About mmol

mmol · ‎03-01-2022

In the classic Dashboard environment we can specify a 'valuePrefix' for an input. In the Dashboard Studio GUI editor there does not seem to be such an option. Is there a way to do this the using code editor? Thanks

mmol · ‎12-15-2020

The links to the 'other' questions/answers do not work anymore. But what does work is: | eval n=replace(my__field, "___", " ") So literally add a newline to your code. It is silly to need to do it in this way. Why are \n and similar characters as replacements not supported, while they are supported in the pattern. The replace function should also allow other options like replace only one occurrence or all occurrences (learn a bit from the Perl language I guess...)

mmol · ‎06-22-2020

(I'm the person that originally emailed the question to sideview.) Thanks all for the good discussion. I did do an implementation using lookup tables. It looks much simpler but you depend on creating the lookups in the first place: index=A ... | outputlookup A.csv before combining the data: | inputlookup A.csv | rename id as A_id, name as A_name | lookup REL.csv parent as A_id output child as B_id | where isnotnull(B_id) | mvexpand B_id | lookup B.csv id as B_id output name as B_name | where isnotnull(B_name) | lookup REL.csv parent as B_id output child as C_id | where isnotnull(C_id) | mvexpand C_id | lookup C.csv id as C_id output name as C_name | mvexpand C_name | fields - A_id B_id C_id | sort 0 A_name B_name C_name Although it duplicates possibly a lot of data, this seems easier to understand and to extend to even more relationships.

mmol · ‎04-06-2020

Thanks for the pointer! Just created it as a new idea... https://ideas.splunk.com/ideas/EID-I-168

mmol · ‎04-06-2020

Thanks for your comments Darren, Unfortunately I have no access at the command line level so implementing this requires me to go to the application managment team. It seems such an easy feature to add to the gui....

mmol · ‎04-06-2020

The lookup table files view only shows some basic info about the file. I often like to know the size and the age of the files. I've seen some pyhton additions to show that, but the lookup table file view seems to be the logical place to add such info. Can this be added in a future splunk release?

mmol · ‎02-12-2020

You could make use of the override_if_empty attribute of outputlookup: | dbxquery connection=xxx query="select * from tablex" |massage the data |discard all events when an error condition occurs, maybe using: | eventstats count as dbresults | where dbresults > 10000 | outputlookup tablex_fast_lookup override_if_empty=false

mmol · ‎07-09-2019

Another question on counting the number of events per values() value in stats command. Using sistats this is seems to be done automatically. For example having events with src_ip, dest_ip, user (and a couple of more) fields. sistats values(src_ip) as src_ip, values(user) as user by dest_ip gives me for example dest_ip src_ip user 1.2.3.4 8.9.10.11;3 root;1 10.11.12.13;2 marcel;4 but using stats only shows: dest_ip src_ip user 1.2.3.4 8.9.10.11 root 10.11.12.13 marcel So splunk already can already count the number of occurrences per value but does not show it for plain stats I started using sistats to build a summary index, but using the implicitly added symmaryindex command does not seem to allow me to specify sourcetype and source values for example. Therefor I want to revert to stat and explicitly use the collect command to build a summary index. But then I loose the counts per value in the values() results as shown above. I tried to solve that by adding eventstats: | eventstats count(user) as usercnt by user, dest_ip | eventstats count(src_ip) as srcipcnt by src_ip, dest_ip | eval user=user . ";" . usercnt, src_ip=src_ip . ";" . srcipcnt | stats values(src_ip) as src_ip, values(user) as user by dest_ip This works fine for small input datasets, but it quickly runs out of memory on large base search results (the actual query has additional by fields and aggregates), while the sistats version runs fine. Any thoughts suggestions ideas? @splunk development team: maybe you can add some optional functionality to the values() function to add such count information? Thanks -Marcel

Posts	8
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎07-09-2019

Online Status	Offline
Date Last Visited	‎03-01-2022 11:47 AM

How to specify a 'valuePrefix' for an input in Das...

size and timestamp of lookup files

stats: count number of occurences for each value i...

How to specify a 'valuePrefix' for an input in Das...

Re: Replace a character with a linebreak in table ...

Re: Looking to rewrite a join across several index...

Re: size and timestamp of lookup files

Re: size and timestamp of lookup files

size and timestamp of lookup files

Re: How abort a search based on a condition?

stats: count number of occurences for each value i...