About pratibha0610

pratibha0610 · ‎08-08-2023

Hi Team, So i am new to splunk, therefore excuses for my stupid question. We have an Application, and multiple alerts/reports are created under it. Now there is a situation where a user fro our team is moved to another one, so i have to get list of alerts/report that are send this user. Can i do it with a search or manually is only option. Thanks in advance!!

pratibha0610 · ‎07-06-2023

@cesaccenturefed : did you see any solution for this issue?

pratibha0610 · ‎01-16-2023

Hi all, Could some please help me with this query. I have 3 different sources from which i want to match the fields. I am Source A contains K_user, ID Source B contains RECID, USER_RESET Source C contains USER, NAME i have do the query in 2 steps 1. Join A and B using ID. (RECID=ID) and get USER_RESET 2. Join the result from step 1 with C. Match K_USER and USER_RESET to get the name from source C. if i explain using example Source A K_USER ID ABN 1 XYZ 2 Source B RECID USER_RESET 1. MNP 3. IJK SOURCE C USER NAME ABN John XYZ Mary MNP Philip IJK Cathy Final result should look like K_USER | ID | USER_RESET | NAME(K_USER) | NAME(USER_RESET) ABN 1 MNP John Phillip Can i achieve this without using join. Thanks in Advance!!

pratibha0610 · ‎08-04-2022

@ITWhisperer thanks a lot!! my search worked. I also wanted to check one thing for setting up alert to send mail to Email address popped in result. Will the below solution work? Enable send email alert action and in to: field set $result.Email$

pratibha0610 · ‎08-04-2022

Hi team, I wonder if someone can help me with the below query. I have a to combine my two searches with join. With first search i get the assignement group and with second search i get email of those assigment group to send alert. i have common values between two sourcetype but field name is different. in the first serach, field is called dv_name and in second it is called name. Therefore i create name variable before using join. However my field email is still coming blank serach: index=production sourcetype=call | eval name=dv_name | join name type=left [ index=production sourcetype=mail earliest="04/30/2022:20:00:00" latest=now() | dedup name | stats values (dv_email) values (name) by name] | eval Email=if(isnull(dv_email), " ", dv_email) | table dv_name Email

pratibha0610 · ‎02-06-2019

hi, I have below as my records as my search results. Highlighted ones are unique key. I want compare between the record 1 and 3 , 2 and 4 display the incremented count. Record 1 null - 2019-02-01T12:55:58.270 - Quename- INL_TTI_01 - Inbound - Process - ABCODSC123245678:Record processed Successfully Record 2 null - 2019-02-01T12:55:59.270 - Quename- INL_TTI_01 - Inbound - Process - ABCODSC123248888:Record processed Successfully Record 3 null - 2019-02-01T12:55:58.777 - Quename- INL_TTI_01 - Outbound - Process - ABCODSC123245678:Record processed Successfully Record 4 null - 2019-02-01T12:55:60.270 - Quename- INL_TTI_01 - Outbound - Process - ABCODSC123248888:Record processed Successfully Record 5 null - 2019-02-01T12:55:62.270 - Quename- INL_TTI_01 - Outbound - Process - ABCODSC123245678:Record processed Successfully . . . . . n

pratibha0610 · ‎02-05-2019

Hi, Thanks for the reply. Can I also sort the logs based on the unique key?

pratibha0610 · ‎02-05-2019

Hi richgalloway, Thanks for the response. I also need to compare the two records. The search results in many rows. I use the search index= applicationet sourcetype=Rex

pratibha0610 · ‎02-05-2019

Hi all, I have a requirement where i have to know if the transaction key is processed within 3 seconds. I need to compare two unique references and take the latest timestamp. For e.g., I have two unique references, "ABC1" and "ABC2", and both of them have multiple records in the logs. I have to take the first timestamp from ABC1 and ABC2, and it should be less than 3 seconds. Can you all please give me some points which i can follow to complete this requirement?

Posts	9
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎02-05-2019

Online Status	Offline
Date Last Visited	‎08-08-2023 01:34 PM

how many splunk alerts are send to single User for...

Matching fields from 3 different sources?

Why are results still coming back blank after usin...

How do you compare timestamps from two rows?

how many splunk alerts are send to single User for...

Re: Scheduled searches stuck in past

Matching fields from 3 different sources?

Re: Join using multiple source type. But result is...

Why are results still coming back blank after usin...

Re: How do you compare timestamps from two rows?

Re: How do you compare timestamps from two rows?

Re: How do you compare timestamps from two rows?

How do you compare timestamps from two rows?