Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About fpedrosa
fpedrosa
Engager
Member since:
03-09-2022
03-30-2023
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-09-2022 |
Activity Feed
- Posted Real-time query with click on table doesn't work? on Splunk Search. 11-21-2022 11:25 AM
- Posted Re: My search doesn't count correctly on Splunk Search. 11-01-2022 09:36 AM
- Posted Re: My search doesn't count correctly on Splunk Search. 10-28-2022 11:38 AM
- Posted Re: My search doesn't count correctly on Splunk Search. 10-28-2022 11:23 AM
- Posted Re: My search doesn't count correctly on Splunk Search. 10-28-2022 10:49 AM
- Posted How would I fix my search not counting correctly? on Splunk Search. 10-27-2022 02:19 PM
- Posted Help with stats building a wrong result on my table on Splunk Search. 10-27-2022 02:14 PM
- Posted Pie Chart - How to show my own field instead of Count% ? on Splunk Search. 09-26-2022 05:10 AM
- Posted Re: How to check if field exists and bring another field if true on Splunk Search. 03-09-2022 06:06 AM
- Posted Re: How to check if field exists and bring another field if true on Splunk Search. 03-09-2022 05:55 AM
- Posted Re: How to check if field exists and bring another field if true on Splunk Search. 03-09-2022 05:39 AM
- Posted Re: How to check if field exists and bring another field if true on Splunk Search. 03-09-2022 05:08 AM
- Posted How to check if field exists and bring another field if true on Splunk Search. 03-09-2022 04:01 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-21-2022
11:25 AM
Hello,
I have a table with a custom Splunk Query, and a custom Click on an Cell.. work fine if I select to filter any filter than "Real Time" . Using real time, this click doesn't work, appears to recreate the query every second, and when I click the action is not triggered.
How can I fix that?
Thanks
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
stats
-
tstats
11-01-2022
09:36 AM
@johnhuang mvcount if there isn't any record, this search returns "no result" for the Single Value, so, it's showing like this: Do you know, if is possible to bring just 0 when there's no record?
... View more
10-28-2022
11:38 AM
In my case some record may have multivalues events, or only one event... using your last search, I'm getting several returns, not just one return with the count, and the numbers are pretty different too..
... View more
10-28-2022
11:23 AM
Thanks again @johnhuang appears it's going somewhere.. 🙂 Running your search I'm getting this on "Search": I'm wondering if we need to have only "one" result with the all number... or I misunderstood something here?
... View more
10-28-2022
10:49 AM
Hi @johnhuang thanks for your reply. Unfortunately not worked here.. using your code like this: earliest=-30d@d
| spath
| spath path=events{} output=events
| eval event_ct=MVCOUNT(event)
| timechart span=30d sum(event_ct) AS event_ct Brings 0 (zero) even with records there.. I tried to change like this: earliest=-30d
| spath
| spath path=events{} output=events
| stats by _time, events
| mvexpand events
| eval _raw=events
| kv
| table _time
| timechart span=30d aligntime=latest count(_time) as event_cnt show some numbers, but not the right ones..
... View more
10-27-2022
02:19 PM
Hello y'all! I'm trying to use the Single Value object, and build a search which count the number of the records and shows up.. but, for some reason it's not bring the right number.. Here is my search:
index=redhatinsights
| spath
| spath path=events{} output=events
| stats by _time, events, application, event_type, account_id, context.display_name
| mvexpand events
| eval _raw=events
| kv
| table _time
| where relative_time(now(), "-30d") <= _time
| timechart span=30d count(_time) as count
| appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | makemv time | mvexpand time | table time count | rename time as _time ]
for some reason is not bring all the records, and this time range doesn't make any affect to the result:
What's is the right way to use this object and bring the total count of the records in the last 30 days? Thanks!
... View more
10-27-2022
02:14 PM
Hello, I have a lots of records, some one has account_id field filled.. others has org_id field filled, and some ones both filled.... I'm trying to bring the table both field (account_id and org_id) but, when I put the org_id into the stats by, bring only a few records, If I remove it, bring all the records, whats I'm doing wrong? Thanks ! Here is my search: | spath
| rename object.* as *
| spath path=events{} output=events
| mvexpand events
| stats by timestamp, events, application, event_type, org_id, account_id, context.display_name
| eval _raw=events
| kv
| table created_at_fmt, account_id, "application", "event_type", "context.display_name", title, url, org_id
... View more
09-26-2022
05:10 AM
Hi, I have this search: | stats count by application
| eval application = case(
application=="malware-detection", "Malware",
!isnull(application), upper(substr(application,1,1)).substr(application,2)
)
| eventstats sum(count) as total
| eval count_2=round(100*count/total,2)
| fields- total
| eval count_perc="".count_2."%"
| rename application as Application, count as Count and I would like to show the Application, Count and count_perc fields on mu Pie Chart, but splunk still show the Count%. My goal is to round the percentage, how can I do this? Thanks for support!
... View more
Labels
- Labels:
-
chart
03-09-2022
06:06 AM
@PickleRick do you know how I can get the array index for the json? for example, with my search, I'll split the `events` array into a new record, but I need to know the index of the original event, so I can grab it when I'll develop row expansion, to show more data. Do you know how to do this?
... View more
03-09-2022
05:55 AM
You are right!! Works now! Thanks!
... View more
03-09-2022
05:39 AM
Thanks again, unfortunately still the same... here is my search: | spath
| rename object.* as *
| spath path=events{} output=events
| stats by timestamp, events, application, event_type, account_id, context.display_name,
| mvexpand events
| eval _raw=events
| eval title=coalesce('payload.rule_description', event_type)
| kv
| table timestamp, title, "context.display_name", account_id, "event_type", "application", "payload.rule_url"
| rename account_id as "Account ID", timestamp as "Timestamp", context.display_name as "System", context.host_url as "Host URL", event_type as "Event Type", "title" as "Title", "application" as "Application", "payload.rule_url" as "URL"
... View more
03-09-2022
05:08 AM
Thanks @PickleRick but didn't work... brings me event_type for all records, even the record with payload.rule_description
... View more
03-09-2022
04:01 AM
Hi, I have this search: | spath
| rename object.* as *
| spath path=events{} output=events
| stats by timestamp, events, application, event_type, account_id, context.display_name,
| mvexpand events
| eval _raw=events
| kv
| table timestamp, payload.rule_description, "context.display_name", account_id, "event_type", "application", "payload.rule_url"
| rename account_id as "Account ID", timestamp as "Timestamp", context.display_name as "System", context.host_url as "Host URL", event_type as "Event Type", "title" as "Title", "application" as "Application", "payload.rule_url" as "URL" I have a json with multiple `events, inside this event I have "payload.rule_description", but, some record, doesn't have this "payload.rule_description" object, so, I don't have the "payload.rule_description". How can I check if the record has the "payload.rule_description" if not, brings `event_type` instead? Tried to use `eval title=if(payload.rule_description, payload.rule_description, event_type)` doesn't work. Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-30-2023
11:00 AM
|
