About Khuzair81

Khuzair81 · ‎01-25-2023

Hi, in the CSV file in there is a field. Brand : Puma, Adidas SplunkEvents Brand : Puma, Adidas, Nike, Gucci, LV I want the result as Brand : Nike, Gucci, LV

Khuzair81 · ‎01-25-2023

Please help with the query on how to compare CSV data with Splunk event and get those data in result which is not available in csv. Thanks

Khuzair81 · ‎08-29-2022

status=Auto, Manual car= BMW, Honda, Audi index * | stats count(status) as Total by car Is there anyway I can get the results as shown in attached picture.

Khuzair81 · ‎08-10-2021

@scelikokThankyou

Khuzair81 · ‎08-10-2021

Hi All, Please help me to solve this. desc="Trigger App : Search [Abc_[qwert] asd] number" I want to fetch the "[Abc_[qwert] asd]" from the above string Thanks

Khuzair81 · ‎07-18-2021

@ITWhisperer thanks for the help. Is there any doc where i can get these for all type visualization. It will be really helpful.

Khuzair81 · ‎07-17-2021

@ITWhisperer any help.

Khuzair81 · ‎07-15-2021

Sorry @ITWhisperer. I posted the wrong one PFB <row> <panel> <html> <style> #test g[transform] { font-size: 15px !important; font-weight: bold !important; } </style> </html> </panel> </row>

Khuzair81 · ‎07-13-2021

Hi All, I have a dashboard with chart which is representing Count by Dates. I have increased the font size of count value but need help in increasing the font size of Date. Below XML I'm using currently. <row> <panel> <html> <style> #test th{ font-size: 15px !important; font-weight: bold !important; } </style> </html> </panel> </row> Thanks

Khuzair81 · ‎06-08-2021

Hi @gcusello there is field value in events like every day there are new events and some of them is updating from past few days so i just wanted the new events that came in yesterday. So i want to compare a field value with yesterday

Khuzair81 · ‎06-08-2021

I want to get the data only from yesterday Date is there anyway to write it in Query Can i use | where Date=-1d@d I'm trying | eval today=strftime(now(), "%d") | where Date=Today-1

Khuzair81 · ‎06-08-2021

@richgalloway i want to get the data only from yesterday is there anyway to write it in Query Can i use | where Date=-1d@d

Khuzair81 · ‎06-07-2021

How to convert the below the time field from GMT to EST. time=Jun 7, 2021 10:24:33 AM GMT i tried below | eval t=strftime(strptime(time, "%m %d, %y %H:%M:%S %Z"), "%H:%M:%S") I'm not getting the result

Khuzair81 · ‎05-29-2021

c= US Language = abcdENGLISH123qw ..... | rex fields=Language "\w{4}(?<myval>)\d{4}" | eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c Result ans = NA myval = English c = US I want the ans = English

Khuzair81 · ‎05-28-2021

@richgalloway c= US Language = abcdENGLISH123qw ..... | rex fields=Language "\w{4}(?<myval>)\d{4}" | eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c Result ans = NA myval = English c = US I want the ans = English

Khuzair81 · ‎05-28-2021

@richgalloway Please help in the below Query c=US, UAE Lang=English, Arabic ........... | rex fields=Lang "(? <myval>)" | eval ans=case(c="US",myval) | table ans, myval I'm getting the 'ans' field as blank while 'myval' field has the Value.

Khuzair81 · ‎05-28-2021

c1 = US, c2 = UAE L1 = English, L2 = Arabic I want to get the answer in "ans" like, If c1= US, then ans= L1 elseif c2 = UAE, then ans= L2

Khuzair81 · ‎05-28-2021

@ITWhisperer Got one more Question field2 = word[abcdefg_123]word I want to get answer as : [abcdefg_123]

Khuzair81 · ‎05-27-2021

field1=abcdCheck:123456wxyz, sdfCheck:234567qwe I want get the result as Check:123456

Khuzair81 · ‎05-16-2021

DROPDOWN - I want to create one dashboard. While creating Country Dropdown I want only those countries in dropdown which my team support(US, UK, AUSTRALIA ETC.) but we are getting data for All countries. Query - index=* country="US" OR country="UK" OR country="AUSTRALIA" | table country | dedup country The above Query give me the perfect result in dropdown. But I want to add one more option "All" in the dropdown which gives me the above mentioned country data only. Is there anyway?

Khuzair81 · ‎09-02-2020

Hi @richgalloway There is one thing common in both event but the column name is different. Event1 : Ticket_no - username123, Event2 : Ticket_no. - TKT123, UserId - username123

Khuzair81 · ‎08-31-2020

Event1 - Ticket_no = username*, id=111 Event2 - Ticket_no = TKT123, Id =0 Is there any way to merge this 2 events to get stats as : Ticket_no= TKT123, id=111

Posts	25
Solutions	0
Karma Given	12
Karma Received	0
Member Since	‎08-31-2020

Online Status	Offline
Date Last Visited	‎02-07-2024 11:41 AM

How to compare CSV data with Splunk data?

How to display field value into column?

Regex

Font size

Date

Timezone

Eval

Condition

Rex

Drop-down

Re: Compare CSV data with Splunk Data

How to compare CSV data with Splunk data?

How to display field value into column?

Re: Regex

Regex

Re: Font size

Re: Font size

Re: Font size

Font size

Re: Date

Date

Re: Timezone

Timezone

Eval

Re: Condition

Re: Condition

Condition

Re: Rex

Rex

Drop-down

Re: Merge 2 events

How to merge two events?