About rnotch

rnotch · ‎12-19-2017

You are welcome, I'm still learning regex myself so I am glad I was able to help at least a bit.

rnotch · ‎12-18-2017

The field extractor, when successful, adds that new field to Splunk settings, rather than just this one search. Meaning, only one is allowed at a time. If you want to extract fields just from one search, rather than changing all of your Splunk searches, you'll be needing to extract it in the search string itself. This involves the rex command, and learning some regular expression programing. So it might involve something like: | rex (Document\sowned\sby\s)(?<owner>[\w?\d?]+)\s to get the field for the owner. A fun way to learn more about regex is at this site: https://regexone.com Or, if you don't care to learn regular expressions, you can take the Field Extractor to the point where it has figured out the extraction, and just copy it out of the "Show regex" area, and not save the extraction.

rnotch · ‎12-18-2017

What worked for me was something like this: index=yourindex sourcetype=yoursourcetype | rex [if you are using rex to extract fields, it goes before fix. If not, you can skip this] | search fieldname1=* OR fieldname2=* OR fieldname3=* OR fieldname4=* | stats [or whatever table you are using] What's happening here is it searches only field names that have a result (the * does not include nulls), and by using "OR" you make sure that if any result is in any of the four fields, that row stays in. This fix might not work well for 50 fields, but it is nice for a few.

rnotch · ‎12-01-2017

I downvoted this post because yes, since the example and explanation feature conflicting data, this response is impossible to tell which is correct.

rnotch · ‎11-06-2017

I'm afraid that search comes up as blank, even when running it in a search bar with the token removed. If I run it with just the "addtotals," it looks identical to before. The last pipe is stripping all the data for some reason.

rnotch · ‎11-03-2017

Hi, so currently I have the following panel and code: index=origin sourcetype=access_combined (AccountID!="test" AND AccountID!="server") $AccountIDtoken$ | eval AccountID=if(isnum(AccountID), tag, AccountID) | chart count by AccountID, status_description But what I WANT is for it to look kinda like this... ...With FOUR overlay lines (one for each response code total count). One axis would be account IDs (probably stacked), the other axis would be time slots. I have pickers for Timeframe (token=field1) and AccountID (token=AccountIDtoken) and timespan (token=span) in place. That way I could see variation in response codes over time, per account. Any thoughts?

Posts	6
Solutions	1
Karma Given	7
Karma Received	3
Member Since	‎11-02-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to get multiple overlays on panel, by time

Re: Field-extraction wizard error: "The extraction...

Re: Field-extraction wizard error: "The extraction...

Re: How to remove all null fields to prevent gaps ...

Re: what is the format to use for a date in a sear...

Re: How to get multiple overlays on panel, by time

How to get multiple overlays on panel, by time