About karthik4455

karthik4455 · ‎05-22-2017

This helps but I would face the problem when I seach for a source which could be linked to any Customer. If I search with source I like to see Customer and source automatically like I used to see when I run the below query and the event count is not zero. index=dailyincidents earliest=-30d@d source=FW1-HKS-01 | dedup id | stats values(customer) AS Customer count AS QuarterlyVolume by source

karthik4455 · ‎05-22-2017

If I use that I am seeing NA as Customer in the result. I am expecting something like below source Customer QuarterlyVolume FW1-HKS-01 Customer_Name 0

karthik4455 · ‎05-22-2017

I have a scenario where one column needs to be indicated with Zero in the instance of no result. However, it's showing other fields as NULL. fillnull isn't working. index=dailyincidents earliest=-30d@d source=FW1-HKS-01 | dedup id | stats values(customer) AS Customer count AS QuarterlyVolume by source | appendpipe [stats count | eval QuarterlyVolume=0 | where count=0 | fields - count] I am using the above search and I'm seeing the below result. Nothing below source and Customer, Zero appears below QuarterlyVolume. source Customer QuarterlyVolume 0 I want to see the details of source and Customer as well. Similar issue has been discussed here: https://answers.splunk.com/answers/59589/no-results-found-to-be-represented-as-null-or-0.html

karthik4455 · ‎05-22-2017

I have a scenario where one column needs to be indicated with Zero in the instance of no result. While this seems to be working, however, it's showing other fileds as NULL. query: index=dailyincidents earliest=-90d@d source=FW1-HKS-01 | dedup id | stats values(customer) AS Customer count AS QuarterlyVolume by source | appendpipe [stats count | eval QuarterlyVolume=0 | where count=0 | fields - count] I am using the above query and I'm seeing the below result: source Customer QuarterlyVolume 1 0 I want to see the details of source and Customer as well.

karthik4455 · ‎09-10-2014

Escalated_Tickets Resolved_Tickets 4334 3453 5545 8438 7565 8948 8877 4675 9868 4334 3453 5568 5545 8438 6932 7565 8948 8877 1258 6589 4675 9868 What I need is the below output. Tickets 5568 6932 1258 6589 Single output which will remove entries that are identical in Escalated_Tickets & Resolved_Tickets

karthik4455 · ‎07-27-2014

I appended 2 searches and each of them has "top Engineer" and now my result is like this. Engineer Escalated Closed Shaun 61 Smith 53 Arun 41 Sam 19 John 14 Jason 13 Eddy 12 Rich 9 Arun 114 John 93 Shaun 76 Eddy 74 Jason 46 Rich 38 Smith 16 Sam 12 How can I have a result like this ? Engineer Escalated Closed Shaun 61 76 Smith 53 16 Arun 41 114 Sam 19 12 John 14 93 Jason 13 46 Eddy 12 74 Rich 9 38

karthik4455 · ‎07-23-2014

Thanks a lot. It worked.

karthik4455 · ‎07-22-2014

Can you tell me how I can filter the output as follows: You could notice the output doesn't have B,C & D because they should be dropped. A Escalated & Closed E Escalated & Closed

karthik4455 · ‎07-22-2014

I wish to run a query where I need to see if field1 has both entries in field2. Ex: I need to query the results like A & E which has both Escalated and Closed status. Field status A Escalated A Closed B Closed C Escalated D Escalated E Escalated E Closed

karthik4455 · ‎07-22-2014

I am including this to my search but I receive error "Unknown search command 'index'." index=hfgtrdaily status=* ty=* | search Engineer!=system | index=blah sourcetype=bleh STATUS=ESCALATED OR STATUS=CLOSED| transaction Ticket | where mvcount(Engineer) = 1

karthik4455 · ‎07-22-2014

I am trying to create a report where same engineer has escalated a ticket and resolved it. Like Ticket 13440211 was escalated by shan and also closed by him as well. How can I create a query for this? Ticket status Engineer count 1 13440238 ESCALATED shan 10 2 13440211 CLOSED shan 74 3 13440211 ESCALATED shan 74 4 13440188 ESCALATED shan 2 5 13440144 ESCALATED shan 2 6 13440143 ESCALATED chan 15 6 13440143 CLOSED chan 15 7 13440143 ESCALATED shan 14

Posts	11
Solutions	0
Karma Given	0
Karma Received	4
Member Since	‎07-22-2014

Online Status	Offline
Date Last Visited	‎07-14-2021 02:15 AM

How to edit my search so that no results should be...

How to merge two fields and remove values that are...

append searches

Search to compare fields where field1 has both ent...

Search query for a report to match 3 fields

Re: How to edit my search so that no results shoul...