×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
tchmielarski
Explorer
Member since: ‎04-27-2011
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 1
Member Since ‎04-27-2011
View All

Re: A single events has been indexed as 100 sepera...

by in Getting Data In
‎02-06-2012 02:49 PM
‎02-06-2012 02:49 PM
is it possible to BREAK_ONLY_BEFORE_DATE and MAX_EVENTS = ? I'm looking for a way to truncate jboss error logs (full of java exceptions). ... View more

Re: Merging data from multiple events into a singl...

by in Reporting
‎04-27-2011 01:40 PM
‎04-27-2011 01:40 PM
the answer appears to be |transaction (thanks) plus |mvcombine The delimiter (delim=",") does not show up, and i'm still working on that so the result is more legible but the current result is more or less what I wanted. example: .... |transaction dest_host maxspan=7d maxpause=7d | mvcombine delim="," signature ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:02 AM
Karma from
View All