Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About pstalin_
pstalin_
Engager
Member since:
12-02-2020
12-16-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-02-2020 |
Activity Feed
- Posted Re: how to replace join in this query? on Splunk Search. 12-15-2020 07:59 PM
- Posted Re: how to replace join in this query? on Splunk Search. 12-14-2020 08:08 PM
- Posted Re: how to replace join in this query? on Splunk Search. 12-14-2020 05:35 AM
- Tagged Re: how to replace join in this query? on Splunk Search. 12-14-2020 05:35 AM
- Posted how to replace join in this query? on Splunk Search. 12-14-2020 03:30 AM
- Tagged how to replace join in this query? on Splunk Search. 12-14-2020 03:30 AM
- Posted Re: Hi I have replaced like this, but I'm getting different output on Splunk Search. 12-04-2020 09:08 PM
- Posted Re: Hi I have replaced like this, but I'm getting different output on Splunk Search. 12-03-2020 03:29 AM
- Tagged Re: Hi I have replaced like this, but I'm getting different output on Splunk Search. 12-03-2020 03:29 AM
- Posted How to replace join from the below query? on Splunk Search. 12-02-2020 11:50 PM
- Tagged How to replace join from the below query? on Splunk Search. 12-02-2020 11:50 PM
- Posted How to replace join command with any other alternative command for the below query? on Splunk Search. 12-02-2020 08:52 PM
- Tagged How to replace join command with any other alternative command for the below query? on Splunk Search. 12-02-2020 08:52 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
12-14-2020
08:08 PM
@scelikok "index=168347-np [ | `last_np_sourcetype("index=168347-np","hardware")`] (physicalType=*) | fields physicalElementId deviceId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681 | fields deviceId ] | stats dc(physicalElementId) as Devices" This queries contains the fields physicalElementId deviceId and deviceid has common but U didn't used this in your query I'm getting different answer.
... View more
12-14-2020
03:30 AM
Hi, Anyone please help me in rewplacing join in this below query index=168347-np [ | `last_np_sourcetype("index=168347-np","hardware")`] (physicalType=*) | fields physicalElementId deviceId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=300543 | fields deviceId ] | stats dc(physicalElementId) as Devices
... View more
- Tags:
- remove join
Labels
- Labels:
-
join
12-04-2020
09:08 PM
@bowesmana Hi I have tried the query as u said before but still I'm not getting the exact events count as I got when I used join. Could you please help me in solving this? (index=148031-cli sourcetype=show_system_resources) OR (index=14031-cli sourcetype=show_memory_statistics) OR (index=148031-np sourcetype=device_details) |fields deviceId,memory_used,memory_total,used,total,productFamily, swVersion, deviceName | stats latest(*) as * by deviceId | eval nexus_percent_used=round(100*memory_used/memory_total) | eval nexus_status=if(nexus_percent_used > 85, "Not OK", "OK") | eval ios_percent_used=round(100*used/total) | eval ios_status=if(ios_percent_used > 85, "Not OK", "OK") | eval percent_used=if(like(productFamily, "%Nexus%"), nexus_percent_used, ios_percent_used) | eval status=if(like(productFamily, "%Nexus%"), nexus_status, ios_status) | table deviceName, productFamily, swVersion, percent_used, status | sort -percent_used
... View more
12-03-2020
03:29 AM
(index=148031-cli sourcetype=show_system_resources) OR (index=14031-cli sourcetype=show_memory_statistics) OR (index=148031-np sourcetype=device_details) |fields deviceId,memory_used,memory_total,used,total,productFamily, swVersion, deviceName | stats latest(*) as * by deviceId | eval nexus_percent_used=round(100*memory_used/memory_total) | eval nexus_status=if(nexus_percent_used > 85, "Not OK", "OK") | eval ios_percent_used=round(100*used/total) | eval ios_status=if(ios_percent_used > 85, "Not OK", "OK") | eval percent_used=if(like(productFamily, "%Nexus%"), nexus_percent_used, ios_percent_used) | eval status=if(like(productFamily, "%Nexus%"), nexus_status, ios_status) | table deviceName, productFamily, swVersion, percent_used, status | sort -percent_used
... View more
- Tags:
- replacing join
12-02-2020
11:50 PM
index=105261-cli sourcetype=show_system_resources | dedup deviceId | eval nexus_percent_used=round(100*memory_used/memory_total) | eval nexus_status=if(nexus_percent_used>85, "Not OK", "OK") | fields deviceId, nexus_percent_used, nexus_status | append [ search index=105261-cli sourcetype=show_memory_statistics | dedup deviceId | eval ios_percent_used=round(100*used/total) | eval ios_status=if(ios_percent_used>85, "Not OK", "OK") | fields deviceId, ios_percent_used, ios_status ] | join deviceId [ search index=105261-np sourcetype=device_details | fields deviceId, productFamily, swVersion, deviceName ] | eval percent_used=if(like(productFamily, "%Nexus%"), nexus_percent_used, ios_percent_used) | eval status=if(like(productFamily, "%Nexus%"), nexus_status, ios_status) | table deviceName, productFamily, swVersion, percent_used, status | sort -percent_used
... View more
Labels
- Labels:
-
join
12-02-2020
08:52 PM
index=105261-cli sourcetype=show_processes_cpu pid=0 | dedup deviceId | fields deviceId, idle, fiveMinutes | eval cpuLoad = round(if(isnull(fiveMinutes), 100-idle, fiveMinutes)) | join deviceId [ search index=105261-np sourcetype=device_details | fields deviceId, deviceName, productFamily, swVersion ] | eval Status=if((cpuLoad <85 ), "OK" , "Not OK" ) | table deviceName, productFamily, cpuLoad, swVersion, Status | sort - cpuLoad
... View more
Labels
- Labels:
-
join
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-16-2020
12:21 AM
|
