×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Hanneke
New Member
Member since: ‎11-17-2017
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-17-2017
View All

Re: how can I populate a variable in a table with ...

by in Splunk Search
‎11-22-2017 07:40 AM
‎11-22-2017 07:40 AM
The relations are: resource_type : resource_id = many : 1 resource_id : endpoint = many : 1 (or really close to 1:1 but just not completely) resource_type : endpoint = many : 1 For now there are 7 resource_types: Let's call them resource_type1, ... , resource_type7. For resource_id you can think of something like: resource_idaaa1, ..., resource_idaaa10 resource_idbbb1, ..., resource_idbbb10 etc, with 10 of them belonging to one resource_type. And for endpoints likewise. I hope things are kind of clearer now. ... View more

Re: how can I populate a variable in a table with ...

by in Splunk Search
‎11-20-2017 12:02 AM
‎11-20-2017 12:02 AM
No it is the same question. But I accidentally asked it twice. Thanks, I will have a look at your answer. ... View more

how can I populate a variable in a table with a se...

by in Splunk Search
‎11-17-2017 06:50 AM
‎11-17-2017 06:50 AM
index=infrastructure_some_index resource_type="This could be variable from a search" | stats values(endpoint) as "Endpoints" values(resource_type) as "Resource Type" by resource_id | rename resource_id as "Resource ID" | table "Resource Type", "Resource ID", "Endpoints" Hello, Above is my query. I would like to have several of these tables with resource_type as variable. In the data are now 6 different resource_types but they can be added, so maybe every month one will be added or changed. Is it possible to make as many tables as there are source_types so it would be a dynamical dashboard without any fixed values in the search for source_type? Example: Resource_type= 1234 Resource_type Resource ID Endpoints ..... ...... ...... Resource_type= 4567 Resource_type Resource ID Endpoints ..... ...... ...... Resource_type= 6789 Resource_type Resource ID Endpoints ..... ...... ...... ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM