About Mockjin

Mockjin · ‎03-28-2023

Hi @Gr0und_Z3r0 , thank you for your quick answer. When i try your idea i get the error message "unbalanced parantheses". I changed the Example Search for understanding. Direct search without inputfield in test_dashboard: |tstats count where index=_internal AND (TERM(name=dump) OR TERM(name=exec)) by PREFIX(name=) Example search with _internal index and text field named inputfield in test_dashboard: inputfield="dump,exec" |tstats count where index=_internal AND (TERM(name=mvindex(split($inputfield$,","),0)) OR TERM(name=mvindex(split($inputfield$,","),1))) by PREFIX(name=) Any idea why?

Mockjin · ‎03-28-2023

Hi * i am trying to search via tstats and TERM() statements. How can i use TERM() phrases that comes from an Dashboard input field? for example Input field= test1,test2 Output search= | tstats values(PREFIX(test_content=)) as test_content where index=testindex AND (TERM(host=test1) OR TERM(host=test2) by _time PREFIX(host=)

Mockjin · ‎08-24-2021

@richgalloway thank you for your fast answer 🙂

Mockjin · ‎08-24-2021

Hi, i am trying the App "Lookup File Editor" and have problems with the match_type settings. Normal lookups can be configured to use match_type=CIDR or something else. I cant find similar settings in the "Lookup File Editor" app from splunkbase. Do i something wrong or is this feature not included? Thanks

Mockjin · ‎07-19-2021

Hi @venkatasri , your solution worked for me. Thanks 🙂

Mockjin · ‎07-16-2021

Hello * how can i overwrite the default eval definition for field app in props.conf? default/props.conf ... EVAL-app = "Blue Coat ProxySG" ... I try to overwrite this field with following in local/props.conf ... FIELDALIAS-app = x_bluecoat_application_name as app ... We use a distributed Environment so i changed this in SH and HF app. But no change to the results. What am i doing wrong?

Posts	6
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-23-2021

Online Status	Offline
Date Last Visited	‎04-03-2023 10:42 AM

How can I use TERM() phrases that comes from an D...

"Lookup File Editor" match_type settings

Overwrite App-default EVAL in props.conf with Fiel...

Re: Dashboard with TERM() and tstats

How can I use TERM() phrases that comes from an D...

Re: "Lookup File Editor" match_type settings

"Lookup File Editor" match_type settings

Re: Overwrite App-default EVAL in props.conf with ...

Overwrite App-default EVAL in props.conf with Fiel...

Are you a member of the Splunk Community?