About hantun

hantun · ‎07-13-2023

Hello, I have two panels with different logic (various indexes and filters) that produces X and Y respectively. I want to see if we can combine X+Y=Z to create a Z number. Would you be able to do that with Splunk? I do not want to reuse the both logics to get Z.

hantun · ‎04-27-2023

How can we put that SPL query into a dynamic dropdown? My project is looking for if the query spits out 1X, splunk gets all the events with the Business as 1X. If query is looking for 2X, gets all the events with Business as 2X. Then, I have dashboard panels that are doing counts etc depending on the dropdown.

hantun · ‎04-25-2023

Can we put that into a static function of a dropdown? If so, how should we go about it? I am building dashboard where we are counting the business

hantun · ‎04-25-2023

index=csmp OR index=aws-business-map OR index=sim OR index=guardduty | eval BindleNew = case(sourcetype="sim_csmp", AWSAccountName, sourcetype="csv", BindleName, sourcetype="sim_prod", WAWT2-BindleName, sourcetype="sim_prod", CloudTrail-AWSAccountName, sourcetype="sim_gd", AWSAccountId) | stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(WAWT2-BindleName), values(CloudTrail-AWSAccountName), values(AWSAccountId), values(Business) as Business by BindleNew | search AWSAccountName!="" Business="XP" This is what I have for combination so far. Something to note is that CloudTrail-AWSAccountName, WAWT2-BindleName, BindleName, AWSAccountName are all the same data. Can we normalize them using Match?

hantun · ‎04-24-2023

I have a search where I am comparing two indexes for a matching cell and I am trying to filter where Business = 1X... here's the SPL: index=csmp OR index=aws-business-map | eval BindleNew = case(sourcetype="sim_csmp", AWSAccountName, sourcetype="csv", BindleName) | stats values(IssueUrl), values(AWSAccountName) as AWSAccountName, values(BindleName), values(Business) by BindleNew | search AWSAccountName!="" I am unsure where to put Business-="1X" clause. Also, if we have more indexes like csmp that I am trying to compare to aws-business-map, how do we go about matching 4 indexes to aws-business-map?

hantun · ‎03-28-2023

I got up to this: index=csmp | rex field=Title "^CSMP\s-\s(?<BindleName>\w+)\s-\s([a-zA-Z0-9 ]*)$" | eval BindleName=Title | lookup CostCentersandAWSAccounts.csv Business BindleName I am confused why it is not returning the BindleName which is what I am parsing and comparing to the Lookup table's column named BindleName. Once the comparison is made, I want the search to return the related row of the Business column from the Lookup table. I feel like I am missing something big here...

hantun · ‎03-27-2023

Hello - I am looking to match an uploaded lookup table in csv format to the indexes we have. I am running into problems since the column I want to match in the index is not parsed. I have two questions: 1. Can we parse in splunk to extract the numbers and words we need? If so, what is the resource I need or how do I parse correctly? 2. I am looking to match a column in my lookup table to the parsed data in the index. We have different indexes and we need to look all of them up with the same lookup table csv. What I have so far is this, do we need eval command? index=guardduty | [ |inputlookup CostCentersandAWSAccounts.csv | search AccountId=Title | fields Business ]

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎03-27-2023

Online Status	Offline
Date Last Visited	‎07-13-2023 03:44 PM

Adding two values

Why am I getting where clause?

Comparing input lookup table to index?

Adding two values

Re: Getting where clause

Re: Why am I getting where clause?

Re: Getting where clause

Why am I getting where clause?

Re: Comparing input lookup table to index

Comparing input lookup table to index?

Are you a member of the Splunk Community?