About sarumjanuch

sarumjanuch · ‎12-08-2013

That is actualy waht i did. If someone need, i cant post it here.

sarumjanuch · ‎11-27-2013

Hmm the problem is that i use simple XML..

sarumjanuch · ‎11-27-2013

I have 5 views and each of them have date picker, is there any way to share date picker between all views, so when i navigate from one to other, time remain as i selected.

sarumjanuch · ‎11-27-2013

Who knows, how to implment dropdow for setup.xml, i can se in documentation that there is type "list", but here shoud i pupulate values for it?

sarumjanuch · ‎11-22-2013

Finaly found resolution: TIME_PREFIX=^([^,]*,){Position of needed field}

sarumjanuch · ‎11-22-2013

Need help, i have log file kind of: "INT","INT","INT","VARCHAR","""VARCHAR"" ","VARCHAR","VARCHAR","VARCHAR",VARCHAR,,,VARCHAR,VARCHAR,"2013-09-19 09:29:53","2013-09-19 09:29:55","2013-09-19 09:34:50",297,295,VARCHAR,VARCHAR,"1379597393.479905","" i neet to set my timestamp as first time field: "2013-09-19 09:29:53" is there any way to tell on what position my timestamp?? Or maybe any other way to do this? Previous field is not good idea to regexp, because it can be string with digits in any order and with any legth. Thank you!

sarumjanuch · ‎11-20-2013

Thank you! Marked next answer, because it full.

sarumjanuch · ‎11-20-2013

Hi. Reading the forum and docummentation don't gave me an answer. I have an application, all my views are done with Simple XML. I am using Splunk 6. I packaged app, and everything is working fine. Do i need to convert my views to Advanced XML ?

sarumjanuch · ‎11-19-2013

Hi Guys, i am developing free application for splunk, right now i am on the poing where i need to packege everything, i need to know what is the proper structure of my searches, right now they are in form of simple xml, should i move all my searches to savedsearches.conf? Also is there any way to have an application setup screen where user can select a value wich will be then used over all apllication, reason for this, application must work with two differen log files, and both of them can be in database or text log file. Thank you.

sarumjanuch · ‎11-13-2013

Hi is there any way to return same value if not found in lookup table? i.e. I have file users.csv code,name 100,jhon 200,jane and for exmple when i am doing lookup and send for example code 300, i don have it in my table, and it will become NONE, but i want lookup to return 300. Thank you.

sarumjanuch · ‎11-04-2013

Hi there i have log something like this: id=4555 event=Enter data1=12 id=4555 event=Connect data1=23 id=4555 event=Exit data1=28 id=4556 event=Enter data1=12 id=4556 event=Connect data1=23 id=4556 event=Exit data1=28 then i use | transaction id and i receive my events gouped by id, but now, i need to create a table like this: id | data1 from line where event=Enter | data1 from line whre event=Connect can someone advise me, what tool i should read about?

sarumjanuch · ‎10-29-2013

Thank you good man.

sarumjanuch · ‎10-29-2013

Is there any way to rename fields for by getting value from different source? For example in my log file i have user=100, and i have table or just a text file, where i spcify 100=Jhon Doe. So i can repleace 100 with Jhon Doe in my reports?

sarumjanuch · ‎10-29-2013

Yeah, i understand this, but for examle i have CDR's application and i need to count total duration of calls, and this will be very wierd if i will post my calls duration something like this, is there any way to get this in absolute values?? for example: "160:25:30"

sarumjanuch · ‎10-28-2013

Why when i am using this function for big seconds values, i get something like: "1+06:29:32"? If this field is duration then i suspect it can have more than 24 hours. Can someone explain?

Posts	15
Solutions	1
Karma Given	4
Karma Received	6
Member Since	‎09-20-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Share data betwen views

Setup.xml dropdown list

Can't extract timestamp from multi-timestamp csv f...

Advanced XML vs Simple XML, do i need it?

Application settings and structure

Lookup return same value if not found

Multiline event report

Rename field value from other source

tostring (X, "duration") working wierd.

Re: Setup.xml dropdown list

Re: Share data betwen views

Share data betwen views

Setup.xml dropdown list

Re: Can't extract timestamp from multi-timestamp c...