Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jtabilas
jtabilas
Loves-to-Learn Everything
Member since:
06-27-2023
07-07-2023
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-27-2023 |
Activity Feed
- Posted index and the sourcetypes in which the hosts have collected events, with the date of the first and last event on the spe on Splunk Search. 07-07-2023 12:49 AM
- Posted Re: query search don't match on input on Splunk Search. 07-06-2023 06:53 AM
- Posted Re: query search don't match on input on Splunk Search. 07-06-2023 06:52 AM
- Posted query search don't match on input on Splunk Search. 07-06-2023 06:42 AM
- Posted Re: Duration between Login and Logout of user Splunk on Splunk Search. 07-05-2023 03:14 AM
- Posted How do I calculate the duration between Login and Logout of user? on Splunk Search. 07-05-2023 03:06 AM
- Posted Re: Connect multiselect to another multiselect on Dashboards & Visualizations. 06-28-2023 03:21 AM
- Posted Re: Connect multiselect to another multiselect on Dashboards & Visualizations. 06-28-2023 02:40 AM
- Posted How do I connect multiselect to another multiselect? on Dashboards & Visualizations. 06-28-2023 02:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-07-2023
12:49 AM
on index=_internal I have to create two searches one on (report ) and one connected to the dashboard where the index and the sourcetypes have collected events, with the date of the first and last event on the specific sourcetypes, the searches must take into account the data already present in the lookup itself. With the search, we don't have to overwrite the lookup every time, making the very purpose of its creation fail, since the date of the first event is lost as soon as the searchable data go beyond the retention of the indexes. also with 2 lookup datasets, an old one we have, a new one we need to create. check between the old and the new. if the old recorded data is old, it is kept if the new data is among the oldest, it will be replaced. below the oldlookup search /// // index="_internal"
| stats count, earliest(_time) as first, latest(_time) as last by sourcetype, index, host
| eval first = strftime(first, "%Y-%m-%d %H:%M:%S"), last = strftime(last, "%Y-%m-%d %H:%M:%S")
| table host, index, sourcetype, first, last
| rename first as "first event", last as "last event"
| sort - "first event"
| outputlookup old
.csv
... View more
Labels
- Labels:
-
lookup
-
search job inspector
-
subsearch
07-06-2023
06:53 AM
07-05-2023
03:14 AM
Can i monitor the session of user?
... View more
07-05-2023
03:06 AM
Hi guys! I want see the avg duration of activity of user on Splunk, but i didn't find the field of logout.
... View more
Labels
- Labels:
-
fields
06-28-2023
03:21 AM
Hi, thank you. But what do you mean "You didn't defined the field both"?
... View more
06-28-2023
02:40 AM
so this is my solution <input type="multiselect" token="city" searchWhenChanged="true">
<label>City</label>
<delimiter>,</delimiter>
<choice value="*">All</choice>
<fieldForLabel>city</fieldForLabel>
<fieldForValue>city</fieldForValue>
<search>
<query>source="*pubblico.json" index="google_reports" sourcetype="ga_json" | fields city | dedup city </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<default>*</default>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
<input type="multiselect" token="category2" searchWhenChanged="true">
<label>Category</label>
<default>*</default>
<choice value="*">All</choice>
<delimiter> ,</delimiter>
<fieldForLabel>category</fieldForLabel>
<fieldForValue>category</fieldForValue>
<search>
<query>| inputlookup categories| search $city$ | fields category | dedup category</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
... View more
06-28-2023
02:09 AM
Hi guys, i want connect my multiselect City to multiselect Category. First i try with add token in the second multiselect (Category) but don't work :(. Any solutions?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-07-2023
04:59 AM
|
