Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About stephenlclarke
stephenlclarke
New Member
Member since:
07-10-2015
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-10-2015 |
Activity Feed
- Posted Re: How to extract a repeating field from an event on Splunk Search. 07-24-2015 02:09 AM
- Posted Re: How to extract a repeating field from an event on Splunk Search. 07-23-2015 08:37 AM
- Posted How to extract a repeating field from an event on Splunk Search. 07-23-2015 08:29 AM
- Tagged How to extract a repeating field from an event on Splunk Search. 07-23-2015 08:29 AM
- Posted Re: How to create a table with two stats list columns? on Splunk Search. 07-10-2015 08:38 AM
- Posted Re: How to create a table with two stats list columns? on Splunk Search. 07-10-2015 07:38 AM
- Posted How to create a table with two stats list columns? on Splunk Search. 07-10-2015 04:34 AM
- Tagged How to create a table with two stats list columns? on Splunk Search. 07-10-2015 04:34 AM
Topics I've Started
07-24-2015
02:09 AM
If I implement this on our production splunk infrastructure will this 'break' any existing reports and dashboards?
... View more
07-23-2015
08:37 AM
Actually...
The data looks a bit more like this;
AA=value1,BB=value2,CC=value3,BB=value4,BB=value5
AA=value6,BB=value7,BB=value8
AA=value9,BB=value10,CC=value11
AA=value12,BB=value13,CC=value14,BB=value15,CC=value16
There are other fields (CC) that I am not interested in that are mixed up with the BB fields. There is always only one AA field per event. Each BB field may have an associated CC field.
I am only interested in the BB fields per AA
... View more
07-23-2015
08:29 AM
I have data that looks like this:
AA=value1,BB=value2,BB=value3,BB=value4
AA=value5,BB=value6,BB=value7
AA=value8,BB=value9
AA=value10,BB=value11,BB=value12
How do I extract all the BB fields for each AA field?
... View more
- Tags:
- field-extraction
07-10-2015
08:38 AM
Perfect.. ~Thanks very much
... View more
07-10-2015
07:38 AM
Update:
I have a server estate that is running both DEV and TEST instances of a number of applications. One source type has all the logs for the DEV instances and the other has all the logs for the TEST instances.
What I need is a report that lists all the DEV instances per host in one column and all the TEST instances per host in a separate column. Some hosts will only have DEV while other will only have TEST apps, but a handful will be running both DEV and TEST.
... View more
07-10-2015
04:34 AM
I have two queries that I want to merge into one.
First query:
<pre>
sourcetype="sourceType1"
rex "Application=(? +)" |
dedup appname |
sort appname |
stats list(appname) Column1 by host
</pre>
Returns:
<pre>
host Column1
srv16 APP1
APP2
srv19 APP3
APP4
srv26 APP5
APP6
srv27 APP7
APP8
</pre>
Second query:
<pre>
sourcetype="sourceType2"
rex "Application=(? +)" |
dedup appname |
sort appname |
stats list(appname) Column2 by host
</pre>
Returns:
<pre>
host Column2
srv15 APP1
APP2
srv16 APP1
APP2
srv19 APP3
APP4
srv26 APP5
APP6
srv27 APP7
APP8
</pre>
How do I merge these two queries to get something that looks like this:
<pre>
host Column1 Column2
srv15 APP1
APP2
srv16 APP1 APP3
APP2 APP4
srv19 APP3
APP4
srv25 APP5
APP6
srv26 APP5
APP6
srv27 APP7 APP7
APP8 APP8
</pre>
... View more
- Tags:
- stats
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
