About VipeRafajzat

VipeRafajzat · ‎12-10-2020

Actually I am looking for real-time data here. After some time the time start to be delayed, so like 10 minutes old data start to show up instead of real-time. If I run the query manually in fast-mode the data showing some delay, but not real time, but when I am running it as verbose, the data is real-time as it should be. The index reads the data from a .csv which is getting updated from a remote system.

VipeRafajzat · ‎12-10-2020

Hello! I have a problem with dashboard reports where the verbose mode shows the latest data, while the fast/smart which is somehow the default, shows like 10 minutes old data. I tried a couple of settings and even change my query, but nothing helped. If I restart the splunk, then the data is ok for a couple of minutes, then it will start to show delayed the data. Does anyone can advise what needs to be changed in order to run always in verbose mode? index=MYINDEX | lookup code_lookup code OUTPUTNEW t_name | eval code=IF(ISNULL(t_name),code,t_name) | lookup v_lookup v OUTPUTNEW v_name | eval v=IF(ISNULL(v_name),v,v_name) | eval CMinutes = ceil(duration / 60) | rex field=d_num mode=sed "s/(\d{4,})[0-9#]{4}$/\1####/g" | rename date as Date-mmddyy, time as Time, tag::cond_code as "CType", c_num as "C Number", d_num as "D Number", duration as "Seconds", CMinutes as "Minutes", code_used as Trunk, vdn as VDN | table Date-mmddyy, Time, "CType", "Seconds", "CMinutes", "CNumber", "DNumber", T, V | fields Date-mmddyy, Time, "CType", "Seconds", "CMinutes", "CNumber", "DNumber", T, V | head 100 | sort -Time Thank you!

VipeRafajzat · ‎11-24-2020

Thank you! It was almost perfect, except that it failed if the last digit was a #, then it was not masked with XXXX then.

VipeRafajzat · ‎11-24-2020

Thank you! This was the solution what I was looking for 🙂

VipeRafajzat · ‎11-24-2020

Hello! I am struggling to mask the last 4 digits of my numbers. | rex field=FIELD_XY mode=sed "s/[0-9#]{3}$/###/g" With this code I am able to mask the last 4 digits of all kind of numbers in my table to ####. So the numbers looking like : 123456####. What I cannot do is to apply this masking only those numbers which are 8 digits or more long. Tried several options and played with regex, but it didn't mask it or over masking everything . Thank you!

VipeRafajzat · ‎11-24-2020

Hi Rich, Thanks for your reply. What I did and solve my problem is the following based on your suggestion: | eval XY = mvappend(field1, field2) | where len(xy_number)=7 Thank you!

VipeRafajzat · ‎11-19-2020

Hi All, I would like to search for a specific 7 character length of data from 2 tables. Within these 2 tables I have multiple data length, so it varies from 1 to 20, but I need only those which are exactly 7 digits/characters long. After I filtered for these 7 digits from these 2 tables, I would like to put them into a common name/ID which I can use for my lookup. Do you have any idea how can I do it and use with the above lookup? The lookup search what I am using is: index=myindex| lookup my_lookup field1 OUTPUTNEW mylookup_name | eval field1=IF(ISNULL(mylookup_name),field1,field2) | rename field1 as "NAME" | chart count by "NAME" | sort -count Do you have any idea how can I do it and use with the above lookup?

Posts	7
Solutions	1
Karma Given	2
Karma Received	0
Member Since	‎11-19-2020

Online Status	Offline
Date Last Visited	‎12-11-2020 08:50 AM

Verbose mode on Dashboard report

Mask the last 4 digits of a number which is 8 digi...

Search 2 tables with limited characters

Re: Verbose mode on Dashboard report

Verbose mode on Dashboard report

Re: Mask the last 4 digits of a number which is 8 ...

Re: Mask the last 4 digits of a number which is 8 ...

Mask the last 4 digits of a number which is 8 digi...

Re: Search 2 tables with limited characters

Search 2 tables with limited characters

Are you a member of the Splunk Community?