About giorgioanastasi

giorgioanastasi · ‎12-10-2021

So, of the suggested searches, only this one (swong_splunk) extracts the results (correct?): tag=Operativo NOT(SO=ios AND VersSO="9.*") | dedup IdCliente | search [search tag=Operativo (SO=ios AND VersSO="9.*") | table IdCliente | dedup IdCliente | table IdCliente | format] This search extracts all customer codes that use ios 9. * but have also used a different device. I would need the opposite, that is, only customers who have used exclusively ios 9. * (but I can get them by difference from the list of those who use ios 9. * minus the search list above) This research does not extract anything: tag=Operativo | eval iphone9=if(SO=ios AND match(VersSO,"9\..*"),"Yes","No") | stats count(eval(iphone9="Yes")) as iphoner dc(model) as modelcount by IdCliente | search iphoner>0 | sort IdCliente

giorgioanastasi · ‎12-10-2021

So, of the suggested searches, only this one (swong_splunk) extracts the results (correct?): tag=Operativo NOT(SO=ios AND VersSO="9.*") | dedup IdCliente | search [search tag=Operativo (SO=ios AND VersSO="9.*") | table IdCliente | dedup IdCliente | table IdCliente | format] This search extracts all customer codes that use ios 9. * but have also used a different device. I would need the opposite, that is, only customers who have used exclusively ios 9. * (but I can get them by difference from the list of those who use ios 9. * minus the search list above) This research does not extract anything: tag=Operativo | eval iphone9=if(SO=ios AND match(VersSO,"9\..*"),"Yes","No") | stats count(eval(iphone9="Yes")) as iphoner dc(model) as modelcount by IdCliente | search iphoner>0 | sort IdCliente

giorgioanastasi · ‎12-09-2021

Hi Giuseppe !! How are you ?? you should know these files very well! 😉 unfortunately with your search it does not work, strangely:count(eval(SO="ios" AND VersSO="9.*")) AS iphone9 is always 0 this is the search: tag=Operativo | stats count(eval(SO="ios" AND VersSO="9.*")) AS iphone9 count(eval(NOT (SO="ios" AND VersSO="9.*"))) AS not_iphone9 BY NDG

giorgioanastasi · ‎12-08-2021

Hi, I would have this need, that is to carry out a search that extracts all users who use iphone with SO = 9. * and then through the extracted users, search through them who has also used another device. One solution would be to run the first search, get the list of all users and then do a new search with UsersId in input. First search: search model = iphone so = 9. * | table UserId Second search: search UserId IN (user list of the first search) model! = iphone Would it be possible to do this extraction with just one search? Thanks

giorgioanastasi · ‎11-29-2021

Thanks again, adding the error codes on multiple lines works

giorgioanastasi · ‎11-29-2021

Hi Bowesmana and thanks for the response. match work correctly with one error code, if i add other error codes in the lookup table, !IN(errorCode, Errors) does not work, i.e. the search does not filter these cases. This is the contents of the lookup column: login.error.E99999 login.error.10002

giorgioanastasi · ‎11-28-2021

Hi all, I have this need, compare a field with a series of error codes. I would not like to write in the search, any error codes, but I would like to use a lookup table. I then entered the error codes in a column (Name = Errors) of the table, but when i perform the search, they are not compared correctly. In the column, for example, is present: login.error.1004 In the search: tag = Log | lookup ServiziApp.csv ServiceName AS Service | search Functionality = "Access" errorCode! = Errors But the lines despite having a field = login.error.1004, are displayed. Checking the extracted fields, the errorCode field contains login.error.1004 and the Errors field also contains login.error.1004. Thanks in advance

Posts	7
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎11-28-2021

Online Status	Offline
Date Last Visited	‎12-10-2021 09:55 AM

SubSearch

Compare field with column of lookup table

Re: SubSearch

Re: SubSearch

Re: SubSearch

SubSearch

Re: Compare field with column of lookup table

Re: Compare field with column of lookup table

Compare field with column of lookup table