Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jarrex
jarrex
Explorer
Member since:
07-10-2015
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 07-10-2015 |
Activity Feed
- Karma Re: Comparing a field value with an entire column or CSV for woodcock. 06-05-2020 12:47 AM
- Got Karma for Re: Comparing a field value with an entire column or CSV. 06-05-2020 12:47 AM
- Posted Re: Automatic Lookups on Internal Index on Knowledge Management. 07-31-2015 11:47 AM
- Posted Re: Automatic Lookups on Internal Index on Knowledge Management. 07-31-2015 11:40 AM
- Posted Re: Automatic Lookups on Internal Index on Knowledge Management. 07-31-2015 11:15 AM
- Posted Automatic Lookups on Internal Index on Knowledge Management. 07-31-2015 10:58 AM
- Tagged Automatic Lookups on Internal Index on Knowledge Management. 07-31-2015 10:58 AM
- Tagged Automatic Lookups on Internal Index on Knowledge Management. 07-31-2015 10:58 AM
- Posted Splunk is translating IP addresses incorrectly using the iplocation command. How do I report this bug? on Splunk Search. 07-23-2015 07:36 AM
- Tagged Splunk is translating IP addresses incorrectly using the iplocation command. How do I report this bug? on Splunk Search. 07-23-2015 07:36 AM
- Tagged Splunk is translating IP addresses incorrectly using the iplocation command. How do I report this bug? on Splunk Search. 07-23-2015 07:36 AM
- Tagged Splunk is translating IP addresses incorrectly using the iplocation command. How do I report this bug? on Splunk Search. 07-23-2015 07:36 AM
- Posted Storing Calculated Data for Later Use on Knowledge Management. 07-16-2015 01:09 PM
- Tagged Storing Calculated Data for Later Use on Knowledge Management. 07-16-2015 01:09 PM
- Tagged Storing Calculated Data for Later Use on Knowledge Management. 07-16-2015 01:09 PM
- Posted Re: Comparing a field value with an entire column or CSV on Getting Data In. 07-13-2015 06:15 AM
- Posted Re: Comparing a field value with an entire column or CSV on Getting Data In. 07-13-2015 06:13 AM
- Posted Comparing a field value with an entire column or CSV on Getting Data In. 07-10-2015 11:47 AM
- Tagged Comparing a field value with an entire column or CSV on Getting Data In. 07-10-2015 11:47 AM
- Tagged Comparing a field value with an entire column or CSV on Getting Data In. 07-10-2015 11:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-31-2015
11:47 AM
It should probably also be noted that there are 2 doing the same query because I wasn't sure if there was an issue with the sourcetype. It did this back when I just was trying it on splunk_web_access
... View more
07-31-2015
11:40 AM
bash-4.1$ cat props.conf
[_internal]
[splunkd*]
[splunk_web_access]
LOOKUP-AD = AD_User_List cn AS user OUTPUTNEW FullName AS UserFullName
[source::/opt/splunk/var/log/splunk/web_access.log]
LOOKUP-Lookup-AD Source Attempt = AD_User_List cn AS user OUTPUTNEW FullName AS UserFullName
bash-4.1$
... View more
07-31-2015
11:15 AM
I am using the user field and the sourcetype of splunk_web_access
... View more
07-31-2015
10:58 AM
Is the _internal index exempt from automatic lookups? I can't get any automatic lookups working on the index even with global permissions selected to work on the internal index, it works everywhere except there. Is there no way to do this?
... View more
07-23-2015
07:36 AM
When performing IPLocation on a set of login IPs and trying to find outlying data, I notice that Splunk is translating subnets incorrectly. How do I report this to get this fixed? Splunk is saying that the subnet 43.224.156.XXX belongs to Japan when in reality it belongs to India and I am sure this isn't the only subnet mixup, but a quick google of where these CIDRs belong reveal that Splunk should report it as India, not Japan.
... View more
- Tags:
- bug
- ip
- iplocation
07-16-2015
01:09 PM
I am trying to essentially gather information of a pretty large query and count it every day, and then display this total count every day in a timechart so that we can track the change overtime. The problem I have is that the calculations are based on a CSV file that are overwritten every day so I am not sure how to go about storing historical data. The best thing I can think of doing is to append to a CSV the time and the calculated count every day but I wasn't sure if there was an easier way to do this.
... View more
07-13-2015
06:15 AM
Could you explain 1 thing to me? When appending the CSV and renaming the column, does that cause the two identically named columns to merge?
... View more
07-13-2015
06:13 AM
1 Karma
You understood perfectly! Had to tweak it 1 last time to filter out any blanks
| where numTypes=1 AND type=1 AND teams!=""
But now it works perfectly, thank you a lot!
... View more
07-10-2015
11:47 AM
I have been searching for how to do this for the longest time and it's rather frustrating that I can't seem to find a simple explanation anywhere.
I have a search setup and a CSV file that lists a bunch of "blacklist" items that I do not want included in the results I have tried just about everything with regards to the CSV and I have seen no progress. It got to the point that I have now been trying to append the CSV and then just search the value within the appended column but there doesn't seem to be a way to search a CONTAINS within a different column.
Here is what I want to do:
I have a table that looks like this
Name Teams Removed Team TeamDels
Bob Team A Yes TeamA
Bob Team B No TeamE
Jane Team C No TeamF
Jane Team D No TeamG
Jane Team E Yes TeamH
What I am currently thinking I am going to have to do is append the CSV (TeamDels column) and then somehow do a search if Teams contains a value in TeamDels but I can't do this?
Removed Team would be calculated by looking at the Team value (Team A, Team B etc.) and seeing if it is in the blacklist. If it is in the black list is says Yes.
I do not care how to go about doing this, I can even remove the Removed Team column if there was a way to filter out the teams based on the contents of the CSV file but there doesn't seem to be a way.
It should be noted that the "Teams" are multivalue to start so I have to split them.
DeletedTeamList.csv contains 1 column with the header TeamDels
Here is my current search:
index=teams action=*
| append [inputlookup DeletedTeamList.csv]
| table Name,Teams,Removed_Team
| mvexpand Teams
| eval Removed_Team=If(Teams!=TeamDels,"No","Yes")
If I typo'd anything on here please ignore as these aren't the real fields or anything.
... View more
