Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About bcouavoux
bcouavoux
Explorer
Member since:
02-11-2021
05-11-2021
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 02-11-2021 |
Activity Feed
- Karma Re: Sum latest value multiple field with timechart for kamlesh_vaghela. 05-07-2021 06:21 AM
- Posted Re: Sum latest value multiple field with timechart on Splunk Search. 05-07-2021 05:17 AM
- Posted Sum latest value multiple field with timechart on Splunk Search. 05-07-2021 04:09 AM
- Posted Re: Split Multiple data in column with mutliple delimiter on Splunk Search. 02-12-2021 12:28 AM
- Karma Re: Split Multiple data in column with mutliple delimiter for scelikok. 02-12-2021 12:26 AM
- Posted Re: Split Multiple data in column with mutliple delimiter on Splunk Search. 02-11-2021 12:04 PM
- Posted Re: Split Multiple data in column with mutliple delimiter on Splunk Search. 02-11-2021 11:40 AM
- Posted Re: Split Multiple data in column with mutliple delimiter on Splunk Search. 02-11-2021 11:34 AM
- Posted Split Multiple data in column with mutliple delimiter on Splunk Search. 02-11-2021 09:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-07-2021
05:17 AM
@kamlesh_vaghela I would like to have a timechart by day that corresponding of the addition of the last "NbRisk" value by "SubProject" and summarize by "GlobalProject". For example, all the latest "NbRisk" by "SubProject" is additioned and summarize by "GlobalProject" until there is a new value arrived that replace it in the addition. So, based on my example : 07/05/2021, Project 1, 19 07/05/2021, Project 2, 111 06/05/2021, Project 1, 19 06/05/2021, Project 2, 111 05/05/2021, Project 1, 19 05/05/2021, Project 2, 111 04/05/2021, Project 1, 19 04/05/2021, Project 2, 111 03/05/2021, Project 1, 19 03/05/2021, Project 2, 111 02/05/2021, Project 1, 19 02/05/2021, Project 2, 111 01/05/2021,Project 1, 89 01/05/2021,Project 2, 103 The blank in my post is just to say that the dates are continuous but the values are the same. I dont know if I am clear, it is quite complicated to explain
... View more
05-07-2021
04:09 AM
Hello ! My data is in this form : _time (dd/mm/yyyy), NbRisk, SubProject, GlobalProject 02/05/2021, 10 , SubProject1, Project 1 01/05/2021, 4 , SubProject2 , Project 1 01/05/2021, 5 , SubProject3 , Project 1 10/04/2021, 80 , SubProject1 , Project 1 09/04/2021, 32 , SubProject2 , Project 1 09/04/2021, 12 , SubProject3 , Project 1 03/05/2021, 11 , SubProject1, Project 2 01/05/2021, 40 , SubProject2 , Project 2 15/04/2021, 60 , SubProject3 , Project 2 09/04/2021, 2 , SubProject3 , Project 2 08/04/2021, 4 , SubProject2 , Project 2 05/04/2021, 3 , SubProject1 , Project 2 I would like to calculate the last "NbRisk" by "SubProject" and sum it by all day and by "GlobalProject" with timechart to see the trend. For example : 07/05/2021, Project 1, 19 07/05/2021, Project 2, 111 06/05/2021, Project 1, 19 06/05/2021, Project 2, 111 | | 01/05/2021,Project 1, 89 01/05/2021,Project 2, 103 | | 10/04/2021, Project 1, 124 10/04/2021, Project 2, 9 I have tried a lot of thing like streamstats/addtotals without success .. Thanks for ur help !
... View more
Labels
- Labels:
-
count
-
field extraction
-
stats
-
subsearch
-
timechart
02-12-2021
12:28 AM
That exactly what i wanted ! Thank you very much scelikok for your time 🙂
... View more
02-11-2021
12:04 PM
Thanks Indeed it is better! I still have a problem (sorry) I would like every row to be related. I don't know if I can make myself understood but with this regex the data is individual. I would like that every block (that is separated by an <br>) is related. For example I would like an array like this: And not as currently: Sorry for the black rectangle.. I don't know if you know what I mean and I also don't know if it's possible..
... View more
02-11-2021
11:40 AM
The other block data is separed by a <br> and i dont know how to loop the search to display it
... View more
02-11-2021
11:34 AM
Hi scelikok, Thanks for your help ! But this regex return me only the first data 😕 :
... View more
02-11-2021
09:49 AM
Hello ! I am sorry if the issue has already been addressed. Several topics talk about it but I haven't been able to adapt it to my situation and I am new to Splunk. So I have data always in the same form: WorkInfo="Job:Initialize job|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:Checkout to s|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:VisualStudioTestPlatformInstaller|Result:succeeded|TaskName:VisualStudioTestPlatformInstaller|TaskVersion:1.151.3|IssuesMessages: <br> Job:TestComplete adapter install|Result:succeeded|TaskName:InstallTestCompleteAdapter|TaskVersion:1.73.382|IssuesMessages: <br> Job:Tests Run : Campagne Globale|Result:skipped|TaskName:VSTest|TaskVersion:2.170.1|IssuesMessages: <br> Job:Post-job: Checkout Talent to s|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:Finalize Job|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:Tests Run 1 Tests|Result:failed|TaskName:VSTest|TaskVersion:2.170.1|IssuesMessages:[error] Test Run Failed. \\ [warning] Vstest failed with error. Check logs for failures. There might be failed tests. \\ failed with exit code 1 \\ [error] Vstest failed with error. Check logs for failures. There might be failed tests. <br> Job:QA TestsUI|Result:failed|TaskName:|TaskVersion:|IssuesMessages: <br> Job:Report build status|Result:succeeded|TaskName:|TaskVersion:|IssuesMessages: <br> Job:QA TestsUI_Deploy tc2|Result:failed|TaskName:|TaskVersion:|IssuesMessages:" So we have several blocks which are separated by a <br>. In these blocks i have : Job: Result: TaskName: TaskVersion: IssuesMessages: Each of this information is separated by a pipe |. So I would like to display them as a table like this: I'm not comfortable with regex expression and all my attempts at trying with split and makemv delim have been unsuccessful... Thank you for your help !
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
-
subsearch
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-11-2021
05:09 AM
|
