cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
srishtiarora
New Member
Member since: ‎04-11-2017
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-11-2017
Activity Feed
View All

Re: Filter out results from report using "rex _raw...

by in Splunk Search
‎04-11-2017 02:00 PM
‎04-11-2017 02:00 PM
The Code 1 to Code 3 and Message1 to message3 are just aliases as it cannot be shared, but they hold different values and there is no string with Message in them. when I tried adding eval temp=1 | untable temp Message Count | where count>0 | fields - temp, it didn't work. ... View more

Filter out results from report using "rex _raw" an...

by in Splunk Search
‎04-11-2017 01:26 PM
‎04-11-2017 01:26 PM
Hi, I am looking to filter out the contents of Search results that is using rex, transpose and count. we are having multiple results with count 0 and need to be removed from report as its occupying majority of dashboard. Below is Command sample: table "_raw" | rex field=_raw "(?PCode1)" | rex field=_raw "(?PCode2)" | rex field=_raw " (?PCode3) " | stats count(eval(match(AA,""))) AS "Message1", count(eval(match(AB,".*"))) AS "Message2" , count(eval(match(AC,".*"))) AS "Message3" |transpose i am not sure how i can filter out this as where count>0 is not working. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM