About _Tom

_Tom · ‎10-18-2023

Solution in my case was a field marked as required which was missing in the data - after adding it to the data again the issue was solved.

_Tom · ‎10-12-2023

Hi @ikulcsar, have you found a solution to the problem? I currently face a similar issue in Splunk 9.0.5 with an accelerated datamodel, completing 100% but with 0 byte size and no results while having 30 buckets and the base-search is returing a million events and no errors.

_Tom · ‎03-03-2022

This might be caused by files which are not owned by the splunk user. For instance, if this applies to local.meta, you will get an error that metadata can not be written.

_Tom · ‎01-24-2022

Splunk truncates leading and trailing spaces during field extraction. Normally this is desired behavior. However, for one of our fields, the leading spaces must be preserved. It is about a fileinput with KV_MODE = none. This should also not involve any manipulation of the field value, such as inserting quotes at the beginning and end of the field value, which would preserve the spaces. Any ideas are welcome - is it possible at all?

_Tom · ‎01-24-2022

If you want to get the key with an empty value, use "KEEP_EMPTY_VALS = true" in your extraction stanza in transforms.conf.

_Tom · ‎12-13-2021

We have a saved search in a search head cluster which returns its results in a KV-Store lookup using append=true. Although the searches run successfully, the results where not stored in the KV-Store for few executions. Unfortunately, we were not able to locate the issue in the mongod.log or splunkd.log. Any ideas are appreciated.

_Tom · ‎10-28-2021

Hello @ITWhisperer, thank you very much for the quick answer, which helped a lot. We need to do the transformation for multiple fields within a complex query. Therefore, the solution had to be adapted somewhat: | makeresults | eval fieldname1="1;A__B 2;B__C__D__A__E 3;G" | eval other_fields_1="other_content" | eval tmp_raw = _raw | eval _raw=fieldname1 ``` temporarily overwriting _raw with the field value ``` | multikv noheader=t | table _raw *other_fields* ``` to keep the fields which we still need ``` | eval first=mvindex(split(_raw,";"),0) | eval second=split(mvindex(split(_raw,";"),1),"__") | mvexpand second | eval _raw=first.";".second | rename _raw as fieldname1 | fields - first,second | mvcombine delim="\n" fieldname1 ``` to get a multivalue field ``` | eval _raw = tmp_raw | table * Is there a better solution than overwriting _raw with the field value? I also was surprised that creating a multikv.conf file seems not to be required, as it autodetects semicolon as the separator and ignores the underlines.

_Tom · ‎10-27-2021

Hello *, I am looking for an SPL that reads the first part of a string via regex and replaces all occurrences of a certain character with this first part. This is to be used for summary indexing. Example: 1;A__B 2;B__C__D__A__E 3;G is to be transformed into (each line will become a value in a multivalue field): 1;A 1;B 2;B 2;C 2;D 2;A 2;E 3;G Neither replace nor rex seem to be able to afford multiple replacements of this kind. I also tried foreach with some field extractions but failed. Before I write a custom search command for it, I hope for your ideas to solve the problem with some clever standard SPL. Thank you in advance for your thoughts!

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎10-27-2021

Online Status	Offline
Date Last Visited	‎10-24-2023 02:13 AM

Keep whitespace at beginning of a field value?

KV Store not updated by Outputlookup

SPL: Use regex replacement string multiple times

Re: Data model acceleration status: Building

Re: Data model acceleration status: Building

Re: In handler 'savedsearch': Data could not be wr...

Keep whitespace at beginning of a field value?

Re: How do I fix my field extraction to account fo...

KV Store not updated by Outputlookup

Re: SPL: Use regex replacement string multiple tim...

SPL: Use regex replacement string multiple times