About aa0

aa0 · ‎01-13-2023

Thanks for your reply. I've give a try and the icons appear but how to make it include align with the list result? expected result: host | range | status xxx1 active (green icon) xxx2 inactive (red icon)

aa0 · ‎01-12-2023

Hi all, I'm currently using Splunk Cloud and my focus is to display status icons as values based on the search results in my classic dashboard table. I found a way to display only the icon with html but at the same time im struggling to assign the icon based on the result from the search query (if result active, pass icon check-circle else default pass icon warning/error etc.). How can I achieve this ? Any tweaks from this code attached will be much appreciated! <row> <html> <div> <td class="icon-inline numeric"> <i>Range icon: </i> <i class="icon-check-circle" style="color: green"><var>low</var></i> <i class="icon-alert" style="color: orange">warning</i> <i class="icon-alert-circle" style="color: red">error</i> </td> </div> </html> </row> <row> <panel> <table id="t1"> <search> <query>index=XXX host=* | eval host=upper(host) | stats count BY host | eval count=1, host=upper(host) | fields host count | stats sum(count) AS total BY host|rangemap field=total low=1-10 default=severe</query> <earliest>-30m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row>

aa0 · ‎01-09-2023

Thanks a lot! It working well with 3 backslashes used instead in order to escape a backslash character.

aa0 · ‎01-09-2023

Hi all, I want to extract the following word with rex expression: ABC\qq1234 expected result: qq1234 Please note that the substring needed will always after ABC\. Any help will be appreciated!

aa0 · ‎01-06-2023

Some of the app names consist inside the app category- for instance AOutlook and Outlook are basically represent the same category app name, hence I need both of the field names but only with filed1-Outlook field2-Outlook instead of field1-AOutlook field2-Outlook (standard name for both fields).

aa0 · ‎01-06-2023

Hi all, I have two similar words that giving the same meaning. How can I standardize them into one value to prevent inconsistencies in result but at the same time keep initial subcontent for both words? Here's the detail: app= AOutlook, Outlook..etc index=XXX app=XX...| eval Outlook=mvappend(AOutlook, Outlook)|table app action... expected result: app | action .... Outlook Not found Outlook Completed previous query for append doesn't work, any alternative will be appreciated!

aa0 · ‎11-01-2022

Hi all, I'm trying to create category based on host category: Lab,Personal,Staff and get workstations to be counted for each category. I tried using below and it gives desired results however it doesn't work when I applied boolean expression (OR) on more details in certain category. <base search>| eval category = case(match(host,"ABC-*"),"Staff",match(host,"DESKTOP*" OR host,"PC-*"),"Lab",true(),"Personal")|stats count by category,host|sort -count|stats sum(count) as Total list(host) as Workstation_Name list(count) as count by category|where Total>1|sort Total Expected Result: category | Total | Workstation_Name | count Staff 5 ABC123 2 ABC345 3 Lab 2 DESKTOP123 1 PC123 1 Personal 1 Etc... 1 Any help would be much appreciated!

aa0 · ‎10-10-2022

thanks for your reply, unfortunately I'm actually looking for other query. I've tried this to start so far: |set union[search index=indexA user=john|fields description user][search index=indexB user=john|fields user EventCode Workstation] could someone help to expand the search idea or make few tweaks to merge into one table? Many thanks.

aa0 · ‎10-10-2022

Hi all, I would like to create a table with details involved from two different index created. I'm facing difficulty in combining the data from both two indexes with common columns but different event structure. How to start a query to merge/combine fields from different indexes? As mentioned, both indexes consist of one similar field which is user=john. Here are the details: IndexA fieldA1=user (john) fieldA2=description IndexB fieldB1=user (john) fieldB2=Workstation fieldB3=EventCode Expected result: user| EventCode| description| Workstation john| 4740 |locked out| Lenovo.. could someone point me to the right direction on how to start a Splunk Cloud query to merge into one table? Many thanks.

aa0 · ‎09-02-2022

Thanks Matt!!!

aa0 · ‎09-01-2022

So what will be the possible query to begin with?

aa0 · ‎09-01-2022

Hi, I'm trying to display only a value in one particular column, for instance represent one team for different status. This is what I've done so far: index=xxx | stats count by Team, status *my expecting result is to have only one "DevOps" to represent team for different status displayed. Team | Status | Count DevOps Assigned 10 Pending 5 New 2 Resolved 1 .......... Many thanks for any help 🙂

aa0 · ‎06-10-2022

Thanks guys, solved!

aa0 · ‎06-10-2022

Thanks for your reply! I've tried the command but it still didn't did the trick, list of hosts is there but the total error and total success are missing somewhere

aa0 · ‎06-09-2022

Hi, I am a newbie in Splunk. I have to write a splunk query to get the status_code count for error(status range 300 and above) and success(status range 200-299) by host. This is my current search(24 hrs) but unfortunately return 0 result except for host list displayed index=xxxx host=* status=* | stats count(status>=300) as "Error", count(status<299) as "OK" by host Expected result: Host | Error | OK ---------------------------------------- xxxx | 23 | 1

Posts	15
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎06-09-2022

Online Status	Offline
Date Last Visited	‎04-04-2023 08:08 AM

How to add icon in Splunk Cloud?

How to extract subword from a string?

How to standardize similar words?

How to match case on multiple value assigned

How to index combination with different event stru...

How to display only one value in column?

How to display table of total error status code an...

Re: How to add icon in Splunk Cloud?

How to add icon in Splunk Cloud?

Re: How to extract subword from a string?

How to extract subword from a string?

Re: How to standardize similar words?