Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About 0range
0range
Communicator
Member since:
05-27-2013
06-05-2020
Community Statistics
| Posts | 85 |
| Solutions | 4 |
| Karma Given | 36 |
| Karma Received | 13 |
| Member Since | 05-27-2013 |
Activity Feed
- Karma Re: sql "IN" in splunk for Ayn. 06-05-2020 12:47 AM
- Karma Re: convert timerange to epoch values for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to join large tables with more than 50,000 rows in Splunk? for wpreston. 06-05-2020 12:47 AM
- Got Karma for convert timerange to epoch values. 06-05-2020 12:47 AM
- Got Karma for How to join large tables with more than 50,000 rows in Splunk?. 06-05-2020 12:47 AM
- Got Karma for Re: How to enable WARN messages in alert emails for Splunk 6.1 that were present in previous versions?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to use earliest twice in one search?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to use earliest twice in one search?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to use earliest twice in one search?. 06-05-2020 12:47 AM
- Got Karma for Is it possible to use earliest twice in one search?. 06-05-2020 12:47 AM
- Karma Re: axisX.minorUnit for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: add recently triggered alerts to my dashboard for MuS. 06-05-2020 12:46 AM
- Karma Re: how to add description to alert e-mail for sloshburch. 06-05-2020 12:46 AM
- Karma Re: run two scripts when triggering alert for MuS. 06-05-2020 12:46 AM
- Karma timechart x-axis tick marks every month for bowesmana. 06-05-2020 12:46 AM
- Karma Re: Search Syntax Highlighting? for yoho. 06-05-2020 12:46 AM
- Karma Re: chart overlay for martin_mueller. 06-05-2020 12:46 AM
- Karma What's the maximum data throughput per second can a single indexer handle? for jichen. 06-05-2020 12:46 AM
- Karma Re: >256 lines events on universal forwarder for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: >256 lines events on universal forwarder for Ayn. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 |
02-01-2016
05:42 AM
It shows only result from search, but the ara filtered due to subsearch conditions. And the filtering works wrong.
I want to implement an SQL code
select * from a
where event=b
and eventId not in
(select eventId from a where event=by)
in SPL. It looks like this
sourcetype=a event=b NOT [search sourcetype=a event=b | fields eventId]
but it is not EXACTLY the same.
... View more
02-01-2016
02:37 AM
Is it possible to make exactly the same timerange for the search and the subsearch in Splunk 6.3?
For example a search:
sourcetype=a event=b NOT [search sourcetype=a event=b | fields eventId]
(eventId is unique for every event, for example)
returns some results in the end of the time window. So, Splunk doesn't find them from a subsearch, but found from the main search.
Any ideas?
Edited :
Latest&Earliest is a good idea, but what if I want to run a search on a schedule? The only latest I can imagine is "now" and it's the default one.
I can set latest=-1m in search and it will solve the problem, but it is a very bad solution.
Is there any other ideas?
... View more
10-07-2015
11:55 PM
| rex field=operation mode=sed "s/([0-9a-z]+\-)+[0-9a-z]+/id/"
Works fine:) thank you!
... View more
10-07-2015
10:44 AM
It's numeric or alfa-numberic with special structure
... View more
09-02-2015
12:18 AM
In general, it can be at any level
... View more
09-01-2015
02:18 AM
Hello everyone.
I need to substitute text "id" in text fields where I have ids now: like 123123123, 312asda-adas2 and so one.
For example, I need these transformations:
/bar/1233131/foo -> /bar/id/foo
/bar/12313 -> /bar/id
/foo/a2b-b2a/bar -> /foo/id/bar
How can I do it in Splunk?
... View more
07-02-2015
08:25 AM
append0 a chance ....
append0?
... View more
02-04-2015
03:01 AM
I want to run some report when an other alert triggers. Is that possible?
... View more
01-26-2015
07:19 AM
subj. how is it possible?
here http://dev.splunk.com/view/python-sdk/SP-CAAAEK2#savedsearchparams the params action.email and action.script are marked as read-only 😞
... View more
Seems like we need to update the sendemail.py adding the $job.messages$ param from here
... View more
12-17-2014
08:52 AM
Hello everyone!
In older versions of splunk, there were WARN messages in alert emails like the following:
-- Search generated the following messages --
Message Level: WARN
1. Unable to distribute to peer named ... at uri ... because replication was unsuccessful. replicationStatus Failed
2. Unable to distribute to peer named ... at uri ... because peer has status = "Authentication Failed".
Now in 6.1 they are disabled.
Is it possible to enable it again?
Thank you in advance.
... View more
08-29-2014
07:19 AM
the description sounds like coalesce(id, bid, "")
where can I read about the "." operator?
... View more
08-29-2014
02:22 AM
4 Karma
will it work:
(earliest=-1d@d latest=@d sourcetype=a) OR (earliest=-1d@d sourcetype=b)
?
... View more
08-29-2014
12:33 AM
what does the point mean?
| eval id=coalesce(id,"").coalesce(bid,"")
... View more
08-28-2014
09:15 AM
So.
C. What I do
(sourcetype=a OR sourcetype=b OR sourcetype=c)
| eval bid = coalesce(bid, id, cid)
| stats min(_time) as _time, max(cid) as cid by bid
| eval bid = if(cid = bid, null, bid)
| eval cid = coalesce(cid, bid)
| where not (isnull(bid))
| stats max(bid) as bid by cid
| eval a = bid | eval c = if(cid = bid, null, cid)
// and eval b - unknown... have no time now 😞
It all looks like a tricky and time wasting thing 🙂 I think it's possible to improve
... View more
08-28-2014
09:01 AM
Ok, I'll try to show what do I really need now.
I suppose not-inner join's become a little problem now.
A. What I've got
1) sourcetype = a | table _time, id
2) sourcetype = b | table bid, cid
3) sourcetype = c | table cid
B. What I need
earliest=-1d@d latest=@d a
left join
earliest=-1d@d b on a.id = b.bid
left join
earliest=-1d@d c on b.cid = c.cid
and gt a table: a._time, a.id, b.bid, c.cid from this join
...to be continued...
... View more
08-28-2014
04:38 AM
first problem: more than 2 indexes/tables
second problem: different variables for different joins
third problem: different names for the same variable
when I haveto join three indexes A, B, C; and join A with B by id1 and B with C by id2 - it becomes MUCH more complicated. especially when the join-by-fields have different names in different indexes. 20 rows of and awful-formatting search request for such a simple thing... =(
... View more
08-28-2014
04:37 AM
ye, it's possible, but it is a little bit strange way.
... View more
08-22-2014
12:55 AM
How to round search time to 5 mins?
If i use span=5m fro timechart the time rounded to 1 minute looks awful.
... View more
- Tags:
- timerange
08-21-2014
02:23 AM
Hello!
How can I, for example, eval min(_time) an mvcombine ip for event grouped by two or three other fields?
Thank you in advance!
... View more
07-23-2014
12:43 AM
And what to use instead of join?
My case is joining some data 🙂 from different applications and hence different sources/sourcetypes/indexes.
Several million of rows, at least.
... View more
07-22-2014
01:04 AM
1 Karma
How do you join large tables?
It is impossible to join tables with more than 50k rows in splunk, so I'm using some tricks, and these tricks are extremely annoying.
Is there any "normal way"?
So, to summarize:
there is no "beautiful" way to join in splunk. We need to use stats, eventstats and brainfuck.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
