Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Minghao
Minghao
Explorer
Member since:
12-04-2020
03-10-2022
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 12-04-2020 |
Activity Feed
- Posted Re: Is it possible to speed up the search or improve the running performance by increasing the number of sourcetype on Splunk Search. 03-10-2022 01:46 AM
- Posted Re: Is it possible to speed up the search or improve the running performance by increasing the number of sourcetype on Splunk Search. 03-10-2022 01:45 AM
- Posted Re: Is it possible to speed up the search or improve the running performance by increasing the number of sourcetype on Splunk Search. 03-08-2022 08:40 PM
- Posted Re: Is it possible to speed up the search or improve the running performance by increasing the number of sourcetype on Splunk Search. 03-08-2022 08:31 PM
- Posted Is it possible to speed up the search or improve the running performance by increasing the number of sourcetype on Splunk Search. 03-07-2022 08:18 PM
- Posted Re: How to find the perple who leave in the next day on Splunk Search. 02-07-2021 06:44 PM
- Posted Re: How to find the perple who leave in the next day on Splunk Search. 02-07-2021 06:43 PM
- Posted How to find the perple who leave in the next day on Splunk Search. 02-07-2021 05:13 AM
- Posted Re: How to normalize the timechart data by time on Splunk Enterprise Security. 12-22-2020 04:13 AM
- Karma Re: How to normalize the timechart data by time for somesoni2. 12-22-2020 04:09 AM
- Posted Re: How to normalize the timechart data by time on Splunk Enterprise Security. 12-22-2020 04:06 AM
- Karma Re: How to normalize the timechart data by time for to4kawa. 12-22-2020 04:05 AM
- Posted How to normalize the timechart data by time on Splunk Enterprise Security. 12-04-2020 01:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-10-2022
01:46 AM
Thank you all the same!
... View more
03-10-2022
01:45 AM
Thank you for your patient answer, and it's a great help for me and my team! I want to express the depth of my gratitude to you!
... View more
03-08-2022
08:40 PM
HI @gcusello , Thank you for your answer! I think that my not clear enough description that confused you. Actually, I wonder whether a additional sourcetype can speed up search compared with using a field value. Another answer has solved my problem. Thank you again!
... View more
03-08-2022
08:31 PM
Thank you for your detail introduction which very useful for me to understand the basics of splunk search and your introduction actually solved my question about the performance optimizition. Just to make sure I get your points, can I summary that the way to speeding up search in splunk are narrowing the time window and specifying the fields as strict as possible? Thanks again！
... View more
03-07-2022
08:18 PM
I have a log like below: index=login sourcetype=login new_user=1 I also have logs without new_user label index=login sourcetype=aa What's the difference between I search which specify the sourcetype index=login sourcetype=login new_user=1 and do not specify the sourcetype just using new_user like index=login new_user=1 I wonder which one is faster or perform better and why? And if I make new_user=1 as a sourcetype, does index=login sourcetype=new_user better than index=login sourcetype=login new_user=1 Thank you in advance
... View more
Labels
- Labels:
-
other
02-07-2021
06:44 PM
Thank you very much, I have post it and in where flt means the first login time which I think is very useful
... View more
02-07-2021
06:43 PM
The login log is like below: 2021-02-07 21:39:40 id=1001,flt=2021-01-11 00:05:18, ip=xxx.xx.xxx.xx,device=xxx
... View more
02-07-2021
05:13 AM
We have a game and login log. I want to anyalize the people that login today and don't login tommorow, which is to analyze what effect the 1-day retention. BUT, I can't find these leaved people. I think maybe I can use NOT command or JOIN INNER command, however I failed.
... View more
Labels
- Labels:
-
join
12-22-2020
04:13 AM
bucket also works for me ! Thank you very much!
... View more
12-22-2020
04:06 AM
It does works! Thank you very much!
... View more
12-04-2020
01:50 AM
I use the timechart to analyze the data and I want to normalize the data in the timechart ... | timechart span=3d count by step What I get is like: _time 1 2 3 11/2 2 3 4 11/3 3 4 5 And I want to divide the max value of each row and get like this: _time 1 2 3 11/2 0.5 0.75 1 11/3 0.6 0.8 1 How can I get this? Thank a lot in advance
... View more
Labels
- Labels:
-
troubleshooting
