About bruno_eduardo

sandyjov1 · ‎01-10-2022

Can someone explain exactly what is happening when using untable?

woodcock · ‎04-26-2016

Assuming you have a field called my_time , try this: | rex field=my_time mode=sed "s/ BRST$/ -0200/" | eval my_time_epoch = strptime(my_time, "%b %d, %Y %H:%M:%S %Z") | eval _time = my_time_epoch We need to modify the timezone because Splunk does not recognize BRST .

s2_splunk · ‎12-14-2015

Perfectly valid approach. A quick test shows that eval/strptime is about 30% faster (on my laptop) when comparing to rex/sed with a query against a little over 100k sample events, so if efficiency is important, I would consider that. If you want to test in your environment, try ... | eval myDate = strftime( subname, "%Y-%m-%d") It won't help you in your quest to learn more about the rex command, though. 🙂

jul1an · ‎11-14-2017

Yes!! In my case I have solved with head comand: index=index1 source="file.csv" Status="Active" [search index=index1 source="file.csv" | dedup _time | head 1 | return _time] |...

MuS · ‎11-10-2015

Hi bruno_eduardo, see the docs http://docs.splunk.com/Documentation/DBX/2.0.6/DeployDBX/Prerequisites about this, it says: Splunk DB Connect has not been tested and is not supported with Splunk Cloud, Splunk Free, or Splunk Light. cheers, MuS

stmyers7941 · ‎10-26-2015

I tested this method and added the addtotals command...it works well enough: index="Test" | stats count by "Event Category", "Threat Type" | stats sum(count) as Total list("Threat Type") as "Threat Type" list(count) as Count by "Event Category" | addtotals col=t fieldname=Total label=TOTAL labelfield="Event Category" | table "Event Category" "Threat Type" "Count" "Total"

jeffsegal · ‎05-09-2018

It worked, thank you for your help.

martin_mueller · ‎11-28-2014

Use the HTML element, for example like this: <row> <panel> <chart> ...your regular panel content goes here... </chart> <html> <a href="your url here">your text here</a> </html> </panel> </row>

jeremiahc4 · ‎11-24-2014

Disregard, just read further on that link and found why. Now to figure out how to use that masterLegend property I guess.

MuS · ‎11-04-2014

Hi bruno_eduardo, I would compare epoch times not human readable time stamps. So something like this will do it: ... | eval now_time=now() | convert mktime("Resolution Period") AS Resolution_Period | where Resolution_Period > now_time | table Resolution_Period regarding the future timestamp you can try this: ... | eval future_time=relative_time(now(), "+15d") | ... this will return an epoch timestamp as well. hope this helps .... cheers, MuS

sk314 · ‎10-01-2014

Posts	24
Solutions	1
Karma Given	15
Karma Received	2
Member Since	‎10-01-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Convert this time format to epoch and simple date ...

How to transform this date format from 20151412 to...

How to get results only from the last source file?

Is it possible to use Splunk DB Connect 2 with Spl...

How to |addtotals on a |stats list result?

Lookup - How to compare and remove events from the...

How Can I do a simple line graph?

How to Add a button on a dashboard panel which dir...

How do I change the color of a pie graphic for eac...

How to do operations with dates fields?

Re: How Can I do a simple line graph?

Re: Convert this time format to epoch and simple d...

Re: How to transform this date format from 2015141...

Re: How to get results only from the last source f...

Re: Is it possible to use Splunk DB Connect 2 with...

Re: How to |addtotals on a |stats list result?

Re: Lookup - How to compare and remove events from...

Re: How to Add a button on a dashboard panel which...

Re: How do I change the color of a pie graphic for...

Re: How to do operations with dates fields?

Re: How to compare field values in two different...

Join the Conversation