About criedman

criedman · ‎09-25-2019

Great Thank You !

criedman · ‎09-20-2019

Hello, i have only two values logout_time and online_time and i would like to get the login_time. How could i subtract the online_time from the logout_time ? search: index="index_5" sourcetype="system:logins" | table logout_time,online_time,login_time

criedman · ‎06-11-2018

Thats the soluten thank you. <dashboard> <search> <query>| inputlookup Lookup_1 where Value="Value_A" | eval valuestatus=Value_A | table valuestatus <done> <set token="init">$result.valuestatus$</set> </done> </search> </dashboard> BR Christoph

criedman · ‎06-08-2018

Hi, is it possible to set a token based on a search result value ? My search does not work ... =( <init> <eval token="init">| inputlookup Lookup_1 | search Value="Value_A" | eval valuestatus=Value_A | table valuestatus</eval> </init> Value_A = 0 .... 0 Should be set to the token. BR Christoph

criedman · ‎06-07-2018

Hi, i want to search the events from the last 10 minutes based on the secondary datetime field from a event. Normal Search with Index time: earliest="-10m" index="xxx" source="xxx" Spezial Search with Event time: earliest(from DateTime Field)="-10m" index="xxx" source="xxx" ??? Thank You Christoph

criedman · ‎12-13-2017

Hello, is it possible to enable / disable a scheduled search over a dashboard ? -> Enable / Disable alarming at the alarm Dashboard. BR Chriss

criedman · ‎11-27-2017

Hi, thank you thats the perfect solution for me =). | where match(source, "^[a-zA-Z]{3}server.*") Result: The result must contain 3 letters before "server". xxxserveryyy Thanks Christoph

criedman · ‎11-27-2017

Hi, i want to search for hosts which always have 3 letters at the begin of the dns name. search: index="myindex" host="(letter)(letter)(letter)server*" Result should be: xxxserver01 aaaserver01 bbbserver01 cccserver01 .... Thanks! Christoph

Posts	8
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎11-27-2017

Online Status	Offline
Date Last Visited	‎10-12-2020 02:43 AM

Subtract different time format

Set a token by open a dashboard based on a search

Search earliest"-10m" based on a datetime field fr...

Enable / Disable Sheduled Searches on a Dashboard

How can i search for a host wich must have 3 lette...

Re: Subtract different time format

Subtract different time format

Re: Set a token by open a dashboard based on a sea...

Set a token by open a dashboard based on a search

Search earliest"-10m" based on a datetime field fr...

Enable / Disable Sheduled Searches on a Dashboard

Re: How can i search for a host wich must have 3 l...

How can i search for a host wich must have 3 lette...