Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About queryboy
queryboy
Explorer
Member since:
10-10-2022
11-02-2022
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 10-10-2022 |
Activity Feed
- Posted How to compare a field with accents with a field without accents? on Splunk Search. 11-02-2022 10:21 AM
- Posted Re: How to add multiple field values from a CSV to my main search? on Splunk Search. 11-01-2022 09:08 AM
- Posted How to add multiple field values from a CSV to my main search? on Splunk Search. 11-01-2022 07:51 AM
- Posted How can I have the query show just Year-Month-Day and remove the rest of what is showing above? on Getting Data In. 10-13-2022 06:24 AM
- Posted Re: How to use join to compare results from a csv file? on Splunk Search. 10-12-2022 01:26 PM
- Karma Re: How to use join to compare results from a csv file? for yuanliu. 10-12-2022 01:25 PM
- Posted Re: How to use join to compare results from a csv file? on Splunk Search. 10-12-2022 05:19 AM
- Posted Re: How to use join to compare results from a csv file? on Splunk Search. 10-11-2022 09:45 AM
- Posted Re: How to use join to compare results from a csv file? on Splunk Search. 10-10-2022 03:48 PM
- Posted How to use join to compare results from a csv file? on Splunk Search. 10-10-2022 12:48 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-02-2022
10:21 AM
I need to compare two fields "Name" and "StudentName" and I am having problems with this, the values in the field "Name" do not contain accents but the values in "StudentName" contain accents in the names like 'Róbert' or 'Czuukó' and also names like 'Mary-Ann' so when I try to compare it will give me several matches because most of the names don't have accents but the ones that contain an accent in"Name" won't show up as matching with "StudentName"
... View more
Labels
- Labels:
-
field extraction
-
fields
-
lookup
-
regex
-
rex
11-01-2022
09:08 AM
can you please show me how to put it in splunk currently I have this: | lookup Hirings.csv Last_Name AS Last I need to add more fields from the CSV one of this fields is called "Search_Status" but I don't know how to set the syntax for this.
... View more
11-01-2022
07:51 AM
I need to add multiple values from a CSV to a main Search I have, I used the lookup command but I think that will just compare one field from the main search and the CSV and I need to add more fields from the CSV to do some evals, Please help!
... View more
Labels
- Labels:
-
field extraction
-
fields
-
join
-
lookup
-
subsearch
10-13-2022
06:24 AM
I am creating a dashboard for reporting and one of the values of my search is called 'start date' when I check the column of 'start date' in the Search app it shows the date format like this 2022-07-10 which is what I want.
When I put the Query into a Splunk dashboard the field value shows like this for all values in the column.
2022-07-10t18:00:00-06:00
Question: How can I have the query show just Year-Month-Day and remove the rest of what is showing above?
... View more
10-12-2022
01:26 PM
@yuanliu you are awesome! I tested with Applicant_Email for the Eval as you mentioned and is working just fine! Thank you!
... View more
10-12-2022
05:19 AM
@yuanliu it gives me all results as not in list, I did this with excel and there are some names that are in list | eval in_list = if(isnull(Training_Status), "not in list", "in list") is there a way to do a eval and check not for training status but only if emails in the lookup(csv) are in the main search? like : | eval in_list = if(Applicant_Email in primaryWorkEmail), "in list", "not in list") Thank you for your help
... View more
10-11-2022
09:45 AM
Thank you for this, do you know how would you structure the query to if any of the Applicant_Email(employe email) is in any of the rows of the primaryWorkEmail(employee email in directory) and basically have a new column saying "in_list" for the ones that have a match and "not in list" for the ones that doesn't have a match? @yuanliu you are helping me a lot is just that one piece I need to get straight
... View more
10-10-2022
03:48 PM
I uploaded the CSV to splunk this is the query: | inputlookup trainingoct10.csv | dedup Applicant_Email | table Applicant_First_Name, Applicant_Last_Name, Applicant_Email, County_Searched, Training_Status how can I structure my query so it will check for each of the names inside this CSV against my main query? and be able to add a field saying "in list" or "not in list" sorry I am new to splunk and this is getting difficult for me. @yuanliu @richgalloway
... View more
10-10-2022
12:48 PM
this query shows all employees in the company:
index=EmployeeData AND sourcetype=Directory* earliest=@d | search NOT Hire_Date IN ("2021-11-11","2021-05-22","2022-08-02", "2021-11-11") | search Worker !="Level05" Termination_Date="" Training_Performed="" | table First, Last, primaryWorkEmail, Training_Performed
I need to compare with a CSV that shows all of the people who did their training, this CSV contains the field Submitted
How would you structure the join to compare if xyz employee is in the CSV of people who completed their training?
... View more
