Activity Feed
- Karma Re: Convert duration time to number integer for gcusello. 01-10-2025 09:51 AM
- Karma Re: Convert duration time to number integer for isoutamo. 01-10-2025 09:50 AM
- Karma Re: Convert duration time to number integer for bowesmana. 01-10-2025 09:50 AM
- Posted Re: Convert duration time to number integer on Splunk Search. 01-09-2025 07:08 AM
- Posted Convert duration time to number integer on Splunk Search. 01-08-2025 01:13 PM
- Tagged Convert duration time to number integer on Splunk Search. 01-08-2025 01:13 PM
- Tagged Convert duration time to number integer on Splunk Search. 01-08-2025 01:13 PM
- Posted Re: Sum values fields on Splunk Search. 12-16-2024 03:42 PM
- Posted Re: Sum values fields on Splunk Search. 12-06-2024 11:37 AM
- Posted Re: Sum values fields on Splunk Search. 12-06-2024 11:32 AM
- Posted Sum values fields on Splunk Search. 12-06-2024 10:30 AM
- Tagged Sum values fields on Splunk Search. 12-06-2024 10:30 AM
- Tagged Sum values fields on Splunk Search. 12-06-2024 10:30 AM
- Posted Re: Show only null result on Splunk Search. 11-04-2024 09:05 PM
- Posted Re: Show only null result on Splunk Search. 11-04-2024 06:06 PM
- Tagged Show only null result on Splunk Search. 11-04-2024 04:27 PM
- Posted Show only null result on Splunk Search. 11-04-2024 03:28 PM
- Tagged Show only null result on Splunk Search. 11-04-2024 03:28 PM
- Tagged Show only null result on Splunk Search. 11-04-2024 03:28 PM
- Tagged Show only null result on Splunk Search. 11-04-2024 03:28 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-09-2025
07:08 AM
Thanks for the response @gcusello This is the result I get with what you mention. Regards.
... View more
01-08-2025
01:13 PM
I have this search, where I get the duration and I need to convert it to integer: Example:
Min:Sec to Whole
00:02 to 1 00:16 to 1 01:53 to 2 09:20 to 10
...etc
Script:
index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR
"Call.TermParty.TrunkGroup.TrunkGroupId"="2810"
"Call.ConnectTime"=*
"Call.DisconnectTime"=*
|lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie
| eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q")
| eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q")
| eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime')
| eval Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duración
Spain 00:02
Spain 00:16
Argentina 00:53
Spain 09:20
Spain 02:54
Spain 28:30
Spain 01:18
Spain 00:28
Spain 16:40
Spain 00:03
Chile 00:25
Uruguay 01:54
Spain 01:54
Regards.
... View more
12-16-2024
03:42 PM
Sorry for the delay, thanks for the response. Does not show duration information. Countrie Duracion Uruguay Uruguay Uruguay Uruguay Denmark China Chile Spain Uruguay Spain Spain Spain Uruguay Spain Spain Uruguay Spain
... View more
12-06-2024
11:37 AM
Thanks. I paste the script and result index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR "Call.TermParty.TrunkGroup.TrunkGroupId"="2810" "Call.ConnectTime"=* "Call.DisconnectTime"=* |lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie | eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q") | eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q") | eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime') | eval Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duracion Countrie Duracion Chile 01:17 Hong Kong 00:02 Denmark 02:01 Denmark 00:51 Denmark 00:51 Denmark 06:30 China 02:59 Uruguay 00:18
... View more
12-06-2024
11:32 AM
Thanks. I paste the script and result index="cdr" | search "Call.TermParty.TrunkGroup.TrunkGroupId"="2811" OR "Call.TermParty.TrunkGroup.TrunkGroupId"="2810" "Call.ConnectTime"=* "Call.DisconnectTime"=* |lookup Pais Call.RoutingInfo.DestAddr OUTPUT Countrie | eval Disctime=strftime('Call.DisconnectTime'/1000,"%m/%d/%Y %H:%M:%S %Q") | eval Conntime=strftime('Call.ConnectTime'/1000, "%m/%d/%Y %H:%M:%S%Q") | eval diffTime=('Call.DisconnectTime'-'Call.ConnectTime') | eval Duracion=strftime(diffTime/1000, "%M:%S") | table Countrie, Duracion Countrie Duracion Chile 01:17 Hong Kong 00:02 Denmark 02:01 Denmark 00:51 Denmark 00:51 Denmark 06:30 China 02:59 Uruguay 00:18
... View more
12-06-2024
10:30 AM
11-04-2024
09:05 PM
Hi, It was added in the following way and it did not work, it does not show results. index="cdr_cfs_index" | search Call.OrigParty.TrunkGroup.TrunkGroupId=2601 | lookup ClientesSymSipdfntion1 Call.OrigParty.CallingPartyAddr OUTPUT cliente | lookup ClientesSymSipdfntion2 Call.OrigParty.CallingPartyAddr OUTPUT cliente1 | fillnull value=null Call.CallForwardInfo.OriginalCalledAddr | where isnull(cliente) AND isnull(cliente1) AND Call.CallForwardInfo.OriginalCalledAddr="null" | stats count by Call.OrigParty.CallingPartyAddr Call.CallForwardInfo.OriginalCalledAddr | sort - Call.CallForwardInfo.OriginalCalledAddr
... View more
11-04-2024
03:28 PM
05-09-2024
05:43 PM
If I wanted to add another error ,example Codigo_error="11", what would I have to do?
... View more
05-09-2024
05:42 PM
If I wanted to add another error ,example Codigo_error="10001", what would I have to do?
... View more
05-09-2024
02:30 PM
Thanks for the response, it does show info, but it seems that it looks for all errors and not just 10001 and 69. and it seems not to respect that it only shows when the percentage is greater than 10. Regards
... View more
05-08-2024
07:14 PM
Since I can get it to show me when the percentage of errors 69 and 10001 is greater than 10, with the following search it doesn't work, you can help me.
index="cdr"
| search "Tipo_Trafico"="*" "Codigo_error"="*"
| stats count(eval(Tipo_Trafico="MT")) AS Total_MT, count(eval(Codigo_error="69")) AS Error_69
| eval P_Error_69=((Error_69*100/Total_MT))
| stats count(eval(Tipo_Trafico="MT")) AS Total_MT, count(eval(Codigo_error="10001")) AS Error_10001
| eval P_Error_10001=((Error_10001*100/Total_MT))
| stats count by P_Error_69, P_Error_10001
| where count>10
... View more
04-10-2024
06:08 PM
Hello, I have these two results, I need to compare them and tell me when they are different, could you help me. Regards.
... View more
Labels
- Labels:
-
Classic dashboard
05-15-2023
08:41 AM
Thanks for the answers, I managed to get what I was looking for with the following. | eval value=('Tipo_Trafico') | eval ascii=urldecode(ltrim(replace(value,"([a-fA-F0-9]{2})","%\1"),"0x"))
... View more
05-11-2023
02:49 PM
I was able to get the text from the hexadecimal like this: But I need to do it by evaluating a file from an index, because I don't know the value that will come in hexadecimal, it will always come different.
... View more
05-11-2023
09:44 AM
no, i want to convert hexadecimal to text. Example: (Hexadecimal) 20456C20636F7272656F20656C656374726F6E69636F206465207475206375656E74612073652061637475616C697A6F (conver to text) El correo electrónico de tu cuenta se actualizo Regards.
... View more
05-11-2023
07:05 AM
In an index I have files in hexadecimal and I want to convert it to text in a search.
Is there a way to parse that file into hexadecimal and convert it to text
could you help me?, greetings
... View more
- Tags:
- convertion
- hex
- text
Labels
- Labels:
-
field extraction
05-05-2023
03:03 PM
Thanks for the answers. How can I visualize in a table the destinations that are not in the lookup? Regards.
... View more
05-05-2023
12:23 PM
Hello, The search seems to work, but the destination is still not visible in the table Regards
... View more
05-04-2023
02:05 PM
Hello, I have a lookup table with numbers, where it checks the numbers that match the error_code 11. index="cdrs" "error_code"="11" "Destino"="*" | lookup DIDREPEP Destino OUTPUT Destino | table Destino But it shows some blank results because they are not in the lookup table. How can I do so that it only shows me the destination that is not in the search table?. thanks greetings.
... View more
- Tags:
- lookup
Labels
- Labels:
-
configuration
-
correlation search
05-03-2023
09:43 PM
Hello,
I have a lookup table with numbers, where it checks the numbers that match the error_code 11.
index="cdrs" "error_code"="11" "Destino"="*"
| lookup DIDREPEP Destino OUTPUT Destino | table Destino
But it shows some blank results because they are not in the lookup table. How can I do so that it only shows me the destination that is not in the search table?.
thanks greetings.
... View more
Labels
- Labels:
-
correlation search
