Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About pkharbanda1021
pkharbanda1021
Engager
Member since:
12-06-2021
01-05-2022
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-06-2021 |
Activity Feed
- Posted Splunk Slack how to display more than one result via $result.fieldname$ on Alerting. 01-05-2022 07:31 AM
- Tagged Splunk Slack how to display more than one result via $result.fieldname$ on Alerting. 01-05-2022 07:31 AM
- Posted Re: need to update values of a lookup search by count on Splunk Search. 12-07-2021 05:12 PM
- Posted Re: need to update values of a lookup search by count on Splunk Search. 12-07-2021 02:33 PM
- Posted Re: how to display stats results by values(field) on Splunk Search. 12-07-2021 10:17 AM
- Posted Re: need to update values of a lookup search by count on Splunk Search. 12-07-2021 10:10 AM
- Posted Re: need to update values of a lookup search by count on Splunk Search. 12-07-2021 09:13 AM
- Posted Re: need to update values of a lookup search by count on Splunk Search. 12-07-2021 08:44 AM
- Posted Re: need to update values of a lookup search by count on Splunk Search. 12-07-2021 07:16 AM
- Posted Re: how to display stats results by values(field) on Splunk Search. 12-07-2021 07:14 AM
- Posted Re: need to update values of a lookup search by count on Splunk Search. 12-07-2021 07:03 AM
- Posted Re: need to update values of a lookup search by count on Splunk Search. 12-07-2021 06:31 AM
- Posted Re: how to display stats results by values(field) on Splunk Search. 12-07-2021 06:29 AM
- Posted need to update values of a lookup search by count on Splunk Search. 12-06-2021 06:39 PM
- Posted how to display stats results by values(field) on Splunk Search. 12-06-2021 05:34 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
01-05-2022
07:31 AM
I am using Splunk Slack webhook to send alert results to Slack channels but at present its only displaying the first result of the alert ...I want to display all the values rather than just the first value. I tried for each result but that creates multiple messages which is not the solution I am looking for. <$results_url$|$result.sum$ transaction failed - tr_id=$result.tr_id$> tr_id has mutiple values but only displaying first value in slack at the moment
... View more
- Tags:
- slack
Labels
- Labels:
-
alert action
12-07-2021
05:12 PM
Apologies for reaching out again ...couple of things I verified by running individual searches for the strings with regex like "* not found" and I found results so I tweaked the query but it seems like match function doesnt like the keyword and not returning any result. Please let me know if there is way to get it to work..thank you for your help !!
... View more
12-07-2021
02:33 PM
I found a small issue after changing the search to query its not returning any results for keywords which has special characters and regex in that like "* not found" and similar I believe query is unformatted search in terms of splunk please let confirm if I am wrong. @ITWhisperer
... View more
12-07-2021
10:17 AM
for now "your base search" | fillnull value=NA errors | stats count values(traceid_id) as TraceId by title errors but I also tried with [this gives me completely different results and I want results by title] "your base search" | fillnull value=NA errors traceid_id | stats count by title errors traceid_id
... View more
12-07-2021
10:10 AM
that works ..thank you so much !!
... View more
12-07-2021
09:13 AM
I agree but the whole point of lookup is to have multiple values and when you run the above query with even 2 values in the lookup table this wont give you the right result.
... View more
12-07-2021
08:44 AM
this solves for one value only but when you have multiple values in your table like text_string value1 value2 value3 this will always pick the top value and shows the count where as the goal is to count all values/counts then overwrite the table with outputlookup ...I tried with 2 values and it only picks the first one and removes the otherone.
... View more
12-07-2021
07:16 AM
last one count the number of matches from the lookup that each event matches
... View more
12-07-2021
07:14 AM
results which I am getting arent accurate and its not making any sense I want the count for each value you see in the first value and with the above solution this is not accurate and doesnt work
... View more
12-07-2021
07:03 AM
I am not sure if you are following what I am saying let me explain I have a lookup which has 2 columns Col1=xyz col2=count xyz has values which I want to search in my data and that works fine and searches the keywords via lookup without the field existing in the data by converting into search ...goal is I need to count those results by search keywords which is what I am trying to solve.
... View more
12-07-2021
06:31 AM
NO the field comes via lookup column which I am converting to search so that it can search keywords in splunk but I wanted to use that field and i dont see in the data but search works.
... View more
12-07-2021
06:29 AM
this doesn't solve my problem
... View more
12-06-2021
06:39 PM
Splunk Query index="abc" source=def [| inputlookup ABC.csv | table text_strings count | rename text_strings as search] Problem: I need to count the text_string values but when I run the above search which searches the text_strings but I dont find a field called search with which I can count So need help @somesoni2 if you can help please
... View more
Labels
- Labels:
-
lookup
12-06-2021
05:34 PM
I am using the following query and trying to display the results using stats but count by field values search query | | table A B C D E | stats count values(A) as errors values(B) values(C) by E Also tried | stats count by E A B C [but this messes up everything as this requires every field to have values] Current Output E count A. B C Value1. 10. X YY ZZZ Y ZZ BBB Output E count A. B C Value1. 8. X YY ZZZ 2 Y ZZ BBB @somesoni2
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-05-2022
10:51 AM
|
