About Miguel3393

Miguel3393 · ‎01-09-2025

Thanks for the response @gcusello This is the result I get with what you mention. Regards.

Miguel3393 · ‎01-08-2025

I have this search, where I get the duration and I need to convert it to integer: Example: Min:Sec to Whole 00:02 to 1 00:16 to 1 01:53 to 2 09:20 to 10 ...etc Script: index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR "Call.TermParty.TrunkGroup.TrunkGroupId"="2810" "Call.ConnectTime"=* "Call.DisconnectTime"=* |lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie | eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q") | eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q") | eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime') | eval Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duración Spain 00:02 Spain 00:16 Argentina 00:53 Spain 09:20 Spain 02:54 Spain 28:30 Spain 01:18 Spain 00:28 Spain 16:40 Spain 00:03 Chile 00:25 Uruguay 01:54 Spain 01:54 Regards.

Miguel3393 · ‎12-16-2024

Sorry for the delay, thanks for the response. Does not show duration information. Countrie Duracion Uruguay Uruguay Uruguay Uruguay Denmark China Chile Spain Uruguay Spain Spain Spain Uruguay Spain Spain Uruguay Spain

Miguel3393 · ‎12-06-2024

Thanks. I paste the script and result index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR "Call.TermParty.TrunkGroup.TrunkGroupId"="2810" "Call.ConnectTime"=* "Call.DisconnectTime"=* |lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie | eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q") | eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q") | eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime') | eval Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duracion Countrie Duracion Chile 01:17 Hong Kong 00:02 Denmark 02:01 Denmark 00:51 Denmark 00:51 Denmark 06:30 China 02:59 Uruguay 00:18

Miguel3393 · ‎12-06-2024

Thanks. I paste the script and result index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR "Call.TermParty.TrunkGroup.TrunkGroupId"="2810" "Call.ConnectTime"=* "Call.DisconnectTime"=* |lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie | eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q") | eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q") | eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime') | eval Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duracion Countrie Duracion Chile 01:17 Hong Kong 00:02 Denmark 02:01 Denmark 00:51 Denmark 00:51 Denmark 06:30 China 02:59 Uruguay 00:18

Miguel3393 · ‎12-06-2024

How can I get the total sum of the Duration fields? Regards.

Miguel3393 · ‎11-04-2024

Hi, It was added in the following way and it did not work, it does not show results. index="cdr_cfs_index" | search Call.OrigParty.TrunkGroup.TrunkGroupId=2601 | lookup ClientesSymSipdfntion1 Call.OrigParty.CallingPartyAddr OUTPUT cliente | lookup ClientesSymSipdfntion2 Call.OrigParty.CallingPartyAddr OUTPUT cliente1 | fillnull value=null Call.CallForwardInfo.OriginalCalledAddr | where isnull(cliente) AND isnull(cliente1) AND Call.CallForwardInfo.OriginalCalledAddr="null" | stats count by Call.OrigParty.CallingPartyAddr Call.CallForwardInfo.OriginalCalledAddr | sort - Call.CallForwardInfo.OriginalCalledAddr

Miguel3393 · ‎11-04-2024

I added it but it doesn't work, it doesn't show results.

Miguel3393 · ‎11-04-2024

How can I make it show me only what appears as null in the Call.CallForwardInfo.OriginalCalledAddr field? Right now I have this result, you can help me.

Miguel3393 · ‎05-09-2024

If I wanted to add another error ,example Codigo_error="11", what would I have to do?

Miguel3393 · ‎05-09-2024

If I wanted to add another error ,example Codigo_error="10001", what would I have to do?

Miguel3393 · ‎05-09-2024

Sorry, I misunderstood, it works correctly.

