About anoopsankar

anoopsankar · ‎07-26-2016

We made a mistake and logged a few 1000 fields in an event with a wrong format. Is there any way that we could edit these logs and change the already indexed events?

anoopsankar · ‎05-14-2015

@Iguinn, the answer looks promising. Just to have some more clarity, the events are something like this: Event A = a user registration event (usually happens only once per user) Event B = a user doing a payment on our application (could happen many times for a user or never at all). So what I'm looking at is the list of users who have registered but have not yet done even a single payment. Hope this clarifies. Thanks!

anoopsankar · ‎05-14-2015

I have a splunk log that has fields 'user_id' and 'event'. What I would like to do is to find the list of users who have done an Event A, but has not done an Event B. The way I have figured out right now uses a sub-search, but the number of items returned by the sub-search causes a more than maxout warning. The query I use is: event=A user_id NOT [event=B | fields user_id] What is the alternate way to do this?

Posts	3
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎05-14-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Editing an indexed log

Find users who have done an event A, but not done ...

Editing an indexed log

Re: Find users who have done an event A, but not d...

Find users who have done an event A, but not done ...