×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
sandmountain
Explorer
Member since: ‎09-27-2023
‎09-29-2023
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎09-27-2023
View All

Re: Lookup and setting default values using a vari...

by in Splunk Search
‎09-28-2023 06:59 AM
‎09-28-2023 06:59 AM
If should produce the following if the xrq_h_x-corapi-target-id e.g. contains IIDP099999 and this value is not found in the lookup. How do I get the contents of the variable and  not the name of the variable itself?   ProviderId ProviderName IIDP099999 IIDP099999 IIDP06300 My Bank AG ... View more

Lookup and setting default values using a variable...

by in Splunk Search
‎09-28-2023 06:56 AM
‎09-28-2023 06:56 AM
I have the following Query: index=obh_prod sourcetype=obh:edge:api proxy!="ow*" | lookup blink_six_providers ProviderId as pxrq_h_x-corapi-target-id OUTPUT ProviderId ProviderName | fillnull value=target_id ProviderId ProviderName | dedup ProviderName ProviderId | table ProviderId ProviderName If no values are found ProviderId, ProviderName should both get the value of pxrq_h_x-corapi-target-id. If actually now produces: ProviderId ProviderName pxrq_h_x-corapi-target-id pxrq_h_x-corapi-target-id IIDP06300 Valiant Bank AG IIDP00761 Aargauische Kantonalbank       If should produce the following if the xrq_h_x-corapi-target-id e.g. contains IIDP099999 and this value is not found in the lookup. How do I get the contents of the variable and  not the name of the variable itself?   ProviderId ProviderName IIDP099999 IIDP099999 IIDP06300 Valiant Bank AG IIDP00761 Aargauische Kantonalbank   ... View more
Labels

Re: Select the right index based on value in Dropd...

by in Splunk Search
‎09-28-2023 06:45 AM
‎09-28-2023 06:45 AM
Thx that worked fine ... View more

Select the right index based on value in Dropdown

by in Splunk Search
‎09-27-2023 02:07 PM
‎09-27-2023 02:07 PM
I have a dropdown with two values PROD and TEST. Based on my selection in my panels in the dashboard I have to choose a different index for my search. How can I do this? Example of two searches: (which also includes other tokens. These can be ignored. Both searches work if I directly put in the right index 1/  index=<IF PROD then AAA_prod_index else AAA_test_index> sourcetype IN (abc:edge:api, abc:edge:api)  proxy!="ow*" $client_token$ $target_token$ | rex mode=sed field=proxy "s#^(.*?)_(.*)$#*_\2#" | stats count by proxy 2/ index=<IF PROD then BBB_prod_index else BBB_test_index> sourcetype=accesslog  tenant=$tenant_token$ | stats count by HTTPStatusCode ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-29-2023 08:23 AM
Karma given to
View All