Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About FGAnders
FGAnders
Explorer
Member since:
08-10-2022
10-04-2023
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 08-10-2022 |
Activity Feed
- Posted Re: Possible to find different of two amounts from different events but already within a sort by time span? on Splunk Search. 10-03-2023 10:17 PM
- Karma Re: Possible to find different of two amounts from different events but already within a sort by time span? for bowesmana. 10-03-2023 10:15 PM
- Posted Possible to find different of two amounts from different events but already within a sort by time span? on Splunk Search. 10-03-2023 05:55 AM
- Posted Re: Missing Results / Random Results on searches after updating from 8.1.3 to 8.2.9 on Splunk Search. 07-14-2023 12:56 AM
- Tagged Missing Results / Random Results on searches after updating from 8.1.3 to 8.2.9 on Splunk Search. 07-12-2023 01:20 AM
- Posted Missing Results / Random Results on searches after updating from 8.1.3 to 8.2.9 on Splunk Search. 07-12-2023 12:58 AM
- Posted Re: Multisearch - Combining values from fields in different indexes using it to sort on Splunk Search. 06-06-2023 03:53 AM
- Karma Re: Multisearch - Combining values from fields in different indexes using it to sort for ITWhisperer. 06-06-2023 03:53 AM
- Posted Re: Multisearch - Combining values from fields in different indexes using it to sort on Splunk Search. 06-06-2023 03:28 AM
- Karma Re: Multisearch - Combining values from fields in different indexes using it to sort for ITWhisperer. 06-06-2023 03:25 AM
- Posted How to combine values from fields in different indexes using it to sort? on Splunk Search. 06-06-2023 02:22 AM
- Posted Re: Possible to exclude any events with multi value fields and only table ones with single value? on Splunk Search. 09-08-2022 12:45 AM
- Karma Re: Possible to exclude any events with multi value fields and only table ones with single value? for ITWhisperer. 09-08-2022 12:45 AM
- Posted Is it possible to exclude any events with multi value fields and only table ones with single value? on Splunk Search. 09-07-2022 11:37 PM
- Posted Re: Possible to show all values from same field name with different values from one Event on Splunk Search. 08-10-2022 02:55 AM
- Karma Re: Possible to show all values from same field name with different values from one Event for ITWhisperer. 08-10-2022 02:54 AM
- Posted Re: Possible to show all values from same field name with different values from one Event on Splunk Search. 08-10-2022 02:36 AM
- Posted Possible to show all values from same field name with different values from one Event? on Splunk Search. 08-10-2022 01:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-03-2023
10:17 PM
Hi, Thank you for your help and suggestion. Sadly _time without the fieldformat does not come out it in the format. This solution works thank you very much.
... View more
10-03-2023
05:55 AM
Hi, Is it somehow possible to find difference between two or more amounts from different events when the events are sorted by time span of 20s. index=Prod123 methodType='WITHDRAW' currency='GBP' jurisdiction=UK transactionAmount>=3 | fieldformat _time = strftime(_time, "%Y-%m-%d %H:%M:%S") | bin span=20s _time | search transactionAmount=* | stats list(transactionAmount) as Total, list(currency) as currency, list(_time) as Time, dc(customerId) as Users by _time | fieldformat Time = strftime(Time, "%Y-%m-%d %H:%M:%S") | fieldformat _time = strftime(_time, "%Y-%m-%d %H:%M:%S") | search Users>=2 | sort - Time I would like to have it show the difference between the Totals. Like the first one Total 3.8 and 11.2. Is it possible to make it work somehow or would it be better with streamstats and window? I was thinking about using sum or avg as an option also. Thank you,
... View more
07-14-2023
12:56 AM
Hi, Thank you for the suggestion. I already tried without dedup and this does not change anything regrading random results. This was working without any issues before update was done. I did find an older post where there seems to have been similar issues. https://community.splunk.com/t5/Getting-Data-In/Missing-data-Splunk-is-showing-random-gaps-in-the-indexed-data/m-p/98990
... View more
07-12-2023
12:58 AM
Hi, Has anyone an idea what could be the reason why before an update was able to run a query and get correct results but after updating to 8.2.9 getting random results. The data is in the event data, I can find the specific data if I specify for one specific but if I run the query I can get 1 result, 15 results, 42 results so on. Running the same query within the same timeframe. We have over 1500 Indexes and it seems to only be issue with one specific index. It does seem odd that when running it the data is there if I use specific user=123 instead of using user=* but then I would only get results for user 123. I tried even adding user=123 OR user=* does not change anything just random results. Could it be something that needs to be cleared or something? Has anyone seen this before? index=ABC operation=Paymentcompleted PAYMENT_METHOD=* user=* firstName=* lastName=* jurisdiction=UK AMOUNT=* country=GB | dedup user
| eval NameofPayer = FIRST_NAME." ".LAST_NAME
| eval NameofCust = firstName." ".lastName
| eval NameofCust=upper(NameofCust)
| eval NameofPayer=upper(NameofPayer)
| where NOT match(NameofPayer,NameofCust)
| stats list(NameofPayer) as NameofPayer, list(NameofCust) as NameofCust by user | fieldformat Time = strftime(Time, "%Y-%m-%d %H:%M:%S") Running Stats list, values or tables does not make a difference to the random results. While this should be over 140 results. Thank you in advanced,
... View more
- Tags:
- search
06-06-2023
03:53 AM
Thank you very much for the help.
