Activity Feed
- Got Karma for Re: Sorting Charts. 11-25-2024 11:38 PM
- Got Karma for Re: How can I group timechart data by day if the day starts at 10 p.m. and ends 10 p.m. the next day?. 11-04-2024 10:31 AM
- Got Karma for Re: How can I group timechart data by day if the day starts at 10 p.m. and ends 10 p.m. the next day?. 11-01-2024 01:24 PM
- Got Karma for Re: How do I convert time from a time range picker to epoch?. 10-18-2024 12:03 AM
- Got Karma for Re: Passing values to different urls on drilldown. 09-25-2024 11:39 AM
- Got Karma for Re: error while installation. 09-17-2024 08:35 PM
- Got Karma for Re: Problems creating an UDP input: Error binding to socket in UDPInputProcessor: Permission Denied. 09-05-2024 02:53 AM
- Karma Re: How to Redirect Return to Splunk link to a custom URL on the home page for PickleRick. 08-22-2024 02:38 AM
- Posted Re: Head for each value of a field on Splunk Search. 08-07-2024 12:44 AM
- Got Karma for Re: How to find the average of daily indexed data by host for a given time range and show all hosts on a timechart, not just the top 10?. 08-02-2024 01:52 AM
- Got Karma for Re: How to append zeros to the beginning of existing numeric values for a field to make each value 6 digits long?. 07-19-2024 06:27 AM
- Got Karma for Re: Is it possible to store a field as a boolean value?. 06-25-2024 04:29 PM
- Got Karma for Re: Is it possible to store a field as a boolean value?. 06-25-2024 04:29 PM
- Got Karma for Re: Which properties are available for a Universal Forwarder in Props/Transforms ?. 06-11-2024 10:13 AM
- Got Karma for Re: Is there a way to check a particular bit in a field that returns a hex value?. 06-03-2024 01:38 AM
- Got Karma for Re: Can timechart zoom alter time range picker?. 03-30-2024 04:33 AM
- Got Karma for Re: Compute row differences. 02-21-2024 02:24 AM
- Got Karma for Re: Splunk does not listen on specified port. 01-25-2024 09:19 PM
- Got Karma for Re: How to get current app name in a search ?. 01-16-2024 12:02 PM
- Got Karma for Re: How to exclude specific time ranges in search results. 01-10-2024 01:45 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
7 | |||
8 | |||
0 | |||
15 | |||
2 | |||
2 | |||
0 | |||
1 | |||
2 | |||
7 |
08-07-2024
12:44 AM
Well if we are unearthing this then: Index=logins | dedup 5 login
... View more
01-09-2023
08:36 AM
1 Karma
Yes.
... View more
02-01-2022
06:54 AM
Great! Feel free to post the solution in case others can benefit from it later.
... View more
01-28-2022
07:38 AM
Can you describe or draw what you're trying to achieve / what you're trying to avoid?
... View more
01-11-2022
07:24 AM
Not that I'm aware of, no. Support may have an SPL-Number to track.
... View more
11-25-2021
09:12 AM
3 Karma
Check which machine is logging those metrics.log entries: UFs can generate per_index_thruput as well, which would be the volume prior to filtering.
... View more
11-15-2021
05:48 AM
2 Karma
Including include_reduced_buckets=t in your tstats parameters should work around the 8.2 _internal tstats issue.
... View more
09-15-2020
08:52 AM
1 Karma
It would be the `$risk|n$` token filter that would turn off the implicit `$risk|h$` filter that made it HTML-safe... but calling `|n` inside an HTML panel doesn't work ... probably for securitay.
... View more
09-13-2020
04:49 AM
Here's Stirling's Approximation in SPL: `| eval n! = sqrt(2*pi()*n)*pow(n/exp(1), n)`
... View more
- Tags:
- Here's
09-13-2020
04:47 AM
1 Karma
There are two more, significantly less SPL-intense options: Cheat. Given the restrictions of finite-bit maths, you can easily ship a lookup of all reasonable factorials instead of calculating them on the fly, here's a start: https://oeis.org/A000142/list Use Stirling's approximation, expressed in SPL it's `| eval n! = sqrt(2*pi()*n)*pow(n/exp(1), n)` ... it won't be perfect, but it'll give you the right number of digits and the first two will be accurate, ie two sigfigs of precision. Probably good enough for your use case, for 13 choose 6 it yields 1749.
... View more
09-09-2020
02:02 AM
2 Karma
If this is in a dashboard then you don't need to launch a subsearch, instead you can use the token `$env:app$`: https://docs.splunk.com/Documentation/Splunk/8.0.6/Viz/tokens#Use_global_tokens_to_access_environment_information
... View more
06-01-2020
03:21 AM
Can your Fortinet FW send to HEC?
... View more
06-01-2020
03:12 AM
Ignore the replace old connection events in your startswith condition.
... View more
05-13-2020
04:16 AM
Your user's timezone setting applies to your user only. In general I recommend setting the right timezone instead of messing around with adding/subtracting seconds manually.
... View more
05-11-2020
03:49 AM
Filter based on that then.
... View more
05-11-2020
03:35 AM
I don't see language:eng in there.
... View more
05-11-2020
03:00 AM
I can't tell you how to use your data if you don't post your data.
... View more
05-11-2020
02:27 AM
Filter by language:eng then?
... View more
05-11-2020
12:54 AM
I don't think there is a language detection function in Splunk.
Do your original events have a language field?
... View more
05-10-2020
02:57 PM
1 Karma
Overall rank 650 now 😃
... View more
05-10-2020
02:47 PM
You can use any boolean eval expression inside mvfilter() , including regex match() .
... View more
05-10-2020
04:22 AM
Use mvfilter(lower(Message) = "eng") , or some other filter to detect English.
... View more
05-08-2020
05:00 PM
You can add a | sort hours , which should use a more natural sorting order than stats .
... View more
05-08-2020
04:16 PM
If you want to chart the distribution of monthly sums, you can do this:
stats sum(hoursWorked) as hours by Associate
| bin span=5 hours
| stats count by hours
That will give you a chart with the number of Associates per five-hour spans of monthly work.
... View more