About prakashsbk

prakashsbk · ‎10-10-2023

Thanks a lot for your quick help and support , Query is working as expected.

prakashsbk · ‎10-09-2023

Hi All We are trying to get the incidents which are in open state (ie AlertStatus only equal to CREATE) . Table Out is below : Here IncidentID 1414821 has both AlertStatus = CLEAR and CREATE , this Incident ID should not get displayed . We need IncidentID only with Alertstaus = CREATE. we ran with | eval IncidentID=case(AlertStatus="CREATE" AND AlertStatus!="CLEAR",IncidentID) | table IncidentID AlertStatus When we run an Query it should only Display IncidentID value 1437718 Thanks and Regards

prakashsbk · ‎03-17-2023

Hi All We have installed Installed SmartStore in our environment . Need your help in validating SmartStore Features. Have followed the below links and able to verify the connectivity and remote store. basic testing is fine. [SmartStore] How to verify splunk indexer connecti... - Splunk Community and Troubleshoot SmartStore - Splunk Documentation BUT, Need to know if there are any SPL Query or steps to show that after installing smartstore it have improved the performance. Keen on steps or data that will give as evidence that will justify Smartstore features Thanks and Regards

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-17-2023

Online Status	Offline
Date Last Visited	‎04-05-2024 07:50 AM

Splunk Query to check two Conditions

Not able to view SNMP POLL data in splunk?

How to check SmartStore features?

Re: Splunk Query to check two Conditions

Splunk Query to check two Conditions

How to check SmartStore features?