... View more
06-06-2023
03:28 AM
Hi, Thank you for the fast reply. Seems like its not possible then if the fields and values are unique in both events in the indexes.
... View more
06-06-2023
02:22 AM
Hi,
I'm trying to combine values from two different fields in two different indexes. But it seems to come up blank. Is there any other options like join to combine it and sort it after the combined values?
| multisearch [search index=ABC UserID=* CheckEvent Alias=* ] [search index=CDE UserID=* classifications=SuperUser AliasTest=true ] | eval Combi = AliasTest." - ".Alias | stats values(UserID) as UserID, list(Combi) as Combined, list(AliasTest) as AliasTest ,list(classifications) as classifications, list(Alias) as Alias, dc(UserID) as users by Combi It works if I combine fields from same index, but not if I try and combine fields values from ABC and CDE indexes.
Thank you,
... View more
09-08-2022
12:45 AM
Thank you very much
... View more
09-07-2022
11:37 PM
Hi,
Is there any way to exclude any events that has more than one value of a field from end result.
index=X status=1
| rex field=_raw Product\W.(?P<Product>\w*)
| rex field=_raw englishName\W.\W(?P<englishName>\w*.*\w)\W
| rex field=_raw name\W.\W(?P<name>\w*.*\w)
| eval indexTime=_indextime | sort + indexTime | stats list(name) as Customer, list(transaction) as amount, list(Product) as Products, list(currency) as currency, list(englishName) as Item | fieldformat Time = strftime(Time, "%Y-%m-%d %H:%M:%S") |
Data from Event
name: "JohnA",selection=2,Product: "ABC",description=<null>,country='MT',selection=1,Product: "??",description=<null>,country='MT',selection=2,Product: "GOLD",description=<null>,country='MT',
While Having other results where there is only one Product in the events. I would like to exclude any events where there is more than 1 Product. I do not want them in the result. I have tried to find out if there is an option to have rex max_match to only show the ones with max 1 result. Without any luck.
Thank you in advanced,
... View more
08-10-2022
02:55 AM
Thank you very much, this works.
... View more
08-10-2022
02:36 AM
Hi, Thank you for fast reply I tried to only run as shorter query like: index=X Name=JohnA | table Name Product I still only see the first Product of the event from the index. Name Product
JohnA ABC If I go to the event in the index I can see that Product=ABC, Product=?? and Product=GOLD is shown in the event data. But it seems to only show me one of them. Some of the data from event. Name='JohnA',selection=2,Product='ABC',description=<null>,country='MT',selection=1,Product='??',description=<null>,country='MT',selection=2,Product='GOLD',description=<null>,country='MT', I would like it to show all the Products like this Name Product
JohnA ABC,??,GOLD Or like this Name Product
JohnA ABC
??
GOLD Everything else its getting shown correctly except when there is same field with different values in one single event. Thank you,
... View more
08-10-2022
01:52 AM
Hi,
I'm trying to make my query show all the different values from one field (Product) that it is showing in the Event. I have data from Event that has Product=ABC, Product=????? and Product=??. The Products will have random / different values.
When I run the query it will only show me the Product=ABC not any of the others with different values but same field.
index=X Name=* currency=* channel=* country=* state=* Product=* | stats list(Name) as Name, list(currency) as currency, list(amount) as amount, list(channel) as device, list(country) as From, list(state) as Status, list(Product) as Products |
I would like to have it show all the Products from the one event. So in case there are 3 Products
Products ABC ????? ??
---
In case I have another event with four fields with Products it has to show all 4.
Products ABC ????? ?? 4th Product
Is this possible ?
Thank you,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-04-2023
01:38 AM
|
