Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About shayhk
shayhk
Explorer
Member since:
11-20-2013
06-05-2020
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 1 |
| Member Since | 11-20-2013 |
Activity Feed
- Karma Re: Unable to delete search events for Damien_Dallimor. 06-05-2020 12:46 AM
- Karma Re: Splunk dont show fields after parsed. why? for lukejadamec. 06-05-2020 12:46 AM
- Karma Re: Self Join Statement does not work for somesoni2. 06-05-2020 12:46 AM
- Got Karma for Re: join two table. 06-05-2020 12:46 AM
- Posted count number of users in the app on All Apps and Add-ons. 03-17-2014 05:33 AM
- Tagged count number of users in the app on All Apps and Add-ons. 03-17-2014 05:33 AM
- Tagged count number of users in the app on All Apps and Add-ons. 03-17-2014 05:33 AM
- Tagged count number of users in the app on All Apps and Add-ons. 03-17-2014 05:33 AM
- Posted Re: Convert string to date on Splunk Search. 12-24-2013 06:59 AM
- Posted Convert string to date on Splunk Search. 12-24-2013 03:43 AM
- Tagged Convert string to date on Splunk Search. 12-24-2013 03:43 AM
- Tagged Convert string to date on Splunk Search. 12-24-2013 03:43 AM
- Tagged Convert string to date on Splunk Search. 12-24-2013 03:43 AM
- Posted Re: Self Join Statement does not work on Splunk Search. 12-17-2013 07:53 AM
- Posted Re: join two table on Splunk Search. 12-17-2013 06:10 AM
- Posted Self Join Statement does not work on Splunk Search. 12-17-2013 04:30 AM
- Tagged Self Join Statement does not work on Splunk Search. 12-17-2013 04:30 AM
- Tagged Self Join Statement does not work on Splunk Search. 12-17-2013 04:30 AM
- Tagged Self Join Statement does not work on Splunk Search. 12-17-2013 04:30 AM
- Tagged Self Join Statement does not work on Splunk Search. 12-17-2013 04:30 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-17-2014
05:33 AM
Hi,
I am trying to show the uniq users list but getting diffrent results
for example I have this list of data
USER_ID
1111111
2222222
2222222
3333333
4444444
4444444
Why are there diffrent number of results when doing:
...|table id|uniq
...|table id|stats dc(id)
... View more
12-24-2013
06:59 AM
I tried
host=...
| table DateTime1
| convert timeformat="%Y-%m-%d %T" mktime(DateTime1) as _time
but the _time column is empty
the DateTime value is [2013-12-17 09:38:57.7667]
... View more
12-24-2013
03:43 AM
Hi, I am tring to convert string data to date and find diff second
the problem is that i cant convert the string to date
...
|table Key DateTime1 DateTime2
Datetime1&2 formats are [2013-12-17 09:38:57.7667] and they are strings
i want to find the diff seconds between them
... View more
12-17-2013
06:10 AM
1 Karma
hi,
I have the same problem
mysearchA | table field1 field2
| JOIN field1 [ mysearchB | table field1 field3]
| table field1 field2 field3
what is the mySearchA,mySearchB stands for ?
my data provider(file) is a host named XXX
when i am using a host=XXX in both of "mySearchA,B" expression i am getting an error
help needed
Thanks shay
... View more
12-17-2013
04:30 AM
Self Join Statement does not work
Host Demo
RequestID | Method | Type
111 Method_X 1
222 Method_T 1
111 Method_Q 2
233 Method_R 1
As a result
i am looking for the flow of RequestID=111
RequestID | Method1 | Method2
111 Method_X Method_Q
Search code- not working:
host=Demo
| table RequestID Method
| where RequestID =111 and Type=1
| rename Method as Method1
| selfjoin RequestID
[
table RequestID Method
| where RequestID =111 and Type=2
| rename Method as Method2
]
|table RequestID Method1 Method2
looking for a solution
Thanks
shay
... View more
12-01-2013
12:14 AM
The problem is that the folder is locked by solunk.
so i copied the relevant file changed them and copy them back.
... View more
11-27-2013
03:37 AM
FIELDS = date datetime service ws browser params gui empty method id status ver
or
FIELDS = "date"|"datetime"|"service"|"ws"|"browser"|"params"|"gui"|"empty"|"method"|"id"|"status"|"ver"
????
... View more
11-27-2013
03:34 AM
it's not working.
i changed the props.conf + transforms.conf
and restarted the splunk service.
... View more
11-27-2013
03:32 AM
I did all these thing and still, the fileds i asked for are are not showen in the selected\Interesting fields bar.
... View more
11-26-2013
07:15 AM
all i need to do is to create the file and define it like you did?
... View more
11-26-2013
06:15 AM
i dont have a transforms.conf file.
only props.conf.
how can i do it from the SplunkWeb Gui?
thanks
... View more
11-26-2013
06:12 AM
Hi, I only have the option to add Data Inputs from single file.
how do i load a directory full of logs?
... View more
11-26-2013
05:55 AM
I Restart and it didnt help.
I Still cant modify the Prop.conf
Is there away to do it in the Web UI?
... View more
11-26-2013
05:21 AM
Sample Log File
2013-10-31|2013-10-31 00:00:00|serv1|ws1|Mozilla|p1=1,p2=2,p3=3|hash1||method1|id||2.01
2013-11-01|2013-10-31 00:00:00|serv1|ws2|Chrome|p1=55,p2=432,p3=3|hash2||method2|id||3.31
2013-10-03|2013-10-31 00:00:00|serv1|ws3|Explorer|p1=34,p2=434434,p3=555555|hash3||method3|id||4.41
Question
The log fields are fixed and there is adlimiter '|' between them
I want that the splunk automaticlly parse data rows into fileds
I add the prop.conf these attributes
DELIMS = "|"
FIELDS = "date"|"datetime"|"service"|"ws"|"browser"|"params"|"gui"|"empty"|"method"|"id"|"status"|"ver"
Why dont I see those fields on the Selected/Interesting Fields list?
what am i missing?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
