Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Shakira1
Shakira1
Explorer
Member since:
06-29-2021
Thursday
Community Statistics
| Posts | 31 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-29-2021 |
Activity Feed
- Posted Re: convert date to epoch on Splunk Search. Thursday
- Posted How to convert date to epoch? on Splunk Search. Thursday
- Tagged How to convert date to epoch? on Splunk Search. Thursday
- Posted Re: add automatic lookup for kvstore on Splunk Search. 03-15-2023 03:01 AM
- Posted Re: add automatic lookup for kvstore on Splunk Search. 03-14-2023 02:50 AM
- Posted Add automatic lookup for kvstore? on Splunk Search. 03-12-2023 07:42 AM
- Tagged Add automatic lookup for kvstore? on Splunk Search. 03-12-2023 07:42 AM
- Posted Re: Contains "is null" with if command on Splunk Search. 12-28-2022 07:16 AM
- Posted Contains "is null" with if command on Splunk Search. 12-28-2022 03:45 AM
- Tagged Contains "is null" with if command on Splunk Search. 12-28-2022 03:45 AM
- Posted Re: How to compare CIDR from event to lookup? on Splunk Search. 11-29-2022 06:41 AM
- Posted Re: How to compare CIDR from event to lookup? on Splunk Search. 11-29-2022 05:52 AM
- Posted Re: Compare CIDR from event to lookup on Splunk Search. 11-28-2022 02:04 PM
- Posted Re: Compare CIDR from event to lookup on Splunk Search. 11-28-2022 06:17 AM
- Posted Re: Compare CIDR from event to lookup on Splunk Search. 11-21-2022 12:29 AM
- Posted How to compare CIDR from event to lookup? on Splunk Search. 11-20-2022 07:40 AM
- Tagged How to compare CIDR from event to lookup? on Splunk Search. 11-20-2022 07:40 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 02:56 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 02:25 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 02:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Thursday
I have this date string example: Mon, 01 May 2023 00:00:00 GMT
how can I convert it to epoch?
thanks!
... View more
- Tags:
- epoch
- splunk search
Labels
- Labels:
-
other
03-15-2023
03:01 AM
this one? this is working for me in SPL and I add automatic lookup - which not working ( didnt extract the fields)
... View more
03-14-2023
02:50 AM
The purpose is to enrichment the data automatically I did it in the UI under automatic lookup: my lookup id AS id OUTPUT my fields_from_the_lookups it always working but the diff here is that I'm using KVstore thanks
... View more
03-12-2023
07:42 AM
I have kvstore which generate the data by API.
when I use | lookup mylookup id output data - its working
I want to convert it to automatic lookup in some index, but its not working.
any idea why?
... View more
- Tags:
- kvstore
Labels
- Labels:
-
lookup
12-28-2022
03:45 AM
I have all_ip filed that contains all my ips. now I want to split it to public ip and private ip: public_ip, private_ip, all_ip: and when private_ip is null I want to put the value from all_ip in public_ip field. first I did: | eval private_ip=if(like(all_ip,"XXXX.%") OR like(all_ip,"XXX.%"),all_ip,null()) and now I need to do (all the rest fill it in public_ip field. this is possible? thanks!
... View more
- Tags:
- isnull
11-29-2022
06:41 AM
BTW, I have created 2 fields base on my lookup - when the ip is exist I have new fields : my_ip = True this is can be easer to compare now? without using lookup
... View more
11-29-2022
05:52 AM
the result returns me nothing 😞 I'v changed the exist to the filed from my lookup and the value as well and nothing come up. what I missed?
... View more
11-28-2022
06:17 AM
what I tried to do is to compare the data from CIDR to lookup with IP I have a list of internal IPs and in the audit I have only CIDR, how can I compare it? thanks!
... View more
11-21-2022
12:29 AM
this is exactly my case. I have lookup contains my ip and on the events I have only the range. there is any solution to compare it?
... View more
11-20-2022
07:40 AM
I have lookup contains IP and I want to compare to field from event that contains CIDR.
I did lookup definition and add the match type into the advance (CIDR(ip)
my lookup:
ip exist
1.1.1.1 "yes"
2.2.2.2
my event:
cidr
1.1.1.254/32
my query:
|makeresults
| lookup ip ip as cidr output exist
what I did wrong?
... View more
- Tags:
- lookup
- splunk-search
Labels
- Labels:
-
lookup
04-05-2022
02:56 AM
OK, thank you so much for the help!
... View more
04-05-2022
02:25 AM
my lookup is like that: public_ip ,other_ip, more_ip 1.1.1.1, 2.2.2.2, 3.3.3.3 4.4.4.4,5.5.5.5,6.6.6.6 etc..... from my search IP=9.9.9.9 that's it. when I'm looking the IP 9.9.9.9 I see its match to myseatch (my condition) and its not appear on my lookup - so I should get it into my result I hope its more clear now
... View more
04-05-2022
02:11 AM
the result are missing. I know for sure that one of the IP should show up and its not shown, I dont know what I missed
... View more
04-05-2022
01:56 AM
by I have 5 IPs fields in my lookup which contains more then 1000 IPs so I cant do the one condition and this is the reason I used lookup....
... View more
04-05-2022
01:19 AM
OK so, IP - is the field from my search (not in the lookup) V1,V2,V3,V4,V5 is from mylookup (which is also IPs with a diff names) - they should be match to IP fields after we compare it - I want to exclude it from my search and show only the results that not contains the IPs from my lookup
... View more
04-05-2022
01:12 AM
This is not entirely true, I have 4 more fields, How do I compare them from my lookup to my search? this is what I missed..
... View more
04-05-2022
12:54 AM
I have one field from my search that should be much to one if the fields in the lookups I tried to do your solution: my search | search NOT [ inputlookup mylookupcsv | rename V1 as IP | rename v2 as IP | rename V3 as IP | rename V4 as IP | rename V5 as IP | eval IP=null() | foreach * [| eval sourceIPAddress=if(isnull(IP),"V1",mvappend(IP,V1)), | eval sourceIPAddress=if(isnull(IP),"V2",mvappend(IP,V2))] | fields IP | mvexpand IP | dedup IP] | table IP this is what you mean?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
