Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About xyz123
xyz123
Explorer
Member since:
11-14-2020
06-03-2021
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-14-2020 |
Activity Feed
- Posted Re: What is the max search limit for a macro on Splunk Search. 05-02-2021 05:59 PM
- Tagged What is the max search limit for a macro on Splunk Search. 04-30-2021 06:30 AM
- Tagged What is the max search limit for a macro on Splunk Search. 04-30-2021 06:30 AM
- Posted What is the max search limit for a macro on Splunk Search. 04-30-2021 06:29 AM
- Posted What is the max search limit for a macro on Splunk Search. 04-30-2021 06:28 AM
- Posted Re: evaluate multiple fields on Splunk Search. 02-05-2021 05:45 AM
- Posted Re: evaluate multiple fields on Splunk Search. 02-05-2021 05:43 AM
- Posted evaluate multiple fields on Splunk Search. 02-02-2021 06:23 PM
- Posted Re: how to get last field value by time range picker on Splunk Search. 11-18-2020 10:52 AM
- Got Karma for how to get last field value by time range picker. 11-18-2020 04:24 AM
- Posted Re: how to get last field value by time range picker on Splunk Search. 11-18-2020 03:53 AM
- Posted Re: how to get last field value by time range picker on Splunk Search. 11-16-2020 05:14 AM
- Posted Re: how to get last field value by time range picker on Splunk Search. 11-16-2020 03:11 AM
- Posted Re: how to get last field value by time range picker on Splunk Search. 11-15-2020 05:26 AM
- Posted Re: how to get last field value by time range picker on Splunk Search. 11-15-2020 04:27 AM
- Posted how to get last field value by time range picker on Splunk Search. 11-14-2020 08:00 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
05-02-2021
05:59 PM
hello, the code contains several macros and sub searches what I did was to take out the index=Linux for example out from the macro and now it works, not sure why this set up truncated the search.
... View more
04-30-2021
06:29 AM
Hello, I have a macro that calls other macros in order to have a simple view of the code search. The thing is that when running the macro I'm getting empty values, when I select the key combination control+shIft+e then select Open in New search I get all the results, I have only power user, how can I found out what's going on. Thanks.
... View more
Labels
- Labels:
-
other
04-30-2021
06:28 AM
Hello,
I have a macro that calls other macros in order to have a simple view of the code search. The thing is that when running the macro I'm getting empty values, when I select control+shift+e then select Open in New search I get all the results, I have only power user, how can I found out what's going on. Thanks.
... View more
02-05-2021
05:45 AM
I tried, this but since they are around more than 50 "name" it's going to take a lot of code that's why I went using RegEx, thanks so much for your reply.
... View more
02-05-2021
05:43 AM
I like this solution show my code clean, and yes I'm filtering my fields, "name" and 'short name" at the "index" line, thanks
... View more
02-02-2021
06:23 PM
Hello, I have 2 fields I want to filter they are: name, "short name" I want to pull all the events that contains: name="software" or "short name"=software" and exclude: "Splunk" "Adobe" "Microsoft".. and another 50 names for both fields I have this for the exclusion: | regex name!="(.*)((?i)(splunk|acrobat|microsoft)(.*)"
| regex "short name"!="(.*)((?i)(splunk|acrobat|microsoft)(.*)" One question: is there a way to put this in 1 sentence instead of use duplication like above? for example: | regex (name| "short name")!="(.*)((?i)(splunk|acrobat|microsoft)(.*)" Thanks, xyz123
... View more
11-18-2020
10:52 AM
Thanks so much I've used this code to limit the Close date by making a wide range in time range picker. Appreciate your time.
