Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Shakira1
Shakira1
Loves-to-Learn Everything
Member since:
06-29-2021
05-22-2022
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-29-2021 |
Activity Feed
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 02:56 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 02:25 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 02:11 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 01:56 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 01:19 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 01:12 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 12:54 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 12:34 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-05-2022 12:17 AM
- Posted Re: compare multiple value in lookup to single value in index on Splunk Search. 04-04-2022 11:42 PM
- Posted How to compare multiple value in lookup to single value in index? on Splunk Search. 04-04-2022 08:49 AM
- Tagged How to compare multiple value in lookup to single value in index? on Splunk Search. 04-04-2022 08:49 AM
- Posted Re: filter data by source field wildcard on Getting Data In. 07-01-2021 05:33 AM
- Posted Re: filter data by source field wildcard on Getting Data In. 06-30-2021 07:21 AM
- Tagged Re: filter data by source field wildcard on Getting Data In. 06-30-2021 07:21 AM
- Posted Re: filter data by source field wildcard on Getting Data In. 06-29-2021 04:52 AM
- Posted Re: filter data by source field wildcard on Getting Data In. 06-29-2021 03:51 AM
- Tagged Re: filter data by source field wildcard on Getting Data In. 06-29-2021 03:51 AM
- Posted Re: filter data by source field wildcard on Getting Data In. 06-29-2021 03:45 AM
- Posted Re: filter data by source field wildcard on Getting Data In. 06-29-2021 03:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
04-05-2022
02:56 AM
OK, thank you so much for the help!
... View more
04-05-2022
02:25 AM
my lookup is like that: public_ip ,other_ip, more_ip 1.1.1.1, 2.2.2.2, 3.3.3.3 4.4.4.4,5.5.5.5,6.6.6.6 etc..... from my search IP=9.9.9.9 that's it. when I'm looking the IP 9.9.9.9 I see its match to myseatch (my condition) and its not appear on my lookup - so I should get it into my result I hope its more clear now
... View more
04-05-2022
02:11 AM
the result are missing. I know for sure that one of the IP should show up and its not shown, I dont know what I missed
... View more
04-05-2022
01:56 AM
by I have 5 IPs fields in my lookup which contains more then 1000 IPs so I cant do the one condition and this is the reason I used lookup....
... View more
04-05-2022
01:19 AM
OK so, IP - is the field from my search (not in the lookup) V1,V2,V3,V4,V5 is from mylookup (which is also IPs with a diff names) - they should be match to IP fields after we compare it - I want to exclude it from my search and show only the results that not contains the IPs from my lookup
... View more
04-05-2022
01:12 AM
This is not entirely true, I have 4 more fields, How do I compare them from my lookup to my search? this is what I missed..
... View more
04-05-2022
12:54 AM
I have one field from my search that should be much to one if the fields in the lookups I tried to do your solution: my search | search NOT [ inputlookup mylookupcsv | rename V1 as IP | rename v2 as IP | rename V3 as IP | rename V4 as IP | rename V5 as IP | eval IP=null() | foreach * [| eval sourceIPAddress=if(isnull(IP),"V1",mvappend(IP,V1)), | eval sourceIPAddress=if(isnull(IP),"V2",mvappend(IP,V2))] | fields IP | mvexpand IP | dedup IP] | table IP this is what you mean?
... View more
04-05-2022
12:34 AM
but what is IP? I need to rename the lookup fields to "IP"? as I did?
... View more
04-05-2022
12:17 AM
maybe I did wrong but I tried to do it in few ways: mysearch | search NOT [mylookup.csv | format] | dedup IP | table IP OR: mysearch | search NOT [ inputlookup IP.csv | fields IP1,IP2,IP3,IP4, IP_from_my_search | format] | dedup IP | table IP
... View more
04-04-2022
11:42 PM
no 😞 I'v tried and no success.
... View more
04-04-2022
08:49 AM
HI all,
I have lookup table with 5 colon that contains IPs
I want to create a search that exclude the IPs from my results, the issue is that I have 5 values and all of them should be match to 1 single value
example:
mycontiation | search NOT [ inputlookup mylookup.csv ] |rename 1V as IP |fields IP]
| search NOT [|inputlookup mylookup.csv |rename 2v as IP |fields IP]
| search NOT[|inputlookup mylookup.csv |rename 3v as IP |fields IP]
| search NOT [|inputlookup mylookup.csv |rename 4v as IP |fields IP]
| search NOT [|inputlookup mylookup.csv |rename 5v as IP |fields IP] | table IP
its not working. anyone?
thanks!
... View more
07-01-2021
05:33 AM
I can't share sample because it's with PII. but what I want to exclude is some path in the raw data [foo] so I just put the regex like that: XXX\/XXX\/XXX\/XXXX and in the props.conf I just add: TRANSFORMS = foo
... View more
06-29-2021
03:51 AM
for example: s3://XXXXprocess_events/upt_day=20210627/part-00053-a08c751e-1c05-4725-bdea-740009db640e.c000.json.g...
... View more
- Tags:
- source
06-29-2021
03:45 AM
for example: for example: s3://XXXXprocess_events/upt_day=20210627/part-00053-a08c751e-1c05-4725-bdea-740009db640e.c000.json.gz
... View more
06-29-2021
03:40 AM
which mean I can use [source::.*process_events.*] and it's should be working?
... View more
06-29-2021
02:40 AM
I've use case that I need to filter data by source field, that always changes. in the transforms.conf I use: [foo] REGEX = MY REGEX DEST_KEY = queue FORMAT = nullQueue and in the props.conf I use: [source::process_events] TRANSFORMS-01= foo The source always contains process_events and there is more data like date and info that changed. any way its possible to filter data by source wildcard? thanks!
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-22-2022
10:55 AM
|
