About cros

cros · ‎02-09-2021

@ITWhisperer thank you for your quick answer. I added the sort as you recommend it. | sort "Record Number", "PI Number", time It seems to works well thank you

cros · ‎02-09-2021

Hi all, I'm creating couple of events with command : | streamstats window=2 list(PI_Event_Status) as status list(PI_Event_Time) as time list("PI Event Severity") as severity list("PI Event Urgency") as urgency by "Record Number", "PI Number" I notice that when i execute my command only on one "Record Number" (record number is an id) the command works as expected : But when i execute the command on all index the command works partially : Do you know why ? Regards, Clément

cros · ‎01-20-2021

Hi, Here is my raw data : ID, Version, Date, Status 10874381,1,2020-01-15T08:36:00Z,New 10874381,1,2020-01-15T08:46:00Z,Completed - Action Performed 14688643,1,2016-10-06T06:30:00Z,New 14688643,1,2016-10-07T08:32:00Z,Investigating 14688643,1,2016-10-24T15:10:00Z,Completed - Nothing Found I need to create another field for adding informations to this data. To do that i need to create couple of data. Record Number | Status 1 | Status 2 | Result 10874384 | New | Completed - Action Perfomed | Completed Actions 14688643 | New | Investigating | Work 14688643 | Investigating| Completed - Nothing Found | Completed I can not know in advance how many status could be by id (maybe 1, 2, 7 or more). I do not know how to create couple with two different event in splunk. Regards, Clement

cros · ‎01-19-2021

I'm still working on it. I'm now in this part : index=_internal | head 1 | fields _raw | eval _raw="Status A, B, A A, A, B B, B, A B, A, B" | multikv forceheader=1 | eval Status=trim(split(Status,",")) | rename COMMENT as "the logic" | eval State = Status | foreach State [ eval <<FIELD>>=case(mvdedup(<<FIELD>>)="A" AND mvcount(mvdedup(<<FIELD>>))=1,"Value_1" ,mvdedup(<<FIELD>>)="B" AND mvcount(mvdedup(<<FIELD>>))=1,"Value_4" ,mvfind(<<FIELD>>,"A")=0,"Value_2" ,mvfind(<<FIELD>>,"B")=0,"Value_3") | eval remove_index=0,tail=mvindex(<<FIELD>>,(remove_index+1),mvcount(<<FIELD>>)-1),<<FIELD>>=tail] | nomv Status | streamstats count as Event | table Event Status State The following part is for delete the first value of the multivalue field in order to be able to compare each time the first value and the second. eval remove_index=0,tail=mvindex(<<FIELD>>,(remove_index+1),mvcount(<<FIELD>>)-1),<<FIELD>>=tail but this solution do no work. Any idea ?

cros · ‎01-19-2021

Hi @to4kawa , I think your solution may be good thank you. My only concern is about the number of status. In my example i gave only 3 status for each event. But in reality, the number of status can be different for each event (1, 2, 5, or even more). How can i do to manage this ?

cros · ‎01-13-2021

Hi all, My data is logging of support ticket. i retrieved all the change state of each ticket with the transaction command. This command output a list of status for each ticket id. What I'm trying to do is to compare each pair of Ticket status in order to create a state for management. I have this matrix explaining states for all pair of values : A B A Value1 Value2 B Value3 Value4 To accomplish this work, I'm using case statement : state=case(match(mvindex(status, 0), "^A$") AND match(mvindex(status, 1), "^A$"), "Value1", match(mvindex(status, 0), "^A$") AND match(mvindex(status, 1), "^B$"), "Value2", match(mvindex(status, 0), "^B$") AND match(mvindex(status, 1), "^A$"), "Value3", match(mvindex(status, 0), "^B$") AND match(mvindex(status, 1), "^B$"), "Value4") For sure my real matrix is much bigger than this. It's why I'm searching an other way to do it. My expected result is a table like this : Event Status State 1 A, B, A Value2, Value3 2 A, A, B Value1, Value2 3 B, B, A Value4, Value3 4 B, A, B Value3, Value2 regards, clement

cros · ‎01-08-2021

Hi all, I'm trying to create a visualisation to show the percentage of ticket status (New, Comleted, Cancelled, etc.). I tried with this search : | stats latest(_time) as Time by "Record Number", PI_Number, PI_Event_Status I have ticket with Record Number (id), Number (Version), Status. I want to take the last ticket event of the version and get his status. In order to count the current status of each event on the system. The result is the following : Record Number Number Status _time 11867114 1 Completed - Owner Action Required 1472175180 11867114 1 New 1471951740 12297522 1 Completed - Nothing Found 1477321800 12297522 1 Investigating 1475829120 12297522 1 New 1475735400 12297522 2 Completed - Error/Workaround Found 1479229260 12297522 2 New 1479198300 12297522 3 Completed - Recovery PTR Open 1482241320 12297522 3 New 1482226920 With my stats command i'm not able to retrieve only last event for each version of a ticket. How i can do that ? Regards, Clément

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎11-19-2020

Online Status	Offline
Date Last Visited	‎02-10-2021 12:13 AM

Splunk search bug on all data index but work well ...

How to create couple of values in order to compare...

How to add value based on matrix comparison

Count Last event by id and version

Re: Splunk search bug on all data index but work w...

Splunk search bug on all data index but work well ...

How to create couple of values in order to compare...

Re: How to add value based on matrix comparison

Re: How to add value based on matrix comparison

How to add value based on matrix comparison

Count Last event by id and version

Are you a member of the Splunk Community?