About lostpassword

lostpassword · ‎11-26-2013

try top 5 ... useother=t instead of chart limit=5

lostpassword · ‎11-26-2013

Well, it looks like I was actually looking for "top" function.) I've tried the following query: index = testindex | rex "(<= (?P .?) )" | search senderAddress= | top 9 senderAddress useother=t and then opened visualization tab. I think that's what I was trying to achieve. Thank you for your help.)

lostpassword · ‎11-25-2013

Well, as I can see, Splunk just groups all low-count items in one big sector named "other". http://postimg.org/image/ok8bc1fz5/ As I understand, total count of all events should be the same, no matter whether "by senderAddress" is specified or not. Where am I wrong?

lostpassword · ‎11-25-2013

Hello. I'm trying to execute this search: index = testindex | rex "(<= (?P<senderAddress>.*?) )" | search senderAddress=* | chart dc("messageID") by "senderAddress" After processing I can see really nice pie chart 🙂 But I also recieve this warning: These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached. And indeed, I can see only approx. 19k events in the chart, but there should be near 25k. At least, query index = testindex | rex "(<= (?P<senderAddress>.*?) )" | search senderAddress=* | chart dc("messageID") returns 25194. Can you explain me why search results are truncated? Thanks, Alex.

lostpassword · ‎11-15-2013

I'm writing all this by memory, so some parts may be incorrect. By the way, I haven't yet found a way to make Splunk understand Exim logs. I'm quite interested whether it is possible. If you will be able to achieve some progress, please spend a minute and share it here - or mail me at igonin.a.a rsreu.ru.

lostpassword · ‎11-15-2013

Well, I'm new too.) I don't know whether it is right approach... But you can try this: "Data models" -> -> "Edit objects" -> "Add event" -> " " -> -> -> -> -> and here you go) I suspect all this can be done at the indexing stage, but as far as I understood this is "bad practice".

lostpassword · ‎11-11-2013

To add Exim messsage ID field, try to add attribute by Regular expression. In my case, message ID can be extracted by this expression: "(? \w\w\w\w\w\w-\w\w\w\w\w\w-\w\w)"

Posts	7
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎11-10-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Event visualization limit

Re: "Other" option in pie chart

Re: Event visualization limit

Re: Event visualization limit

Event visualization limit

Re: Getting full mail transaction with Exim

Re: Getting full mail transaction with Exim

Re: Getting full mail transaction with Exim

Are you a member of the Splunk Community?