Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tinanicole21
tinanicole21
New Member
Member since:
09-14-2017
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-14-2017 |
Activity Feed
- Posted Re: Create search query where events match lookup table 'fieldA' column (all have values) but exclude events that do not have a value in 'fieldB' column. on Splunk Search. 07-11-2019 12:42 PM
- Posted Re: Create search query where events match lookup table 'fieldA' column (all have values) but exclude events that do not have a value in 'fieldB' column. on Splunk Search. 07-09-2019 09:56 AM
- Posted Re: Create search query where events match lookup table 'fieldA' column (all have values) but exclude events that do not have a value in 'fieldB' column. on Splunk Search. 07-09-2019 09:56 AM
- Posted Re: Create search query where events match lookup table 'fieldA' column (all have values) but exclude events that do not have a value in 'fieldB' column. on Splunk Search. 07-03-2019 11:44 AM
- Posted Create search query where events match lookup table 'fieldA' column (all have values) but exclude events that do not have a value in 'fieldB' column. on Splunk Search. 07-03-2019 08:28 AM
- Tagged Create search query where events match lookup table 'fieldA' column (all have values) but exclude events that do not have a value in 'fieldB' column. on Splunk Search. 07-03-2019 08:28 AM
- Tagged Create search query where events match lookup table 'fieldA' column (all have values) but exclude events that do not have a value in 'fieldB' column. on Splunk Search. 07-03-2019 08:28 AM
- Posted Splunk ES dashboard link within Drilldown Search box of correlation event? on Splunk Enterprise Security. 03-28-2019 09:48 AM
- Tagged Splunk ES dashboard link within Drilldown Search box of correlation event? on Splunk Enterprise Security. 03-28-2019 09:48 AM
- Posted Re: How can I view daily/monthly job query search average times? on Splunk Search. 05-29-2018 09:50 AM
- Posted How can I view daily/monthly job query search average times? on Splunk Search. 05-29-2018 07:40 AM
- Tagged How can I view daily/monthly job query search average times? on Splunk Search. 05-29-2018 07:40 AM
- Tagged How can I view daily/monthly job query search average times? on Splunk Search. 05-29-2018 07:40 AM
- Tagged How can I view daily/monthly job query search average times? on Splunk Search. 05-29-2018 07:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-11-2019
12:42 PM
Our team has not had a chance to try it yet, due to some other real-world issues. I'm pretty optimistic that this should work for them.
... View more
07-09-2019
09:56 AM
I will give it a shot and will report back with my results.
... View more
07-09-2019
09:56 AM
I will give it a shot and will report back with my results.
... View more
07-03-2019
11:44 AM
To clarify, here is the full search query example:
| lookup fieldA | search fieldB != ""
I'm looking to display only sourcetype events that contain an entry in fieldA and fieldB of the lookup table, and not the ones that contain an entry in fieldA where fieldB is blank. I'm not looking to display specific rows within the lookup table. Thanks for the suggestion though.
... View more
07-03-2019
08:28 AM
Example Lookup Table entries:
fieldA fieldB
value value
value 'blank'
value value
Show events where 'fieldA' matches but exclude events where 'fieldB' is blank, within the lookup table. 'fieldB' does not exist in any of the events.
Test query (that does not work):
| lookup fieldA | search fieldB != ""
I believe the query above will match events that contain 'fieldA' but then searches the events where fieldB is blank within the event. Again, the events do not contain 'fieldB' and I'm not looking to append any other fields within the lookup table.
... View more
03-28-2019
09:48 AM
I was just wondering if anyone has figured out the correct syntax to use so you could click on a correlation search 'Drilldown Search' title to open up a specific Splunk dashboard within a new browser tab/window.
... View more
05-29-2018
09:50 AM
I was able to get one step closer with the following search query:
index=_audit savedsearch_name!="" info=completed | eval duration=total_run_time | stats count by _time, savedsearch_name, user, duration | stats avg(duration)
... View more
05-29-2018
07:40 AM
Given an initial search query, I'm trying to view daily and monthly job search query runtimes, then average the times out respectively.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