... View more
11-18-2020
03:53 AM
Hi, could you kindly add the code for the earliest option? Thanks
... View more
11-16-2020
05:14 AM
Hello, thanks for your reply, If I understand what you mean it's to set time range picker for 'All Time' then set the date (Created) range manually like using token for example? It sounds like there's not another way to do this automatically? regards, Xyz123
... View more
11-16-2020
03:11 AM
Hello, unfortunately it didn't work it still gets truncated, again if I put the time range from Nov1-7 to Nov1-14 I get all the values. Here the code again. index=main
| eval _time=strptime(Created,"%Y-%m-%d %H:%M:%S")
| addinfo
| where ((_time >= info_min_time) AND (_time=="+Infinity" OR _time<=info_max_time))
| stats latest(Created) as Created latest(Product) as Product values(Delivered) as Delivered last(Updated) as Updated by Code
... View more
11-15-2020
05:26 AM
Hello, Thanks for your reply, no dashboard for now, I'm tying to get the proper data first. The client's asking for the products list when Created date is within a time range. But I'm getting this products empty since time range is truncated by this time range. Is there another way to show all this data using Created date? I was thinking about transactions but again the last event is not captured. Regards, Xyz123
... View more
11-15-2020
04:27 AM
Hello, Thanks for your question, I have a date field called Create I make Splunk time range picker _time to be the same as this date so it will bring all the events within that range. In this example I took from Nov1-7 The issue is that others fields, like Delivered and Product get updated -after- that time range example in Nov 9, that's why I can see them empty for that time range. I would like to show the final results with all populated. Regards, Xyz123
... View more
11-14-2020
08:00 PM
1 Karma
Hello, What I want to get a table with all fields populated with their last values by time range. For each form I have a field called Created also the field Product that can be filled later or can be left empty. I want to calculate with form has a product value or are empty to get a total percentage. For a time range let's say Created date goes from Nov 1 to Nov 7 the field Product shows empty, but if I add more day at time range like going ahead it gets populated properly, how can I get this last value when taking in count that I just want results within time range Nov1-7 (time range picker), here what I have until now: index=main | eval _time=strptime(Created,"%Y-%m-%d %H:%M:%S") | addinfo | where ((_time >= info_min_time) AND (_time=="+Infinity" OR _time<=info_max_time)) | stats latest(Created) as Created latest(Product) as Product values(Delivered) as Delivered last(Updated) as Updated by Code Code Created Product Delivered Updated 1 A89580 2020-11-02 15:56:20 2020-11-02 20:47:20 2 A23780 2020-11-03 21:18:37 2020-11-04 19:08:12 3 A23826 2020-11-03 21:20:58 2020-11-06 21:21:35 4 A23900 2020-11-03 21:25:05 2020-11-06 21:25:19 If I extend the time range: shows all values for Product and Delivered date I modified last(Update) for values(Update) I can see all the time range for each Code. Just to clarify Product and Delivered fields are independent one of another; after is Delivered, Product can be filled or left empty. Code Created Product Delivered Updated 1 A89580 2020-11-02 15:56:20 PPA89580 2020-11-13 19:39:01 2020-11-02 15:56:24 2020-11-02 19:21:34 2020-11-02 20:47:20 2020-11-10 13:13:06 2020-11-13 19:39:01 2020-11-14 20:01:49 2 A23780 2020-11-03 21:18:37 PPA23780 2020-11-10 02:22:47 2020-11-03 21:18:51 2020-11-04 19:08:12 2020-11-07 19:08:18 2020-11-10 02:19:48 2020-11-10 02:22:47 2020-11-11 03:00:36 3 A23826 2020-11-03 21:20:58 PPA23826 2020-11-12 20:34:07 2020-11-03 21:20:58 2020-11-03 21:21:28 2020-11-06 21:21:35 2020-11-09 21:21:37 2020-11-12 17:56:48 2020-11-12 17:58:36 2020-11-12 20:34:07 2020-11-13 21:01:04 4 A23900 2020-11-03 21:25:05 PPA23900 2020-11-09 21:43:31 2020-11-03 21:25:15 2020-11-06 21:25:19 2020-11-09 13:07:25 2020-11-09 13:09:33 2020-11-09 21:43:31 2020-11-10 22:03:09 Assistance with this will greatly be appreciated. Thank you.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-03-2021
01:09 PM
|
