×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
OrionCulver
Explorer
Member since: ‎11-09-2023
‎11-14-2023
Community Statistics
Posts 22
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎11-09-2023
Activity Feed
View All

Re: Bar Chart Drilldown To Dynamically Generate Ev...

by in Dashboards & Visualizations
‎11-14-2023 10:15 AM
‎11-14-2023 10:15 AM
The difficulty is that click.name2 is the group by in the query, which is dynamically determined by the eval in the query (the AppName).  That AppName is for making the chart human readable, but the drill down need to "convert" the AppName back into the search terms used for the clicked on AppName.  e.g., the app named GVMSAuth is really the search terms (SourceName="KmsService" AND Message="*GVMSAuth(Ver:*"), as far as seeing the event logs. Does that make sense? ... View more

Re: grouping count by multiple field substrings

by SplunkTrust in Splunk Search
‎11-09-2023 07:07 AM
1 Karma
‎11-09-2023 07:07 AM
1 Karma
Almost.  The append must use the same field names as the main search (I used field names from your example output). | eval appType = case(SourceName="Foo \"bar(\"", "app1", SourceName="Foo \"quill(\"", "app2", SourceName="Foo", "app3", source=abcde, "app4", sourcetype=windows AND eventcode=11111, "app5", 1==1, "other") | stats count by appType | append [ makeresults format=csv data="appType,count app1,0 app2,0 app3,0 app4,0 app5,0"] | stats sum(count) as count by appType ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-14-2023 06:13 PM
Karma given to
View All