Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nasha430
nasha430
Explorer
Member since:
12-15-2020
06-25-2021
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 12-15-2020 |
Activity Feed
- Posted Re: It is truncated subsearch. tstats command. on Splunk Search. 06-25-2021 01:03 AM
- Posted It is truncated subsearch. tstats command. on Splunk Search. 06-20-2021 06:45 PM
- Posted Re: tstats, no using stats-function-field, using row-field. on Splunk Search. 05-31-2021 07:32 PM
- Karma Re: tstats, no using stats-function-field, using row-field. for aasabatini. 05-31-2021 07:32 PM
- Posted Re: tstats, no using stats-function-field, using row-field. on Splunk Search. 05-31-2021 06:17 PM
- Posted Re: tstats, no using stats-function-field, using row-field. on Splunk Search. 05-31-2021 05:22 PM
- Posted Re: tstats, no using stats-function-field, using row-field. on Splunk Search. 05-30-2021 04:54 PM
- Posted tstats, no using stats-function-field, using row-field. on Splunk Search. 05-28-2021 02:07 AM
- Karma Re: How to use accelerate datamodel in search? for harsmarvania57. 05-27-2021 09:53 PM
- Posted Is the report linked in the dashboard not updated if we cannot use the time picker shared? on Dashboards & Visualizations. 12-16-2020 05:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
06-25-2021
01:03 AM
Oh, I solve my situation index="test-index01" sourcetype="test_sourcetype" user="*" OR user_name="*"
| stats count(file_name) as file_cnt sum(save_cnt) as save_cnt by user
file_name bunit id name
| join type=left file_name user
[ | tstats summariesonly=t earliest(test_datamodel.privacy_count) as
privacy_count FROM datamodel=datamodel
WHERE "test_datamodel.user"="*"
BY test_datamodel.user test_datamodel.file_name
| rename test_datamodel.user as user test_datamodel.file_name as
file_name
| join type=inner file_name user
[search index="test-index01" sourcetype="test_sourcetype" user="*" OR
user_name="*"
| stats count by file_name user]
| fields file_name user privacy_count] Index=test-index01 is few data(<500). Datamodel=datamodel is many data(>500000).
... View more
06-20-2021
06:45 PM
Hi. I have one problem. It is truncated subsearch result. index="test-index01" sourcetype="test_sourcetype" user="*" OR user_name="*"
| stats count(file_name) as file_cnt sum(save_cnt) as save_cnt by user
file_name bunit id name
| join type=left file_name user
[ | tstats summariesonly=t earliest(test_datamodel.privacy_count) as
privacy_count FROM datamodel=datamodel WHERE "test_datamodel.user"="*"
BY test_datamodel.user test_datamodel.file_name
| rename test_datamodel.user as user test_datamodel.file_name as
file_name] search result alert : [subsearch]: Subsearch produced 1485715 results, truncating to maxout 500000. too many (BY user file_name) results. It is searched privacy_count query by user file_name. So I want to listen your advice. I don't know that I have to see some manual. Thank you.
... View more
05-31-2021
07:32 PM
@aasabatini Oh! I find solution!! Thanks... because you listen my issue, I find my solution. ㅠㅠ. This is my way. | tstats summariesonly=t values(<dataset>.reg_no) as reg_no FROM datamodel=<datamodel> BY <dataset>.user <dataset>.FILE_HASH | dedup <dataset>.user <dataset>.FILE_HASH | stats sum(reg_no) by <dataset>.user Thanks aasabatini!! good luck.
... View more
05-31-2021
06:17 PM
@aasabatini Hi! In my thought If tstats use 'list' command, my issue can be solved. I see search reference, can't use 'list' function. Can it be Other way?
... View more
05-31-2021
05:22 PM
@aasabatini Hello! Please, let you know my conditional factor. Exactly not use tstats command. ( I still am solving my situation, I study lookup command. I will finish my situation with hope.) fields : user(data: STRING), reg_no(data:NUMBER), FILE_HASH(data : HASHCODE) 1. I use 'datamodel acceleration'. 2. I do 'FILE_HASH(field) deduplication'. Event have deduplicated. 3. After deduplication, I use sum(reg_no). So I try code. | tstats summariesonly=t reg_no FILE_HASH FROM datamodel="<datamodel>" by user | dedup FILE_HASH | stats sum(reg_no) by user. But tstats don't use fields... so I have to find other way. I will try lookup command! Maybe let me know other thinking or command.
... View more
05-30-2021
04:54 PM
@aasabatini Thanks you, your message. but I want to see field, not stats field. Based on your SPL, I want to see this. | tstats `summariesonly` Authentication.app as app,Authentication.user as user,
count from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.action,Authentication.src
| dedup user
| stats sum(app) by user because I need deduplication of user event and I don't need deduplication of app data.
... View more
05-28-2021
02:07 AM
Hi, I use tstats, but tstats use required argument ( stats-func ). I want to write SPL. | tstats summariesonly=t <field1>, <field2> FROM datamodel=<datamodel-name> BY <field3> | dedup <field1> | stats sum(<field2>) by <fields1> Is this possible?? datamodel acceleration is done. I'm looking for manual for this,but I don't detect manual about tstats.
... View more
Labels
- Labels:
-
tstats
12-16-2020
05:06 PM
Hello, This is nasha430. Thanks to your help, I've been running this program very gratefully. I'm looking over the manual translated in Korean language and I found that the report linked in the dashboard cannot commence sharing timepicker. Is the report linked in the dashboard not updated if we cannot use the time picker shared? If not, how can we keep the report up-to-date? Thanks for the cooperation. Have a nice day.
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-25-2021
04:26 AM
|
