×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
hbusch
New Member
Member since: ‎04-07-2017
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-07-2017
View All

Re: Why are some searches only rarely executed wit...

by in Splunk Search
‎04-21-2017 07:28 AM
‎04-21-2017 07:28 AM
I ended up with exactly the same search. I suppose it was hidden in the details, I am unsure about what I can share, because they are related directly to my work. In theory the original search should work, but maybe there is something I am missing here. If there would have been a difference I would have gladly shared it already. My final search looks like this (I have left a few more details in): | inputcsv origin.csv where <condition> | eval zip_data_first=substr(zip,1,2) | lookup zip.csv zip_first as zip_data_first OUTPUTNEW lat lon and because I am ending up with multiple matches I added this (maybe someone make a good use of it even though my problem has somehow just vanished): | stats avg(lat) avg(lon) by zip_data_first, <addtl. fields> ... View more

Re: Why are some searches only rarely executed wit...

by in Splunk Search
‎04-20-2017 11:36 PM
‎04-20-2017 11:36 PM
Thank you for your suggestion, so far this works, great! It seems that my error is located somewhere in the search, I will have a further look, maybe I can get it to work now. Edit: It works now! Thank you so much! ... View more

Why are some searches only rarely executed without...

by in Splunk Search
‎04-19-2017 06:04 AM
‎04-19-2017 06:04 AM
Hey everyone i have a little bit of a problem with some of my searches, as I am only rarely able to execute them. Splunk Web just keeps showing the "new search" page (in a dashboard it shows "Could not create search") without any error or warning occurring. I will try to explain what I am trying to do, maybe that helps finding my mistake. So here is one of the searches which failed this way just now: | inputcsv fileone.csv where condition | eval fieldone_first=substr(fieldone,1,2) | lookup filetwo.csv fieldtwo AS fieldone_first OUTPUTNEW lat lon I want to match zip codes in a field from one csv to another. While the first file is basically the origin, the second csv is a table matching zip codes to coordinates. Because it is rather incomplete I would like to only match the first two characters of the zip code I have currently imported two csv files into Splunk which are working fine on their own. Now I try to match the first two characters of the one table to a field of the other table. I hope anyone here has an idea. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM