×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Newser703
Explorer
Member since: ‎04-04-2022
‎07-19-2022
Community Statistics
Posts 5
Solutions 0
Karma Given 5
Karma Received 0
Member Since ‎04-04-2022
Activity Feed
View All

Re: Alert if missing field

by SplunkTrust in Dashboards & Visualizations
‎07-11-2022 03:57 AM
‎07-11-2022 03:57 AM
The main question is what do your results really look like. Because if you do simple stats count splunk will not create a row in results when there are no events to aggregate. It will however produce a row of results with count of 0 if you use timechart. ... View more

Re: How to add a column that sums values while kee...

by in Splunk Search
‎05-05-2022 06:14 AM
1 Karma
‎05-05-2022 06:14 AM
1 Karma
Hi @Newser703  you can try eventstats  it should give you the output you are looking for   | makeresults |eval Name="Name1",Type="TypeA",Value=2 |append[|makeresults |eval Name="Name1",Type="TypeB",Value=4] |append[|makeresults |eval Name="Name1",Type="TypeC",Value=6] |append[|makeresults |eval Name="Name2",Type="TypeA",Value=4] |append[|makeresults |eval Name="Name2",Type="TypeB",Value=8] |append[|makeresults |eval Name="Name2",Type="TypeC",Value=3] |append[|makeresults |eval Name="Name3",Type="TypeA",Value=1] |append[|makeresults |eval Name="Name3",Type="TypeB",Value=5] |append[|makeresults |eval Name="Name3",Type="TypeC",Value=7] |eventstats sum(Value) AS SumbyName by Name |fields - _time   If it helps karma is appreciated/if it resolves acceptance as solution is appreciated  ... View more

Re: How to give matching fields the same number ?

by SplunkTrust in Splunk Search
‎04-04-2022 04:45 AM
1 Karma
‎04-04-2022 04:45 AM
1 Karma
| streamstats dc(Key) as Number ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎07-19-2022 08:40 AM
Karma given to