cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
mbolostk
Explorer
Member since: ‎10-11-2011
‎06-05-2020
Community Statistics
Posts 6
Solutions 1
Karma Given 0
Karma Received 4
Member Since ‎10-11-2011
Activity Feed
View All

CIDR in a lookup table - no access to transforms.c...

by in Splunk Search
‎09-22-2015 11:06 AM
3 Karma
‎09-22-2015 11:06 AM
3 Karma
I know it's possible to put CIDR ip ranges in a lookup table. However, my question is, what if I do not have access to modify the transforms.conf file directly and match_type is now shown in the advanced area of the lookup definitions (I'm using 6.1). Is there a way to use something similar to match_type in a regular query search so I can acquire the same type of results even if it's not specified in the transforms.conf file? ... View more

Re: How to truncate a field value after a regex pa...

by in Splunk Search
‎11-13-2014 02:34 PM
‎11-13-2014 02:34 PM
I figured it out. Nevermind. It was based on the first post - but had to redo the regex as the uri didn't, in this case, start with http:// ... View more

How to truncate a field value after a regex patter...

by in Splunk Search
‎11-13-2014 01:16 PM
‎11-13-2014 01:16 PM
How can I truncate a field value after a given pattern. For example, if I am looking at web page logs, how can I truncate everything after .html so that no parameters or variables are reported in my web page count? ... View more

Re: Adding two field values

by in Splunk Search
‎10-13-2011 02:17 PM
‎10-13-2011 02:17 PM
This is part of a much larger query. When I use table, it switches the order of the columns and displays nothing but the column not related to this part of the query. Any other thoughts/ideas? ... View more

Re: Adding two field values

by in Splunk Search
‎10-12-2011 10:34 AM
‎10-12-2011 10:34 AM
Maybe a 2nd eye will help me see it. Here is that part: eval IE_Average=(IE_Response*.60) | eval FF_Average=(FF_Response*.40) | eval Averages=(IE_Average)+(FF_Average) | stats values(IE_Response) values(FF_Response) values(IE_Average) values(FF_Average) values(Averages) by test_name values(FF_Average) displays column fine values(IE_Average) displays column fine But values(Averages) displays nothing.... ... View more

Adding two field values

by in Splunk Search
‎10-11-2011 03:17 PM
1 Karma
‎10-11-2011 03:17 PM
1 Karma
I have been unable to add two field values and use the new value of a new column I'm trying to take one field, multiply it by .60 then add that to another field that has been multiplied by .40. This is how I thought it would be created: eval NewValue=(FirstValue*.60)+(SecondValue*.40) I've verified that: | stats values(FirstValue) | and | stats values(SecondValue) | print out expected results I've also verified that I am able to do |eval NewValue1=(FirstValue*.60) | and | eval NewValue2=(SecondValue*.60) | both yielding results. However, when I try: | eval NewValue=(FirstValue+SecondValue) I get nothing. Any ideas/thoughts? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma from
View All