Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About erwanlebaron
erwanlebaron
Engager
Member since:
11-20-2019
09-26-2022
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-20-2019 |
Activity Feed
- Posted Re: How to rename a field name with curly braces by using Field Alias ? on Splunk Search. 09-26-2022 01:54 AM
- Posted How to rename a field name with curly braces by using Field Alias ? on Splunk Search. 09-22-2022 06:01 AM
- Posted Re: Failed to parse a JSON string on Splunk Search. 09-25-2020 07:52 AM
- Posted Failed to parse a JSON string on Splunk Search. 09-25-2020 07:36 AM
- Tagged Failed to parse a JSON string on Splunk Search. 09-25-2020 07:36 AM
- Tagged Failed to parse a JSON string on Splunk Search. 09-25-2020 07:36 AM
- Tagged Failed to parse a JSON string on Splunk Search. 09-25-2020 07:36 AM
- Posted Re: How to use a token set as an previous input value as condition for a link in drilldown on Dashboards & Visualizations. 04-14-2020 12:17 AM
- Posted How to use a token set as an previous input value as condition for a link in drilldown on Dashboards & Visualizations. 04-08-2020 05:48 AM
- Tagged How to use a token set as an previous input value as condition for a link in drilldown on Dashboards & Visualizations. 04-08-2020 05:48 AM
- Tagged How to use a token set as an previous input value as condition for a link in drilldown on Dashboards & Visualizations. 04-08-2020 05:48 AM
- Tagged How to use a token set as an previous input value as condition for a link in drilldown on Dashboards & Visualizations. 04-08-2020 05:48 AM
- Tagged How to use a token set as an previous input value as condition for a link in drilldown on Dashboards & Visualizations. 04-08-2020 05:48 AM
- Posted Schedule PDF Option unclickable on my Dashboards on Reporting. 02-07-2020 06:17 AM
- Tagged Schedule PDF Option unclickable on my Dashboards on Reporting. 02-07-2020 06:17 AM
- Tagged Schedule PDF Option unclickable on my Dashboards on Reporting. 02-07-2020 06:17 AM
- Tagged Schedule PDF Option unclickable on my Dashboards on Reporting. 02-07-2020 06:17 AM
- Posted Re: Issue to find the format to convert string to date on Getting Data In. 01-22-2020 04:33 AM
- Posted Re: Issue to find the format to convert string to date on Getting Data In. 01-22-2020 04:31 AM
- Posted Re: Issue to find the format to convert string to date on Getting Data In. 01-22-2020 04:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-26-2022
01:54 AM
Hi @andrew_nelson Thanks for the answers. It works now. It was what I've configured. I just don't understand why alias without {} has applied instantly and those {} was not visible last week. Now I can see all my alias ! Have a nice day
... View more
09-22-2022
06:01 AM
Hi I have several search where I performed renaming. Some of them are done on fied which looks like xxx.yyy{}.aaa xxx.yyy{}.bbb zzz{}.ccc In the search I do | rename xxx.yyy{}.aaa as newname1, xxx.yyy{}.bbb as newname2, zzz{}.ccc as newname3 I tried to implement it with field alias configuration but it's doesn't work Is it possible ? I don't find any documentation about this specification PS : my field alias works properly without curly braces
... View more
Labels
- Labels:
-
fields
09-25-2020
07:52 AM
It works by doing that before the spath command | eval Tags_json=replace(Tags,": ",":")
| eval Tags_json=replace(Tags_json,"\" \"","\",\"") But it doesn't look very elegant... There is a better solution ?
... View more
09-25-2020
07:36 AM
Hi I get data from an CSV file and one of the filed imported is a JSON string called "Tags" which looks like that Tags = {"tag1": "toto" "tag2": "tata" "tag4": "titi"} --> exemple for a line Tags = {"tag3": "toto" "tag4": "tata"} --> exemple for another line The delimitation between key and value is <colon>+<space> The delimitation between two key+value is <space> I tried | spath input=Tags but when I do | table tag1, tag2, tag3, tag4 I get value only for tag1. I tried to find a way to solve it by looking other topics but I do not succed. I understood that my string is not correctly formatted like a "real" Json but I don't fin the command to convert my initialy field "Tags" into a correct Json format to apply the "spath" command Is there anybody has an idea to do it Thanks in adance
... View more
Labels
- Labels:
-
field extraction
04-14-2020
12:17 AM
Perfect it works with " for a quote in the "match" !
... View more
04-08-2020
05:48 AM
Hi
After looking on the forum, I don't find a solution to solve my issue.
I use drilldown on a table to open a link on another application.
<drilldown>
<link target="_blank">https://cmp.<blablabla>/$row.Id$/overview</link>
</drilldown>
But the link will change depanding of a token set trough an input
<fieldset submitButton="false">
<input type="dropdown" token="env_portal">
<label>Environment</label>
<choice value="prd">PRD</choice>
<choice value="tvp">TVP</choice>
<initialValue>prd</initialValue>
</input>
</fieldset>
I tried to add a condition in the drilldown but it doesn't work
<drilldown>
<condition match=" $env_portal$ == 'prd' ">
<link target="_blank">https://cmp.<blablabla>/$row.Id$/overview</link>
</condition>
<condition match=" $env_portal$ == 'tvp' ">
<link target="_blank">https://cmp-tvp.<blablabla>/$row.Id$/overview</link>
</condition>
</drilldown>
How I can do a seach condition ?
