About danbar6

danbar6 · ‎12-01-2017

Some more info will help - What error are you getting? What does your 'ip' field look like? umm and also, why are you converting it to a DF just to go back to a list right away?

danbar6 · ‎11-23-2017

$hosttype$ needs to get an initial value for the search to be built and run. You can do that in another dynamic input or by giving it a static value in another input.

danbar6 · ‎11-15-2017

There are many related blog posts and answers around here. I recommend you start from a read of the epic Maintaining the State of the Union post. Once you've done this alerting will be as easy as scheduling and setting an alert action.

danbar6 · ‎11-15-2017

Did you check _internal logs for timestamp extraction related errors or warnings?

danbar6 · ‎11-15-2017

You can do this with a calculated field, using an eval looking something like this: mvfield = split(trim(commafield, "[]"), ",")

Posts	5
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎02-07-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: How to convert Intersplunk's readResults() to ...

Re: Error in multiselect - Could not create search

Re: How to alert when a deviation has been detecte...

Re: Use JSON epoch date time instead of index time

Re: Is it possible to use commands like makemv or ...