Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About mdeterville
mdeterville
Path Finder
Member since:
01-17-2020
04-12-2022
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 2 |
| Member Since | 01-17-2020 |
Activity Feed
- Karma Re: Regex Extraction for johnhuang. 02-04-2022 10:41 AM
- Posted Regex Extraction on Splunk Search. 02-04-2022 09:51 AM
- Posted Using stats command to return 0 value on Splunk Search. 01-07-2022 06:07 AM
- Posted Re: Regex : Extract text between first and second semi-colon from the right on Splunk Search. 05-06-2021 01:30 PM
- Got Karma for Re: Regex : Extract text between first and second semi-colon from the right. 04-24-2021 09:17 PM
- Posted Re: Regex : Extract text between first and second semi-colon from the right on Splunk Search. 04-24-2021 09:16 PM
- Karma Re: Regex : Extract text between first and second semi-colon from the right for tscroggins. 04-24-2021 09:15 PM
- Posted Regex : Extract text between first and second semi-colon from the right on Splunk Search. 04-24-2021 08:36 PM
- Karma Re: Using REGEX to extract part of a combination of URLs for thambisetty. 11-16-2020 06:45 PM
- Posted Re: Using REGEX to extract part of a combination of URLs on Splunk Search. 11-12-2020 10:07 AM
- Karma Re: Using REGEX to extract part of a combination of URLs for thambisetty. 11-12-2020 09:58 AM
- Posted Using REGEX to extract part of a combination of URLs on Splunk Search. 11-11-2020 03:09 PM
- Posted Re: Using REGEX to extract portion of a string from a field on Splunk Search. 11-04-2020 06:17 PM
- Karma Re: Using REGEX to extract portion of a string from a field for inventsekar. 11-04-2020 06:15 PM
- Got Karma for Using REGEX to extract portion of a string from a field. 11-04-2020 05:57 PM
- Posted Using REGEX to extract portion of a string from a field on Splunk Search. 11-04-2020 05:23 PM
- Posted Show/Hide Panels based off time range picker on Dashboards & Visualizations. 08-27-2020 09:07 PM
- Karma Re: Regex to extract the end of a string (from a field) before a specific character (starting form the right) for richgalloway. 08-27-2020 08:25 PM
- Posted Re: Conditional searching using eval command with if match on Splunk Search. 03-05-2020 06:50 PM
- Posted Conditional searching using eval command with if match on Splunk Search. 03-05-2020 05:46 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-04-2022
09:51 AM
How do i extract everything after the 3rd / from the left in: WinNT://PSAD/johndoe The output should be "johndoe" Thanks in advance for your assistance!
... View more
Labels
- Labels:
-
field extraction
-
regex
01-07-2022
06:07 AM
Hi There: I'm trying to return the list of access_users with 0 web hits from the web_hits table. How can i adjust this query to return the list of users with no hits from the web_hits table? Thanks in advance! | inputlookup web_hits.csv | lookup local=t access_users.csv user OUTPUT user as access_user | search access_user="*" | stats count as num_webhits by access_user
... View more
Labels
- Labels:
-
stats
05-06-2021
01:30 PM
@tscroggins Ran into an issue where the data set also includes some categories only contains 1 Semi colon, similar to: "Business/Economy;User Accepted Business". Any idea if OR conditions can be used to combine the initial solution and another solution that grabs everything before the first semi-colon (FROM THE LEFT) when it finds fields with only one semi colon? Thanks in advance. -Mac
... View more
04-24-2021
09:16 PM
1 Karma
@tscroggins Worked like a charm - Thanks for the quick response!
... View more
04-24-2021
08:36 PM
Hello SMEs: I need some assistance extracting everything between the 1st and 2nd semi-colon ; (FROM THE RIGHT) from a string like this: SITES;Bypass;Whitelist;Finance;User Business Accept In this case, the output would be Finance. Note: text between the semi-colon's may change Any assistance would be appreciated. Regards, Mac
... View more
Labels
- Labels:
-
regex
11-12-2020
10:07 AM
Thanks so much @thambisetty ! This worked well! I was just wondering, what would the new rex's be for capturing 2 new fields: 1. Everything between the 3rd and 4th "/" - lets call this "button_click" 2. Everything between the 6th and 7th "/" - lets call this "domain_ref" FROM: https://notify.webproxy.com/User_Clicked_non-business/https://www.elitetools.ca/ Note: URLS and Button click types may change. Thanks again for your quick turnaround!
... View more
11-11-2020
03:09 PM
Hello SMEs: I need some assistance extracting everything between the 5th and 6th "/" from URLs like the one below. Note: URLs may change. https://notify.webproxy.com/https://www.elitetools.ca/en/ Your assistance would be appreciated!
... View more
Labels
- Labels:
-
regex
11-04-2020
06:17 PM
This works! Thanks for the quick turnaround @inventsekar!
... View more
11-04-2020
05:23 PM
1 Karma
Hi Everyone: I'd like to extract everything after the third "/" below (starting from the left) in the url field below: url=http://4.3.3.4/pld_accepted_business " Note: http://4.3.3.4/ will be constant. The latter may change between pld_accepted_business or pld_accepted_non_business" Any assistance would be greatly appreciated.
... View more
08-27-2020
09:07 PM
Hi There: I'd like to set up some panels that show/hide based on the values of the date/time range picker. Two different panels: 1. Show only when time range picker is set to <=30 days 2. Show only when time range picker is set to >30 days I've tested a few "depends" set ups with no luck. Any help would be greatly appreciated.
... View more
03-05-2020
06:50 PM
Thanks anmol.
The printer name typically looks like eg. Canon MF4770n (from WING_000.0.000.0-RCA).
... View more
03-05-2020
05:46 PM
Hi SMEs:
I would like to define a print event type to differentiate Remote Prints from Office Print jobs.
From my print logs, i'd like to:
Define channel = "Remote Print", where printer name contains "WING*RCA" else, "Office Print".
I started off with:
| eval channel = if(match(like printer="WING*RCA", "Remote Print"), "Office Print")
I'm still relatively new to these commands and would appreciate any assistance.
Thanks in advance,
Mac
... View more
- Tags:
- splunk-enterprise
01-20-2020
06:54 AM
This worked, thank you so much!
... View more
01-17-2020
08:21 PM
Hi Everyone:
I'd like to extract everything before the first "=" below (starting from the right):
sender=john&uid=johndoe
Note: I will be dealing with varying uid's and string lengths.
Any assistance would be greatly appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-12-2022
02:00 PM
|
Karma given to
