Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About cxfuent29
cxfuent29
New Member
Member since:
02-13-2018
06-05-2020
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-13-2018 |
Activity Feed
- Posted Re: How to subtract specific events, key pairs? on Splunk Search. 07-10-2019 06:47 AM
- Posted Re: How to subtract specific events, key pairs? on Splunk Search. 07-09-2019 10:50 AM
- Posted Re: How to subtract specific events, key pairs? on Splunk Search. 07-09-2019 09:40 AM
- Posted How to subtract specific events, key pairs? on Splunk Search. 07-09-2019 07:57 AM
- Tagged How to subtract specific events, key pairs? on Splunk Search. 07-09-2019 07:57 AM
- Tagged How to subtract specific events, key pairs? on Splunk Search. 07-09-2019 07:57 AM
- Tagged How to subtract specific events, key pairs? on Splunk Search. 07-09-2019 07:57 AM
- Tagged How to subtract specific events, key pairs? on Splunk Search. 07-09-2019 07:57 AM
- Tagged How to subtract specific events, key pairs? on Splunk Search. 07-09-2019 07:57 AM
- Posted How can I report on userid's that are on event file but not CSV Lookup? on Splunk Search. 02-13-2018 09:30 AM
- Tagged How can I report on userid's that are on event file but not CSV Lookup? on Splunk Search. 02-13-2018 09:30 AM
- Tagged How can I report on userid's that are on event file but not CSV Lookup? on Splunk Search. 02-13-2018 09:30 AM
- Tagged How can I report on userid's that are on event file but not CSV Lookup? on Splunk Search. 02-13-2018 09:30 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
07-10-2019
06:47 AM
I guess what I am trying to do is a report using the first occurrence of a field within an event.
Some events have multiple fields some don't.
I looked at stats first(xx), but it returned first occurrence of first event only.
... View more
07-09-2019
10:50 AM
Let me try to show examples:
INPUT EVENTS:
1) id=jim,addr=12 main st,phone=825-585-9865
2) id=tom,addr=45 maple,phone=528-777-9685,id=tom second
I am using a simple table:
table id addr phone
Output:
jim 12 main st 825-585-9865
tom 45 maple 528-777-9685
tom second
(the line above is the problem)
... View more
07-09-2019
09:40 AM
Correction: both fields are ID, both are automatically extracted and exist in one event.
Sorry for type
... View more
07-09-2019
07:57 AM
Not sure where I should be going but, I am all for raw data going into fields, enhanced etc...
I am looking at our raw data and there is a field called ID=XXXXXX which is the field I am interested in, there is also another occurrence of ID= XXXXX YYYYY in the event which I am not interested in.
Both are showing up in my searches, NAME=MX001 and the second one ID=MX001 YYYYY .
I have tried Eval substr(ID,1,6) to no avail, any help would be appreciated,
P.S. could this have been taken care of during original extraction??
Thanks Ahead
... View more
02-13-2018
09:30 AM
I am using a lookup csv file.
events have userid and CSV file has userid.
Some of the event file userid's are not on CSV file (timing issue)
The output produces event count by userid.
I need to report on userid's that are on event file but not CSV,
Thanks ahead
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
