fields and one field must be dynamic. on Splunk Cloud Platform. 10-09-2020 12:11 AM
- Posted Re: How can i split the multiple events into fields and one field must be dynamic. on Splunk Cloud Platform. 10-08-2020 11:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-26-2021
04:48 AM
i am looking difference of 2 events in one source file and those events having same values and have to calculate difference. After append search got below values. _time Customer order 2021-03-25 08:30:28.485 123456 2021-03-25 03:53:57.201 123457 2021-03-25 04:43:50.254 123458 2021-03-25 12:59:31.464 123459 2021-03-25 08:30:28.485 123456 2021-03-25 03:53:57.201 123457 2021-03-25 04:48:50.254 123458 2021-03-25 12:59:31.464 123451 2021-03-25 22:59:31.464 123452 2021-03-25 04:59:31.464 123454 2021-03-25 04:59:33.464 123454 2021-03-25 05:00:31.464 123454 2021-03-25 05:05:31.464 123454 2021-03-25 05:10:35.464 123454 Output be like: Starttime EndTime ID (Start- END)Diff 2021-03-25 08:30:28.485 2021-03-25 08:30:28.485 123456 2021-03-25 03:53:57.201 2021-03-25 03:53:57.201 123457 2021-03-25 04:43:50.254 2021-03-25 04:48:50.254 123458 2021-03-25 04:59:31.464 2021-03-25 04:59:33.464 123454 2021-03-25 05:05:31.464 2021-03-25 05:10:35.464 123454 i am trying to take like below but all values are not coming properly and after calculating the difference i have to visualization greater than 10 mins chart. base search | table _time customer | rename customer as ID _time as Starttime | append [search base search |table _time order | rename order as ID _time as Endtime ] | table Starttime Endtime ID | stats count as new values(*) as * by ID | eval new1=mvzip(Starttime, Endtime) | mvexpand new1 | makemv delim="," new1 | eval Starttime1=mvindex(new1,0) | eval Endtime1=mvindex(new1,1) | table Senttime1 Endtime1 ID new Thanks in advance.
... View more
Labels
- Labels:
-
other
03-02-2021
10:09 AM
Thank you so much for the help.
... View more
03-02-2021
06:22 AM
If the data be like this A B C D 288813 1 45456 car 388812 1 2 3 4 45456 12312 78978 12454 car Rose Toy Bus 484784 1 2 3 12312 78978 12454 Rose Toy Bus IN above scenario how it works split for the rows. output be like: A B C D 288813 1 45456 car 388812 1 45456 car 388812 2 12312 Rose 388812 3 78978 Toy 388812 4 12454 Bus 484784 1 12312 Rose 484784 2 78978 Toy 484784 3 12454 Bus
... View more
03-01-2021
09:45 AM
See above screenshot, giving eval logic values are not coming. That image was which I tried earlier and now I shared
... View more
03-01-2021
08:17 AM
sorry i wrongly copied the results, i am keeping the mvexpand command inside only. Suggested query no results found Mvexpand inside the join results. Its not showing correctly. MY expecting output be like after giving where N_PrimeNo = PNO1 LineNo N_PrimeNo PNO1 N_Code 288136957 1 1 66871812 588136313 1 1 66871812 588136313 3 3 65602005 588136313 4 4 69101805 488136313 1 1 66871812 488136313 2 2 65252707 488136313 3 3 65602005 488136313 4 4 69101805
... View more
03-01-2021
07:10 AM
Sorry, Its not working out. With the below query i am getting results like that. index=A earliest=-120d@d latest=now | dedup LineNo | eval new=mvzip(PrimeNo, Code) | mvexpand new | makemv delim="," new | eval N_PrimeNo=mvindex(new,0) | eval N_Code=mvindex(new,1) | table LineNo N_PrimeNo N_Code | join LineNo [search index=B | dedup Order | rex max_match=0 "(?<ShipLine>ShipLine)\s" | search ShipLine=ShipLine | rex max_match=0 "ShipLine PrimeLineNo\=\"(?<PNO1>.*). Q" | table LineNo PNO1] | table LineNo N_PrimeLineNo PNO1 N_Code | mvexpand PNO1 MY expecting output be like after giving where N_PrimeNo = PNO1 LineNo N_PrimeNo PNO1 N_Code 288136957 1 1 66871812 588136313 1 1 66871812 588136313 3 3 65602005 588136313 4 4 69101805 488136313 1 1 66871812 488136313 2 2 65252707 488136313 3 3 65602005 488136313 4 4 69101805
... View more
03-01-2021
06:31 AM
after Joining with 2 tables mvexpand is not working. Results not found | mvexpand PNO1 that mvexpand while using individual table its worked out. While joining 2 tables only its not split
... View more
03-01-2021
06:10 AM
NO, its not giving any results because joined with "lineprime" Because lineprime is not populating properly in the second table. see below:
... View more
03-01-2021
01:53 AM
after joining 2 tables my result is like below and shipline prime is not split properly, using mvexpand also no use. i tried many ways but no use. Using below query getting output like below and help me with correct one index=A earliest=-120d@d latest=now | dedup LineNo | eval new=mvzip(PrimeNo, Code) | mvexpand new | makemv delim="," new | eval N_PrimeNo=mvindex(new,0) | eval N_Code=mvindex(new,1) | table LineNo N_PrimeNo N_Code | join LineNo [search index=B | dedup Order | rex max_match=0 "(?<ShipLine>ShipLine)\s" | search ShipLine=ShipLine | rex max_match=0 "ShipLine PrimeNo\=\"(?<PNO1>.*). Q" | table LineNo PNO1] | table LineNo N_PrimeNo PNO1 N_Code | mvexpand PNO1 but i need final output be like:
... View more
02-27-2021
10:25 PM
How to have split, i tired many ways but its coming out. Output: A B C 288136957 1 66871812 288137548 1 62919303 288137548 2 69101805 288137548 3 84124302 488136313 1 66871812 488136313 2 65252707 488136313 3 65602005 488136313 4 69101805 Thanks for the help.
... View more
Labels
- Labels:
-
other
02-26-2021
10:10 AM
Table A: <Type LineNo="589123363" > <Type> <OrderLine Line="6" PrimeNo="3" S="2"> Code="75602005" /> </OrderLine> <OrderLine Line="6" PrimeNo="4" S="3"> Code="95602015" /> </OrderLine> <OrderLine Line="6" PrimeNo="2" S="4"> Code="65602025" /> </OrderLine> <OrderLine Line="6" PrimeNo="1" S="5"> Code="55602305" /> </OrderLine> <OrderLine Line="6" PrimeNo="5" S="6"> Code="65602405" /> </OrderLine> Table B: <Type LineNo="589123363" > <Type> <ShipLines> <ShipLine PrimeNo="2" Q="1"/> <ShipLine PrimeNo="3" Q="2"/> <ShipLine PrimeNo="4" Q="4"/> <ShipLine PrimeNo="1" Q="3"/> </ShipLines> Need to join above 2 tables with LineNo, PrimeNo and get the code. I tired but values is not coming properly in one table values are coming in horizontal and second table values coming vertical. please help me out. Output: LineNo PrimeNo Code 589123363 1 55602305 589123363 2 65602025 589123363 3 75602005 589123363 4 95602015
... View more
Labels
- Labels:
-
join
02-23-2021
06:45 AM
<Shipment Action> <ShipmentLines> <ShipmentLine PrimeLine="2" /> <ShipmentLine PrimeLine="3"/> <ShipmentLine PrimeLine="4"/> <ShipmentLine PrimeLine="1"/> </ShipmentLines> </Shipment Action> in the above xml file i have to pick out the ShipmentLine count, some times ShipmentLine increases. I have tried different rex combination without luck, any suggestions. output: ShipmentLine=4 count
... View more
Labels
- Labels:
-
other
12-30-2020
04:33 AM
wed } } }, { "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00" open "S" : "12:00" } } } } }, "email" : { "S" : " DHours" } } }, "email" : { "S" : " Hours" } } }] | rex "wed.\D}.\D.\D.(?<sample>.*)DHours i used above rex and gives the result like { "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00"open "S" : "12:00" } } } } }, "email" : { "S" : " but i need below output Result should be like { "S" : "12:00" } } }, "day" M" : { "close" : { "S" : "23:00"open "S" : "12:00" } } } } }
... View more
Labels
- Labels:
-
rex
10-09-2020
12:11 AM
Its working Awesome. Thank you so much 😊
... View more
10-08-2020
11:55 AM
Thank you so much. It is very helpful. If the event will be as below means Abc|cbde1|elog|700|6|1|1|126G7|1907|1|1|126G7|19079|1|1|126G77|190795|1|1|126G7|190795|1|1|126G|1907|1|1|126G|1907 How can I slipt from |6 onwards. Once again, thanks quick response.
... View more
10-08-2020
06:21 AM
thank you so much for quick response.
... View more
10-08-2020
06:20 AM
this is my sample events |6|1|1|126G7|1907|1|1|126G7|19079|1|1|126G77|190795|1|1|126G7|190795|1|1|126G|1907|1|1|126G|1907 |7|1|1|126G7|19076|1|1|126G7|19079|1|1|126G77|190795|1|1|126G7|190795|1|1|126G|1907|1|1|126G|19078|1|1|126G7|19078| i want output be like 6 1 1 650_3M 1921 1 1 1758 749 1 1 55 22 1 1 55 33 1 1 55 55 1 1 55 66 7 1 1 650_3M 1921 1 1 1758 749 1 1 55 22 1 1 55 33 1 1 55 55 1 1 55 66 1 1 55 66 3 1 1 55 66 1 1 55 66 1 1 55 66
... View more
10-08-2020
04:23 AM
my event is below : 6|1|1|12|1907|1|1|1219079|1|1|126G|19079|1|1|12NB|190|1|1|126G774_100_NB|1907|1|1|126G|19079 sometimes A field will change the number as 5, 7, 8 like 5rows and 7 rows will come so that A is dynamic. A B C D E 6 1 1 650_3M 1921 1 1 1758 749 1 1 55 22 1 1 55 33 1 1 55 55 1 1 55 66
... View more
Labels
- Labels:
-
development
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-29-2021
06:30 AM
|
