Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About timo258
timo258
Explorer
Member since:
06-23-2022
11-11-2022
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 06-23-2022 |
Activity Feed
- Posted How to group/split stacked bar chart columns? on Splunk Enterprise. 10-26-2022 07:46 AM
- Tagged How to group/split stacked bar chart columns? on Splunk Enterprise. 10-26-2022 07:46 AM
- Tagged How to group/split stacked bar chart columns? on Splunk Enterprise. 10-26-2022 07:46 AM
- Tagged How to group/split stacked bar chart columns? on Splunk Enterprise. 10-26-2022 07:46 AM
- Posted Re: How to expand/extract multivalue fields line by line? on Splunk Search. 07-01-2022 06:40 AM
- Karma Re: How to expand/extract multivalue fields line by line? for ITWhisperer. 07-01-2022 06:39 AM
- Posted Re: How to expand/extract multivalue fields line by line? on Splunk Search. 06-28-2022 06:43 AM
- Posted Re: How to expand/extract multivalue fields line by line? on Splunk Search. 06-28-2022 04:19 AM
- Posted Re: How to expand/extract multivalue fields line by line? on Splunk Search. 06-28-2022 04:16 AM
- Posted How to expand/extract multivalue fields line by line? on Splunk Search. 06-28-2022 03:17 AM
- Tagged How to expand/extract multivalue fields line by line? on Splunk Search. 06-28-2022 03:17 AM
- Posted Re: Issue with point separator, after conversion from a json file on Splunk Search. 06-24-2022 04:08 AM
- Karma Re: Issue with point separator, after conversion from a json file for richgalloway. 06-24-2022 03:53 AM
- Posted Issue with point separator, after conversion from a json file on Splunk Search. 06-23-2022 09:21 AM
- Tagged Issue with point separator, after conversion from a json file on Splunk Search. 06-23-2022 09:21 AM
- Tagged Issue with point separator, after conversion from a json file on Splunk Search. 06-23-2022 09:21 AM
- Tagged Issue with point separator, after conversion from a json file on Splunk Search. 06-23-2022 09:21 AM
- Tagged Issue with point separator, after conversion from a json file on Splunk Search. 06-23-2022 09:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
10-26-2022
07:46 AM
Hi together,
I want to group my bar chart in 2 columns. In the pictures you can see how I get it done and how it should look.
reached target
host=my_host index=my_index
| stats count
| join
[ search host=my_host index=my_index result.value= -1
| stats count
| rename count as "Tests_Failed"]
| join type=left
[ search host=my_host index=my_index result.value= 1
| stats count
| rename count as "Tests_Passed"]
| join
[search host=my_host index=my_index
| rename result.value as isFailed
| eval isFailed=if(isFailed=-1, 0, 1)
| stats sum(isFailed) as testedPositive by Produktionsnummer
| stats count(eval(testedPositive!="0")) as io count(eval(testedPositive="0")) as nio]
| table Typ-Nummer, Tests_Failed, Tests_Passed, nio, io
| rename Typ-Nummer AS "Product Name & Number", Tests_Passed AS "Tests Passed", Tests_Failed AS "Tests Failed", percFailed as "Percentage of Tests Failed"
I want so split it in 2 stacked columns like on the picture (Tests_Failed, Tests_Passed) and (nio, io).
Many thanks in advance!
... View more
Labels
- Labels:
-
using Splunk Enterprise
07-01-2022
06:40 AM
Works just perfect! Thank you very much!!
... View more
06-28-2022
06:43 AM
Hi Giuseppe, raw data is a huge json file with events like this: (separated by "key" field) {
"customfield_26300" : 10.0,
"customfield_26302" : null,
"customfield_26301" : 15.0,
"customfield_26202" : {
"child" : {
"value" : "Hardware-Techniker"
}
},
"customfield_26204" : {
"child" : {
"value" : "Software-Entwickler Sonderprogramme (C, C++)"
}
},
"key" : "PBWP-4881",
"customfield_26207" : {
"value" : "3 Advanced"
},
"customfield_26206" : {
"value" : "3 Advanced"
}
} customfield_26202 and customfield_26204 has the same content and I have to merge/append them together. Same for customfield_26027 and 26206 etc. That is why I did this: | eval Skills = mvappend(customfield_26202_child_value, customfield_26204_child_value, customfield_26205_child_value)
... I did some tests, Splunk is taking the order from mvappend() function. I think it is not alphabetical. Any ideas how I can achieve that: Skill SkillLevel Hours Hardware-Techniker 3 Advanced 10 Software-Entwickler Sonderprogramme (C, C++) 3 Advanced 15 Thank you 🙂
... View more
06-28-2022
04:19 AM
Hi Giuseppe, Thank you for your answer! The problem with your solution is, if I do a: | stats sum(Hours) Splunk will sum up all hours in that field:
... View more
06-28-2022
04:16 AM
Hi Jamie, Thank you for your answer! The problem with your is, if I do a: | stats sum(Hours) Splunk will sum up all hours in that field:
... View more
06-28-2022
03:17 AM
Hi! I have 3 multivalue fields (max. 3 values per field) and I want to expand/extract them to single values. Data looks like this: When I use | mvexpand Splunk extracts to all skills, all skillLevels with all skill hours: How can I tell splunk to extract only line by line? Result should look like: Skill SkillLevel Hours Hardware-Techniker 3 Advanced 10 Software-Entwickler Sonderprogramme (C, C++) 3 Advanced 15 Query: (without | mvexpand) | eval Skills = mvappend(customfield_26202_child_value, customfield_26204_child_value, customfield_26205_child_value)
| eval SkillLevel = mvappend(customfield_26206_value, customfield_26207_value, customfield_26208_value)
| eval Hours = mvappend(customfield_26300, customfield_26301, customfield_26302)
| table Skills,SkillLevel,Hours Thank you very much!
... View more
- Tags:
- multivalue
Labels
- Labels:
-
field extraction
-
fields
06-24-2022
04:08 AM
Thank you very much! It works! 👏 I have a lot of fields like that, is it possible to extract the fields already with "_" instad of "." while forwarding?
... View more
06-23-2022
09:21 AM
Hi together! I have an issue with the point separator, after conversion from a json file. This is raw json: "customfield_26202" : { "self" : "link", "value" : "Software: Softwareentwicklung und Product Security", "id" : "30705", "disabled" : false, "child" : { "self" : "link", "value" : "Software-Projektleiter", "id" : "30771", "disabled" : false Splunk extracts the field: customfield_26202.child.value="Software-Projektleiter" (Done with _json sourcetype) Now I want to merge to fields like this: | eval output = mvappend(customfield_26202.child.value, customfield_26204.child.value) | mvexpand output | table output When I do exactly the same thing without .child.value everything works fine. I tried it with several quotation marks (", ' etc.) nothing helps. Any idea what I do wrong? Thank you! Timo
... View more
Labels
- Labels:
-
field extraction
-
fields
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-11-2022
10:54 AM
|
