Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About spadler
spadler
Explorer
Member since:
08-25-2022
09-30-2022
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 08-25-2022 |
Activity Feed
- Posted Re: Why are results from multisearch not combining? on Splunk Search. 09-30-2022 06:49 AM
- Posted Re: Why are results from multisearch not combining? on Splunk Search. 09-29-2022 01:58 PM
- Posted Re: Why are results from multisearch not combining? on Splunk Search. 09-29-2022 09:56 AM
- Posted Why are results from multisearch not combining? on Splunk Search. 09-29-2022 08:36 AM
- Karma Re: Add search results to lookup AND send entire lookup by email for gcusello. 09-16-2022 09:25 AM
- Karma Re: Add search results to lookup AND send entire lookup by email for gcusello. 09-16-2022 09:24 AM
- Posted Re: Add search results to lookup AND send entire lookup by email on Splunk Search. 09-16-2022 08:22 AM
- Posted How do I add search results to lookup AND send entire lookup by email? on Splunk Search. 09-16-2022 06:29 AM
- Posted Re: Searching for a string that begins with a square bracket [ on Splunk Search. 08-25-2022 10:33 AM
- Karma Re: Searching for a string that begins with a square bracket [ for richgalloway. 08-25-2022 10:33 AM
- Posted Re: Searching for a string that begins with a square bracket [ on Splunk Search. 08-25-2022 09:16 AM
- Karma Re: Searching for a string that begins with a square bracket [ for richgalloway. 08-25-2022 09:16 AM
- Posted How to search for a string that begins with a square bracket ]? on Splunk Search. 08-25-2022 08:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
09-30-2022
06:49 AM
Yep your test case works for me also. I wondered if it isn't some kind of type mismatch. The second search uses regex while the first is just a normal search. The second search is more like the below. Though both use StatusCode>399 so the search is treating them as numbers. [search index=DEF | rex "message[/]*(?<StatusCode>[^,]*)" |search StatusCode>399 | eval type="search2"]
... View more
09-29-2022
01:58 PM
No, it produces the same results, with two rows for the 504 code
... View more
09-29-2022
09:56 AM
Then I guess my question would be, how do I get those duplicate rows to combine so I get a single sum for each distinct code?
... View more
09-29-2022
08:36 AM
The below search is intended to get status codes from two different sources and put them together in a table. It works except that it keeps codes separate if they come from different searches. In the table at the bottom, I want only one row for 504, with entries for both searches and the sum (=5).
| multisearch
[search index=ABC status.code>399 | rename status.code as StatusCode
| eval type="search1"]
[search index=DEF data.status>399 | rename data.status as StatusCode
| eval type="search2"]
| chart count over StatusCode by type
| eval sum = search1+search2
StatusCode search1 search2 sum
1
400
17
0
17
2
406
10
0
10
3
500
647
0
647
4
504
0
1
1
5
504
4
0
4
6
530
8
0
8
... View more
Labels
- Labels:
-
chart
09-16-2022
08:22 AM
I tried your suggestion with the following in an alert. While it performs the search, updates the lookup, and sends the lookup CSV by email, it overwrites the lookup data. I need it to append the latest search results to the lookup, then send the updated CSV by email. MY_SEARCH
|timechart span=10m count BY status
| outputlookup my_lookup.csv
... View more
09-16-2022
06:29 AM
I was asked to archive search results in a CSV then send those results periodically by email. My solution is to do this in 2 reports. The first report runs the search and appends the results to a lookup. The second just grabs the entire lookup (| inputlookup my_lookup.csv) then emails the results as a CSV.
This seems to work fine but I feel like there should be a more elegant solution, like in only one search/report. I'm curious about what others think.
... View more
Labels
- Labels:
-
lookup
08-25-2022
10:33 AM
Yes I think you're right. Using regex seems to be about as fast as doing something similar with the 'search' command or the 'where' command. I was confused about what order things should be done in for optimization. I also found the info on Parallel processing on this page useful. Thanks for your input.
... View more
08-25-2022
09:16 AM
It's my understanding that regex doesn't speed up searches. Is that right? Because the values that start with [ are not relevant to me and take up over half the results. They are being filtered out by other regex expressions, so I don't mind them being in the results except for the impact they have on speed.
... View more
08-25-2022
08:38 AM
I have a field value like this that I want to exclude.
[22m[2hinfo[3: host.console[0]
The searches I can think of either don't do anything or return an error. Note, I am trying to speed up a search so I do not want to use regex.
Searches I tried:
message != [*
message != "["*
message != "[*"
message != '[*'
message != '['*
... View more
Labels
- Labels:
-
field extraction
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-30-2022
10:10 AM
|
