About simon_b

simon_b · ‎12-14-2023

Hello, at the moment we are indexing JSON files in Splunk and then rename the fields with a Field Alias function. This leads to the problem, that we cannot use tStats on these renamed fields anymore. Now to the question: Is there a way to rename the fields with splunk before indexing the data? The goal is that we can use tStats on all fields with the new renamed names.

simon_b · ‎06-23-2023

@ITWhisperer I want to use the throttle option to stop writing to the summary index for a certain amount of time after some events have been written to the index. Example: An event is written to the summary index After that, use throttle option to stop writing to summary index for x hours (even if there would be events to be written it should be blocked) After x hours: If there are new events --> Write them to summary index again and block it again for x hours

simon_b · ‎06-20-2023

@ITWhisperer Thanks for the answer. You are right, the _raw field is removed completly. Yes, I want to write some events to a summary index and I am aware of the collect command. The problem is, that I cannot use the Throttle option if I do it that way. So my main goal would be to write some events to a summary index using an Alert Action to do that.

simon_b · ‎06-19-2023

I would like to use the "Log Event" alert action to store all fields that are in the result of the search into an index. Is there a token (like $result.fieldname$) which gives back not only one specified field of the result but all fields?

simon_b · ‎02-02-2023

Hi Shiv, thanks again for the answer. I actually was aware of that solution, but don't find it very elegant or efficient. Facing that there is no better solution, I think I'll do it like you explained.

simon_b · ‎01-31-2023

@shivanshu1593 Thanks for your answer. The thing is that I don't want to do the data collection in my search as it would cause the "Throttle" option not to work.

simon_b · ‎01-31-2023

Hi, is there an alert action to save the results of the search directly to a specified, existing index? I already tried the "Log event" alert action, but in the "Event" field that has to be specified, I did not know how to access the results of my search. Thanks for your help!

simon_b · ‎01-30-2023

Hi, I have got a table in a dashboard which shows some information. For every row of the table I want to include a column which shows a link to another dashboard. This link has to be different for every row (including the filters in the link like "?form.time_select.earliest=..."). I tried to do that using the $click.value2$ token in the drilldown "Link to custom URL" . The problem with that is, that the token gives back the value of the clicked field but some special characters from the clicked field value are converted to a different format (for example the character "?" is converted into "%3F"). Is there a solution to get the exact string value that is in the clicked field with the $click.value2$ token? Or would there maybe be a better solution to solve my problem? Thanks for the help!

simon_b · ‎12-06-2022

Hi, I want to change the default value of the specific ttl values for each action that can be triggered from an alert. Especially I'm asking how to change the default value of the "action.lookup.ttl" parameter? I know how to set it for each saved search individually but not how to change the default value.

simon_b · ‎11-30-2022

I have the problem that my scheduled searches all have a lifetime of 10 days. This is the case for searches that run once every day but also searches that run every 4 hours. Changing the "Expires" value doesn't affect that 10 days lifetime. How can I change the default lifetime of my scheduled searches?

simon_b · ‎11-29-2022

Hi @gcusello , the search at the moment looks something like this: index=index1 | regex id != "2|3|4" | join id [ search index=index2 latest=-0d earliest=-7d | regex id != "2|3|4" ***some eval commands*** | where (date_hour>hour_min) AND (date_hour<hour_max) | stats mean(value1) AS "mean_value1" by id] | table _time id mean_value1 The parameters I need in the subsearch are "hour_min" and "hour_max" which represent the earliest and latest hour of the main searches time picker.

simon_b · ‎11-29-2022

Ciao @gcusello, yes I know how to do that. The problem is that I need the timerange of the main search to filter for that hours in the subsearch.

simon_b · ‎11-29-2022

Grazie @gcusello per la risposta. Unfortunately the solution doesn't work for my case. As I explained, in the subsearch I would like to calculate the average for a value, but only for the specified hours of the main search in the last 7 days. For example: If my main search looks at the data from 06:00 to 10:00 for today I want to calculate the average for the last 7 days also only for the hours 06:00 to 10:00 from each day.

simon_b · ‎11-24-2022

Hi, let me try to explain my problem. I have a main search with a selected timerange (typically "last 4 hours") which is selected with the time picker. In addition, I join a subsearch where I want to calculate the average of some values with a bigger time range (typically "last 7 days"). To do that I use the earliest and latest commands in the subsearch. Is it somehow possible to get/access the values of info_min_time and info_max_time (which the addinfo command produces) from the main search into the subsearch?

simon_b · ‎11-15-2022

Hi, i have a duration in seconds and want to convert it to days, hours and minutes. The additional seconds should be just cut off in the output. Ideally there should be no leading zeros (not "04 hours" but "4 hours") and if days, hours or minutes is 0 they should not be displayed in the output. Examples: Duration in seconds Output 14400 "4 hours" 14432 "4 hours" 604800 "7 days" 1800 "30 minutes" 108002 "1 day 6 hours"

simon_b · ‎10-12-2022

Hello, is it possible to change the color of the Single Value Visualization based on a time value of the search result. I get a timestamp as a search result and would like to make the text of the visualization red if the timestamp is from more than 3 days ago. Thanks for your help!

simon_b · ‎10-11-2022

Hi, is it possible to hide the description of the dashboard? I found the command to hide the title including the description but I just want to hide the description.

Posts	18
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎10-11-2022

Online Status	Offline
Date Last Visited	‎03-12-2024 06:56 AM

Rename fields before indexing

Is there a Token to get all fields from a search r...

How to save results to index with alert action?

How to insert link to other dashboard in table vis...

How to change the dafault value of "action.lookup....

How can I change default lifetime of job?

Is it possible to get info_min_time and info_max_t...

Convert seconds in days, hours and minutes?

Change color of Single Value Visualization based o...

Is it possible to hide the description of the dash...

Rename fields before indexing

Re: Is there a Token to get all fields from a sear...

Re: Is there a Token to get all fields from a sear...

Is there a Token to get all fields from a search r...

Re: Save results to index with alert action

Re: Save results to index with alert action

How to save results to index with alert action?

How to insert link to other dashboard in table vis...

How to change the dafault value of "action.lookup....

How can I change default lifetime of job?

Re: Get info_min_time and info_max_time of from m...

Re: Get info_min_time and info_max_time of from m...

Re: Get info_min_time and info_max_time of from m...

Is it possible to get info_min_time and info_max_t...

Convert seconds in days, hours and minutes?

Change color of Single Value Visualization based o...

Is it possible to hide the description of the dash...