Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About diogenesloazeve
diogenesloazeve
Engager
Member since:
04-14-2020
10-14-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-14-2020 |
Activity Feed
- Posted Re: How to remove double quotes from a token using the replace method? on Getting Data In. 10-14-2020 06:40 AM
- Posted Re: How to remove double quotes from a token using the replace method? on Getting Data In. 10-14-2020 06:38 AM
- Posted Re: How to remove double quotes from a token using the replace method? on Getting Data In. 10-14-2020 04:50 AM
- Tagged How to remove double quotes from a token using the replace method? on Getting Data In. 10-13-2020 11:05 AM
- Posted How to remove double quotes from a token using the replace method? on Getting Data In. 10-13-2020 10:33 AM
- Posted Re: How do I change the value of a field if a condition occurs? on Splunk Search. 05-07-2020 10:05 AM
- Posted Re: How do I change the value of a field if a condition occurs? on Splunk Search. 05-07-2020 09:57 AM
- Posted Re: How do I change the value of a field if a condition occurs? on Splunk Search. 05-07-2020 07:39 AM
- Posted Re: How do I change the value of a field if a condition occurs? on Splunk Search. 05-07-2020 07:17 AM
- Posted How do I change the value of a field if a condition occurs? on Splunk Search. 05-07-2020 06:24 AM
- Tagged How do I change the value of a field if a condition occurs? on Splunk Search. 05-07-2020 06:24 AM
- Tagged How do I change the value of a field if a condition occurs? on Splunk Search. 05-07-2020 06:24 AM
- Tagged How do I change the value of a field if a condition occurs? on Splunk Search. 05-07-2020 06:24 AM
Topics I've Started
10-14-2020
06:40 AM
Thank you @ITWhisperer ! This worked perfectly!
... View more
10-14-2020
06:38 AM
@renjith_nair Good hint! Unfortunately it wouldn't work either because my token is of the multiselect type <input type="multiselect" token="support_group_token">
<label>Support Group</label>
<choice value="*">All</choice>
<default>*</default>
<search base="filters_base_search">
<query>
| stats count by support_group
</query>
</search>
<fieldForLabel>support_group</fieldForLabel>
<fieldForValue>support_group</fieldForValue>
<valuePrefix>support_group="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>
... View more
10-14-2020
04:50 AM
@renjith_nair Thanks for the answer! Unfortunately this solution does not work for me because the token already comes to me this way (support_group="Service Desk"). I have to work with the double quotes anyway. I think the solution is in what character do I have to put before support and after Desk. Unfortunately trying something like this didn't work for me either: |makeresults |eval field=\"support_group="Service Desk"\"
... View more
10-13-2020
10:33 AM
Hello! I have the token() whose content is this: $support_group_token$=support_group="Service Desk" Is there any way to remove the quotes from the token? I tried to remove the double quotes using single quotes but the replace didn't work. |eval my_variable = IF(replace('support_group="Service Desk","\"","")="support_group=Service Desk",1,0) |table my_variable Has anyone experienced the same problem? Basically I want to get the result below but the problem is that my token doesn't have the \" between the Service Desk name.
... View more
- Tags:
- "replace"
Labels
- Labels:
-
other
05-07-2020
10:05 AM
And is there a way to make Splunk detect an event like this?
... View more
05-07-2020
09:57 AM
Understood. So is there a way that when this happens, Splunk will create a new ticket with the same information and just change the status to reassigned?
... View more
05-07-2020
07:39 AM
In fact, there is no field to indicate this.
Basically, if I have a ticket in the index and it no longer appears in the new extractions, it must change the status to reassigned
... View more
05-07-2020
07:17 AM
Hi richgalloway!
The ticket X will already be in the index, as it entered as assignment_group A and Status New.
However, as ticket X will not appear in the next ServiceNow extraction, Splunk should only change the Status to Reassigned.
Is it possible to create such a rule?
... View more
05-07-2020
06:24 AM
Hi community!
I'm using Splunk Entreprise to create dashboards with my client's ServiceNow incident information.
My company only look at tickets from assignment_group A.
So, I have a ticket X that belongs to assignment_group A with Status "New".
However, this ticket changed to assignment_group B and is no longer serviced by my company. This will result in a second ServiceNow extraction, that ticket will not appear.
So, I need to create a logic so that when this happens, Splunk changes the Status of ticket X to "Reassigned".
Does anyone know how to do this?
Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-14-2020
11:55 AM
|
