Using the extract function, I can arrive with the below columns: I need to compare the values, and come up with a new field like r1, r2, r3 which says whether it's same or not. I'm thinking of using eval function and then if statements to compare the two values but I'm not sure how to do it in such a way that will apply to all columns with titles beginning with "q" and "a". I was thinking of using foreach loop but it seems that the foreach loop has very specific usecases that doesn't apply to mine. The dilemma is that I need to do this dynamically, because it's possible that in other rows, there will be data reaching up to q5... q10... etc. Is there a specific command for what I want to do?
... View more
Hi everyone, I would like to ask if it's possible to use data from another row, to be set as the value of a different row with the same key... Such as in the table below. id username status XC2345 completed XC2345 in progress XC2345 killjoy started ZC9999 in progress ZC9999 jett started In the example above, I would like to set the values for usernames of each row with the same id to the same as the one with values, for them to become like this: id username status XC2345 killjoy completed XC2345 killjoy in progress XC2345 killjoy started ZC9999 jett in progress ZC9999 jett started Would above be possible through eval or another function?
... View more
Hi everyone, I just want to ask about this particular case that I am rather unsure if it's possible to execute in splunk. So let's say I have 2 sets of forms (which in the future might have more). 1. Kitchen 2. Living Room Each of those forms log text responses in splunk in different ways. The text field for Kitchen forms have * kitchen diameter * [ 12 sqm] * sink diameter * [5 sqm] * table color* [blue] Then for the living room form, it might have the following information *sofa color * [green] *wall color * [black] *tv availability* [none] ... And so on, (just to emphasize that there can really be a huge variety with what kind of data is in the text) Now, my question is. Would it be possible to break them all down in such a way that the values of the text would be the column names when I select them in the dashboard? I want to retrieve them in accordance to when they're selected from a dropdown. I was hoping to use the dropdown to allow me to select either of those three forms. Upon selection, what should happen is, the table below it should change in accordance to what was selected. So table for kitchen would look like sofa color wall color tv availability 12sqm 5sqm none And when I select the living room form it would look somewhat like kitchen diameter sink diameter table color green black none I was thinking of using the rex to extract them, but after extracting them would it be possible to use them as column data? Also, can rex handle it dynamically, like if a form has 6 types of key value pairs, would it be able to handle it?
... View more
I have data that used to be in an if condition, the nameFromChannel is taken from slack, and they use the names as a sort of mechanism to filter the members that are allowed to be a part of the channel. The group credentials are then taken from all the members usernames and are assessed individually whether they're allowed to be a member of the group. It goes something like this. | eval clientName=if(like(nameFromChannel,"%B%"),groupCredentials+ " " +"BASSI",groupCredentials)
| eval clientName=if(like(nameFromChannel,"%W%"),groupCredentials+ " " +"HI WALDORFI",groupCredentials)
| eval clientName=if(like(nameFromChannel,"%V%"),groupCredentials+ " " +"VDWI",groupCredentials)
... (So a channel that has xxx_BW_xxx in their name, means that employees with BASSI / HI / WALDORFI attached to their display names are allowed to be members). P.S. we cut the nameFromChannel before hand, so that the only data are the letters. After some time, we decided that we wanted to change this to a lookup, that had a csv that looked like this : nameFromChannel, groupCredentials
%W%, BASSI WALDORFI
%V%, VDWI I found a few responses in the below page. https://community.splunk.com/t5/Splunk-Search/splunk-lookup-like-match/m-p/219946 It was a lot of help when setting up the lookup, however, I noticed that the % symbols are not being recognized even after I added the WILDCARD(nameFromChannel) in the advanced options section of my lookup definition, so I changed them to *. | lookup listOfCompaniesDefinition nameFromChannel OUTPUT groupCredentials
| eval clientName=if(groupCredentials="",clientName,clientName+groupCredentials) After testing above, it seems that it isn't evaluating the text properly, my result isn't being displayed the same way it used to. The channels are no longer being retrieved. Fairly new to splunk, so I would like to hear your feedback. Thank you!
... View more