Miguel3393 · ‎05-09-2024

Thanks for the response, it does show info, but it seems that it looks for all errors and not just 10001 and 69. and it seems not to respect that it only shows when the percentage is greater than 10. Regards

Miguel3393 · ‎05-08-2024

Since I can get it to show me when the percentage of errors 69 and 10001 is greater than 10, with the following search it doesn't work, you can help me. index="cdr" | search "Tipo_Trafico"="*" "Codigo_error"="*" | stats count(eval(Tipo_Trafico="MT")) AS Total_MT, count(eval(Codigo_error="69")) AS Error_69 | eval P_Error_69=((Error_69*100/Total_MT)) | stats count(eval(Tipo_Trafico="MT")) AS Total_MT, count(eval(Codigo_error="10001")) AS Error_10001 | eval P_Error_10001=((Error_10001*100/Total_MT)) | stats count by P_Error_69, P_Error_10001 | where count>10

Miguel3393 · ‎04-10-2024

Hello, I have these two results, I need to compare them and tell me when they are different, could you help me. Regards.

Miguel3393 · ‎05-15-2023

Thanks for the answers, I managed to get what I was looking for with the following. | eval value=('Tipo_Trafico') | eval ascii=urldecode(ltrim(replace(value,"([a-fA-F0-9]{2})","%\1"),"0x"))

Miguel3393 · ‎05-11-2023

I was able to get the text from the hexadecimal like this: But I need to do it by evaluating a file from an index, because I don't know the value that will come in hexadecimal, it will always come different.

Miguel3393 · ‎05-11-2023

no, i want to convert hexadecimal to text. Example: (Hexadecimal) 20456C20636F7272656F20656C656374726F6E69636F206465207475206375656E74612073652061637475616C697A6F (conver to text) El correo electrónico de tu cuenta se actualizo Regards.

Miguel3393 · ‎05-11-2023

In an index I have files in hexadecimal and I want to convert it to text in a search. Is there a way to parse that file into hexadecimal and convert it to text could you help me?, greetings

Miguel3393 · ‎05-05-2023

Thanks for the answers. How can I visualize in a table the destinations that are not in the lookup? Regards.

Miguel3393 · ‎05-05-2023

Hello, The search seems to work, but the destination is still not visible in the table Regards

Miguel3393 · ‎05-04-2023

Hello, I have a lookup table with numbers, where it checks the numbers that match the error_code 11. index="cdrs" "error_code"="11" "Destino"="*" | lookup DIDREPEP Destino OUTPUT Destino | table Destino But it shows some blank results because they are not in the lookup table. How can I do so that it only shows me the destination that is not in the search table?. thanks greetings.

Miguel3393 · ‎05-03-2023

Hello, I have a lookup table with numbers, where it checks the numbers that match the error_code 11. index="cdrs" "error_code"="11" "Destino"="*" | lookup DIDREPEP Destino OUTPUT Destino | table Destino But it shows some blank results because they are not in the lookup table. How can I do so that it only shows me the destination that is not in the search table?. thanks greetings.

Posts	23
Solutions	0
Karma Given	10
Karma Received	0
Member Since	‎05-03-2023

Online Status	Offline
Date Last Visited	‎03-05-2025 04:20 PM

Convert duration time to number integer

Sum values fields

Show only null result

Porcentage two values

Compare search results

How do I convert Hexadecial to text?

How to show the destination not in the search tab...

How to only show the destination not in the search...

Re: Convert duration time to number integer

Convert duration time to number integer

Re: Sum values fields

Re: Sum values fields

Re: Sum values fields

Sum values fields

Re: Show only null result

Re: Show only null result

Show only null result

Re: Porcentage two values

Re: Porcentage two values

Re: Porcentage two values

Re: Porcentage two values

Porcentage two values

Compare search results

Re: How do I convert Hexadecial to text?

Re: How do I convert Hexadecial to text?

Re: How do I convert Hexadecial to text?

How do I convert Hexadecial to text?

Re: How to show the destination not in the search...

Re: How to show the destination not in the search...

How to show the destination not in the search tab...

How to only show the destination not in the search...

Are you a member of the Splunk Community?