About plynch52

tmcmaster · ‎12-22-2021

I just ran into an issue with the accepted answer. While the $ work for a normal query. When using it in a dashboard the $123$ is evaluated as a dashboard token rather than a field. For a dashboard you must change it to single quotes. | stats count as 123 | eval abc = round('123', 2)

somesoni2 · ‎04-10-2017

Assuming your field extraction is working fine and you're getting fields with numeric names, give this a try your base search | table _time 1* 2* 3* 4* 5* 6* 7* 8* 9* 0* | untable _time fieldnames fieldvalues Once you get one row for each field using above search, your run searches like this Top 10 fields based on count ...above search.. | top fieldnames Top 10 fields based on fieldvalues column ...above search.. | sort 10 -fieldvalues Top 10 based on sum of fieldvalues ...above search.. | stats sum(fieldvalues) as fieldvalues by fieldnames | sort 10 -fieldvalues

plynch52 · ‎04-03-2017

Thanks, I goofed on copy the parse rex field=stats max_match=100 "(? kvpair \d*=\d*)" with angle brackets around kvpair

plynch52 · ‎03-31-2017

Thanks, as a newbie I figured there had to be some way. The original regex was generated by Splunk. It parsed the kv pairs.

Posts	8
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎03-28-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to report on the top 10 fields when logs have ...

How to use dbx to lookup Ids?

Why can't I generate KV pairs from nested field?

Re: Eval on numerically named fields

Re: How to report on the top 10 fields when logs h...

Re: How to use dbx to lookup Ids?

Re: Why can't I generate KV pairs from nested fiel...

Are you a member of the Splunk Community?