About mschaaf

mschaaf · ‎11-25-2022

This could be due to your account having one or more roles that is assigned a srchFilter or imported_srchFilter. This rest query will list any assigned to your role(s): | rest splunk_server::local /services/authorization/roles/ | stats values(*srchFilter*) AS *srchFilter* by title | rename title AS role | append [ rest splunk_server::local /services/authentication/current-context | stats values(roles) AS role by username | mvexpand role ] | stats values(*srchFilter*) AS *srchFilter* values(username) as username by role | search username=* (srchFilter!="" OR imported_srchFilter!="")

mschaaf · ‎09-01-2020

| tstats count by splunk_server splunk_server_group prestats=t | eval splunk_server_group=coalesce(splunk_server_group, "null") | stats count by splunk_server_group splunk_server | stats dc(splunk_server) values(splunk_server) by splunk_server_group Nevermind. Using prestats=t and an eval worked: splunk_server_group dc(splunk_server) values(splunk_server) Group1 3 Server1 Server2 Server3 null 3 Server4 Server5 Server6

mschaaf · ‎09-01-2020

How about for splunk_server_group, since aggregations are not supported for it? Specifically for versions earlier than 8.0, which now has the fillnull_value="string" parameter.

mschaaf · ‎01-14-2020

In the splexicon, punct is stated as being "the first thirty" chars, but in Splunk Enterprise 7.3.1, I see it truncates at 50. In what version did this change? Where this this indexed/default extraction configured? Thanks!

mschaaf · ‎11-19-2019

In Splunk 7.0.3.1, using TERM() didn't return results , but escaping the space did: product_categorization_tier_2::security\ systems

mschaaf · ‎09-11-2019

https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Findkeywords

mschaaf · ‎08-07-2019

After your cluster command, pipe to the findkeywords command. It will add fields "includeKeywords" and "excludeKeywords," among others, which indicate the terms used for each cluster_label.

mschaaf · ‎01-10-2019

In the code below, i want the explicit {5} to be replaced with a variable like {$session_length$}. Is this possible? If so, how? Thanks! | makeresults | eval test="abc5defgHijk" | rex field=test "^.{3}(?<session_length>\d)(?<session>.{5})" |fields session I want the output of session="defgH".

mschaaf · ‎12-06-2018

Where is /admin/macros documented? I couldn't find it within the REST API Reference Manual.

mschaaf · ‎11-16-2018

Do you happen to know the Issue Number? I didn't see anything relevant under KnownIssues for the versions where I'm experiencing this.

mschaaf · ‎11-14-2017

I downvoted this post because this shows unique per bucket, not per search period, which is what the requester was looking for.

Posts	11
Solutions	0
Karma Given	18
Karma Received	3
Member Since	‎11-14-2017

Online Status	Offline
Date Last Visited	‎11-09-2024 02:17 PM

When/Where did punct change from 30 to 50 chars?

How do you use value or capture groups as regex's ...

Re: Help with Search != litsearch --- In 'litsearc...

Re: tstats count query 'by' when a field may or ma...

Re: tstats count query 'by' when a field may or ma...

When/Where did punct change from 30 to 50 chars?

Re: Why does my search fail when searching indexed...

Re: How to find most common words used by cluster ...

Re: How to find most common words used by cluster ...

How do you use value or capture groups as regex's ...

Re: List of Macros

Re: Multiple rex commands no longer works in Fast/...

Re: Does distinct_count() in a timechart count uni...