About LHAYNES020

LHAYNES020 · ‎12-15-2022

I'm trying to use where(isnotnull(mvfind(mvfield,field))) to search to see which records are part of a list. The fields are all strings, and some of them have parentheticals at the end. I noticed that mvfind does not seem to capture these fields. To illustrate my point, try the following search. | makeresults count=10 | streamstats count as n | eval n=n-1 | eval n=case(n<3,"Test (".n.")",n<6,"Test ".n,n<9,"(".n.")",1=1,n) | eventstats list(n) as mv | eval index=mvfind(mv,n) When you do, you'll see that items 3-9 are captured, but 0-2 are not, even though the very values of n were used to generate the mv field. I currently have a workaround to just use rex commands to substitute different strings for the parenthesis, run my mvfind, and then use rex to substitute them back, but it feels a little ridiculous. Does anyone know why mvfind doesn't work here or a cleaner way to fix it?

LHAYNES020 · ‎08-12-2020

Are you able to evaluate the value in the query like my example above? Perhaps if you can show what the rest of the panel looks like, we can find a place to set it that isn't in the drilldown itself.

LHAYNES020 · ‎08-02-2020

I had the same problem and just came to a solution that may not be the most efficient, but is at least working for me. I set the field value in the query itself and then had the search set a token on completion instead of in the drilldown. That seems to be correctly passing the value instead of the name. <table> <title>Google Test</title> <search> <done> <set token="link">$result.link$</set> </done> <query>|makeresults| eval link="google"|table *</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">row</option> <option name="refresh.display">progressbar</option> <drilldown> <link target="_blank">https://$link$.com</link> </drilldown> </table>

LHAYNES020 · ‎08-06-2018

It's a tad clunky, but as long as you want to sort by _time, there's a way to do it with streamstats: | eval low=3 | eval high=4 | streamstats count as NewToOld | head(NewToOld<=high) | reverse | streamstats count as OldToNew | head(OldToNew<=high-low+1) | reverse Streamstats will basically index your events for you and then through a little mathematical manipulation, you can use head and tail (or in this case, reverse & head) to chop off either end of the results leaving only the desired middle results. Note that this will only work if you're looking for the middle results by the order Splunk found them (which is the same as _time as long as you don't have any appended results).

Posts	4
Solutions	1
Karma Given	1
Karma Received	2
Member Since	‎08-06-2018

Online Status	Offline
Date Last Visited	‎12-15-2022 11:47 AM

mvfind can't see spaces and parenthesis

mvfind can't see spaces and parenthesis

Re: simple xml drilldown evaluated token value isn...

Re: simple xml drilldown evaluated token value isn...

Re: How to read middle events from the event list?