Regards
... View more
02-07-2020
06:17 AM
Hi
I would like to schedule PDF Delivery from a Dahsboard but the link is unclickable
My role role includes the schedule_search capability so I don't understand why I can't. Is their something else to activate ?
Thanks in advance for your helps
PS : my email server is correctly configure --> The "sendemail" runs correctly in a querry
... View more
Labels
- Labels:
-
PDF
01-22-2020
04:33 AM
My day number is the format %e and not %d.
The issue came from the field name with the space.
Anyway thanks of having taken time to answer
... View more
01-22-2020
04:31 AM
The issue came from field "Created Time" with space...I add the rename of my field without space and it works
Thanks
... View more
01-22-2020
04:31 AM
The issue came from field "Created Time" with space...I add the rename of my field without space and it works
Thanks Giuseppe
... View more
01-21-2020
02:12 AM
Hi
I tried to convert some string to date but it doesn't work.
Below an example of date ("Created Time")
Created Time
Friday April 19 2019 5:23:48 PM CEST
Friday April 26 2019 5:22:08 PM CEST
Friday August 16 2019 12:44:31 PM CEST
Friday August 9 2019 5:29:40 PM CEST
Friday December 13 2019 2:11:15 AM CET
Friday December 20 2019 12:32:19 PM CET
Friday December 20 2019 12:32:21 PM CET
Friday December 20 2019 12:42:35 PM CET
Friday December 6 2019 9:35:07 AM CET
Friday February 1 2019 4:14:16 PM CET
Friday February 1 2019 4:25:06 PM CET
Friday February 1 2019 4:36:21 PM CET
Friday February 1 2019 8:27:19 PM CET
Friday February 22 2019 5:17:29 PM CET
Friday February 22 2019 5:17:53 PM CET
Friday February 22 2019 8:18:31 PM CET
Friday February 8 2019 10:03:56 PM CET
Friday February 8 2019 11:00:07 AM CET
I tried the following search
[My Search]
| eval Created_Time_timestamp=strptime("Created Time", "%A %B %e %Y %I:%M:%S %p %Z")
| table "Global Id", "Created Time", Created_Time_timestamp
But "Created_Time_timestamp" stay empty
Global Id Created Time Created_Time_timestamp
4a003a1203468c82b5b16c6877f2bac1 Thursday December 26 2019 10:23:25 AM CET
4a01b7d12e0a96078b31c8c109efe428 Thursday December 26 2019 12:35:38 PM CET
4a036467deb8077f9ce0115fae8115b3 Thursday December 26 2019 10:23:19 AM CET
4a0428dc18231232af4588a95d26ca4a Tuesday January 15 2019 6:01:56 PM CET
4a0435ed94329293bcc019297385fd7a Tuesday January 22 2019 6:02:07 PM CET
4a0915459109146eb0a02f49d5b6946d Thursday December 26 2019 10:23:19 AM CET
4a09af63013a323681b9ea494710d6ae Wednesday January 23 2019 5:03:20 PM CET
4a0a85212b65c1fc9bed8fbddf8f9b58 Thursday January 24 2019 12:58:22 PM CET
4a0b1be513465e5a8bd5379e2226a7e3 Wednesday August 21 2019 12:45:47 PM CEST
I don't succed to find a solution.
Is there someone who could have an idea ?
Thanks
... View more
11-21-2019
03:47 AM
The issue came from the fact the format is done as "relative date".
Try to change
<eval token="form.et">strftime('earliest', "%F")</eval>
by
<eval token="form.et">strftime(relative_time(now(),'earliest'), "%F"</eval>
... View more
11-21-2019
12:17 AM
I was exactly what I was looking for.
I hadn't understood the "values" while using stats.
Thanks a lot
... View more
11-20-2019
09:34 AM
Hi
I've a question regarding stat or eventstat option last.
I would like to keep the last "event" in a table with several informations and I don't succeed.
index=dynatrace
| streamstats last("consumedHostUnits") by "vmwareName"
| eval FirstTime=strftime(firstSeenTimestamp/1000,"%d-%m-%Y %H:%M"), LastTime=strftime(lastSeenTimestamp/1000,"%d-%m-%Y %H:%M")
| table "vmwareName" "ipAddresses{}" "consumedHostUnits" "managementZones{}.name" monitoringMode FirstTime LastTime _time
| sort "consumedHostUnits" desc
And I've 3 times a row for a server
And if I use "stats" instead of "eventstats" I lost data for the others column
index=dynatrace
| stats last("consumedHostUnits") as HU by "vmwareName"
| eval FirstTime=strftime(firstSeenTimestamp/1000,"%d-%m-%Y %H:%M"), LastTime=strftime(lastSeenTimestamp/1000,"%d-%m-%Y %H:%M")
| sort HU desc
| table "vmwareName" "ipAddresses{}" HU "managementZones{}.name" monitoringMode FirstTime LastTime _time
What is the solution to have the first screenshot with only a single line as the second screenshot ?
Regards
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-26-2022
01:08 PM
|
