About Balajiraj

Balajiraj · ‎01-27-2020

Approach 1) Have u tried combination of spath and mv expand. Something like spath path=auditLogs{} output=x | fields - _raw | fields x| mvexpand x Approach 2) Try delimiting by logId and then assign value to field and apply mvexpand on top of it

Balajiraj · ‎01-09-2020

Thanks for your input. Can you post this as answer so that i can accept it. Also did u see splunk bin command acting differently for year 2019 and 2020

Balajiraj · ‎01-09-2020

Thanks for the answer. I will explore this option and see if it fits my query but did you also see splunk bin command acting differently for year 2019 and 2020

Balajiraj · ‎01-09-2020

Hi, This article says Beginning on January 1, 2020, un-patched Splunk platform instances will be unable to recognize timestamps from events where the date contains a two-digit year. This means data that meets this criteria will be indexed with incorrect timestamps. But in my case year is four digit, so i doubt if this would affect at all

Balajiraj · ‎01-09-2020

I work in Splunk Cloud Version:7.2.6 Also the link talks about year in 2 digits and when year is in epoch format but in this case year is 4 digits and issue is not while ingesting data but rather while applying bucket over this data

Balajiraj · ‎01-09-2020

This is the output i see _time Timestamp etime 2019-12-30 11:00 Wed Jan 01 01:09:29 EST 2020 1577854800 2019-12-30 11:00 Wed Jan 01 00:56:39 EST 2020 1577854800

Balajiraj · ‎01-08-2020

I have a query which looks for date and time in a field(Timestamp) which is of format "Wed Jan 01 16:24:28 EST 2020" and does a strptime on it. Next i group events using bucket. This used to give the events by date in format 2019-12-31. But for dates in year 2020 it just returns the year "2020" |eval _time=strptime(Timestamp,"%a %b %d %H:%M:%S %Z %Y") |bucket _time span=1d | table Timestamp _time Am i missing something here and is this how bucket is expected to work

Balajiraj · ‎06-21-2017

I see that you have used fieldForLabel and fieldForvalue have same value. Have u tried changing them as mentioned in below post https://answers.splunk.com/answers/329960/duplicate-values-causing-conflict.html

Posts	8
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎06-21-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Bucket behaves differently for year 2020

Re: JSON is one huge single entry - Is there a way...

Re: Bucket behaves differently for year 2020

Re: Bucket behaves differently for year 2020

Re: Bucket behaves differently for year 2020

Re: Bucket behaves differently for year 2020

Re: Bucket behaves differently for year 2020

Bucket behaves differently for year 2020

Re: Drop-down error "Duplicate values causing conf...