×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Splunker1247
Loves-to-Learn
Member since: ‎08-09-2021
‎08-13-2021
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-09-2021
View All

Re: How to get the results for a value which is sa...

by in Alerting
‎08-10-2021 12:46 PM
‎08-10-2021 12:46 PM
I tried, it's not working. The event looks like below. The Account number's & ID's will be same. The report will be generated every day, one day the account Id will be shown in Account_0 and other day it will be shown in Account_2 or Account_1, etc. How can I get details for only one particular Account? whether it is in Account_0 or Account_1 or Accoun_2 it doesn't matter.   ---------------------------------------------- "calDate" : "2021-08-10", "calTime" : "00:30:16.40", "calType" : "T", "urlTitle" : "URL", "actualUrl" : "report-delivery", "calStatus" : "0", "duration" : "2200", "kvpMap" : { "file_0_deliveryChannel" : "***", "file_0_dropStatus" : "UPLOAD", "file_0_fileName" : "detail_report", "file_0_AccountID" : "0123456789", "file_0_AccountNumber" : "9876543210", "file_0_referenceUrl" : "detail_report", "file_0_tenant" : "SPLUNK", "file_1_deliveryChannel" : "***", "file_1_dropStatus" : "UPLOAD", "file_1_fileName" : "detail_report", "file_1_AccountID" : "00000111111", "file_1_payPalAccountNumber" : "8989898989", "file_1_tenant" : "SPLUNK", ... View more

How to get the results for a value which is same, ...

by in Alerting
‎08-10-2021 10:00 AM
‎08-10-2021 10:00 AM
I have an event that has field names that follows; file_1_customer : 123456789  file_2_customer : 34569876893 file_3_customer : 87974849747 file_4_customer : 473257792237 In this I'm looking for only this value (87974849747) and this value is constant it doesn't change. But the field name changes.  Example: Today the (87974849747) value comes in field file_3_customer, but tomorrow it may comes in file_1_customer and day after tomorrow it may comes in file_4_customer. Every day the field name changes but not the value. The value is same. How can I get the only field name and field value for (87974849747) respective with the changes?   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎08-13-2021 12:16 AM