×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
morganj1
Explorer
Member since: ‎04-13-2021
‎05-30-2022
Community Statistics
Posts 5
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎04-13-2021
Activity Feed
View All

Is there a way to make transaction wait or end bef...

by in Splunk Search
‎05-30-2022 04:23 AM
‎05-30-2022 04:23 AM
Hi, is there a way to make a Splunk transaction wait until it has ended, before starting another transaction.   e.g. if I have (with latest results at the top) a end b start c start d end e end f start g start h start   What I get from Splunk here would be transactions: f->e, g->d and b->a. But what I want is h->e and c->a, so once it's found "start" it then looks for "end", and then looks for the next "start" after that... etc. ... View more
Labels

Keep invalid json files

by in Monitoring Splunk
‎12-13-2021 07:49 AM
‎12-13-2021 07:49 AM
Hi, I've set up a Splunk monitor to send some json files to Splunk, however it doesn't send invalid json files. I can see the reasoning behind this, but I'd like to keep invalid json files so that I can see which ones are valid/invalid on my dashboard. Is there any way to make Splunk send over all json files even if they're invalid? Thanks   Edit: For instance, could I maybe make a sourcetype which sets the sourcetype field to be "json" if valid and "invalid_json" if not valid? ... View more
Labels

Re: Use data from two indexes, with separate event...

by in Reporting
‎04-13-2021 08:25 AM
‎04-13-2021 08:25 AM
Wow this is actually exactly what I wanted! Thank you very much, I'm surprised you even understood what I was asking 🙂 ... View more

Re: Use data from two indexes, with separate event...

by in Reporting
‎04-13-2021 07:00 AM
‎04-13-2021 07:00 AM
Thanks for your quick response! I'm afraid this doesn't really work for me, I don't have the ESN field in both indexes. Sorry, it's quite hard to word what I actually want. Is there any way of sort of using index2 as a lookup table? So, I have a lookup table which gives me TC_Back and TC_Front from the ESN. So these will be number 1-4 or 5-8, respectively. Is there a way I can input this number into index2 and receive the latest Temperature for the corresponding Thermocouple number? Something like: index=index1 | lookup lookup_table ESN TC_Back | eval TempBack=function([index=index2 |  latest(Temperature) | where Thermocouple=TC_Back])   I hope this makes sense... ... View more

Use data from two indexes, with separate events

by in Reporting
‎04-13-2021 05:34 AM
‎04-13-2021 05:34 AM
Hi, I have two indexes from two different sources, but I want to use them together, preferably in a table. index1 contains data on hardware units in a rack, with fields ESN (serial number) and UnitTemperature. index2 contains external temperature data, with fields Thermocouple (which are just numbered 1 to 8 ) and Temperature. Thermocouples 1-4 are at the back and 5-8 are at the front of the rack. I have a lookup table to get the number of the two thermocouples (front and back) closest to each unit from their ESN. Now what I want is to make a table with columns: ESN, Unit Temperature, Closest Front Thermocouple Temperature, Closest Back Thermocouple Temperature.   Is there any easy way to do this? Thanks. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎05-30-2022 01:08 PM
Karma given to
View All