Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About thenormalone
thenormalone
Path Finder
Member since:
08-13-2019
05-09-2023
Community Statistics
| Posts | 32 |
| Solutions | 0 |
| Karma Given | 16 |
| Karma Received | 0 |
| Member Since | 08-13-2019 |
Activity Feed
- Karma Re: Append results to dropdown for yeahnah. 05-09-2023 06:02 AM
- Posted Re: Append results to dropdown on Splunk Search. 05-08-2023 02:11 PM
- Karma Re: Append results to dropdown for yeahnah. 05-08-2023 02:11 PM
- Posted How to append results to dropdown? on Splunk Search. 05-08-2023 01:37 PM
- Karma Re: dropdown value used in different ways for bowesmana. 09-22-2022 08:02 AM
- Posted Re: dropdown value used in different ways on Splunk Search. 09-22-2022 08:01 AM
- Tagged Re: dropdown value used in different ways on Splunk Search. 09-22-2022 08:01 AM
- Karma Re: dropdown value used in different ways for jdunlea. 09-21-2022 03:21 PM
- Posted Re: dropdown value used in different ways on Splunk Search. 09-21-2022 03:08 PM
- Posted How to use dropdown value in different ways? on Splunk Search. 09-21-2022 01:52 PM
- Karma Re: Use the result from the subsearch to a main search for isoutamo. 06-29-2021 02:43 PM
- Posted Re: Use the result from the subsearch to a main search on Splunk Search. 06-29-2021 01:16 PM
- Posted Use the result from the subsearch to a main search on Splunk Search. 06-29-2021 12:28 PM
- Karma Re: rename boolean value in a pie chart for yuanliu. 06-07-2021 12:57 PM
- Posted Re: rename boolean value in a pie chart on Splunk Search. 06-06-2021 09:00 AM
- Posted rename boolean value in a pie chart on Splunk Search. 06-04-2021 04:24 PM
- Posted Re: Extract fields from drop down option and use in search on Splunk Search. 04-28-2021 08:24 AM
- Karma Re: Extract fields from drop down option and use in search for richgalloway. 04-28-2021 08:24 AM
- Posted Extract fields from drop down option and use in search on Splunk Search. 04-28-2021 07:00 AM
- Posted Re: Combine two search queries to display count on Splunk Search. 03-17-2021 04:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-08-2023
02:11 PM
Thanks for the response. I should've mentioned that I have tried that and it works, I'm curious if there a way to append results without using another cvs file?
... View more
05-08-2023
01:37 PM
I have a dashboard that has a dropdown which takes in the values from a csv file. Is there a way I can add on to the results of the csv file without altering the csv file so that these two results show up in the dropdown?
<search> <query> | inputlookup domains.csv | fields display, domain | dedup domain </query> <earliest>-24h@h</earliest> <latest>now</latest> </search>
I need to add a couple more results to the dropdown that I'm currently extracting from the csv file.
Any help is appreciated!
... View more
09-22-2022
08:01 AM
Thanks for the suggestion! I was able to get it to run successfully using <change>
<eval token="modified_client">replace($value$, "[.|_]", "-")</eval>
<change>
... View more
- Tags:
- rk
09-21-2022
03:08 PM
I am trying to replace both the "." and the "_" with a "-" for domain2, thanks for the suggestion. So the default value for $selected_client$ is * which it is being assigned to domain 1 however search doesn't return anything because clientForIndexA still just maps to domain1 in my dashboard panel (clientForIndexA = domain1 OR clientForIndexB = host*domain2*prod)
| eval domain1 = "*"
| eval domain2 = if(domain1 == "*", "*", replace (domain1, "[\.|_]" , "-")) so how do I get the values of domain1 and domain2 to be used in the search query?
... View more
09-21-2022
01:52 PM
I have a dropdown whose value once input needs to be used in two different ways in the same search query. One of the indexes require that value to be as is but the other index requires the value to be altered.
I'm doing something like what ive mentioned below but that doesn't seem to be working. Any help is appreciated.
dropdown token value is selected_client with the initial value being "*"
(index = indexA OR index = indexB) AND (clientForIndexA = domain1 OR clientForIndexB = domain2)
| eval domain1 = if("$selected_client$" == "*", "*", "$selected_client$")
| eval domain2 = if(domain1 == "*", "*", replace (sync_ml_domain, "\." , "-"))
| eval domain2 = if(domain1 == "*", "*", replace (sync_ml_domain, "_" , "-"))
... View more
06-29-2021
01:16 PM
well if I'm not mistaken that gives me index=ind1 "correlation-id=<correlation_Id>" so it still isn't giving me that event which has the format "abc: <correlation_Id>"
... View more
06-29-2021
12:28 PM
In one of the search strings, I have an event from which i extract the correlation ids and in turn want to search through there correlation ids to get an event which has a text in from of the correlation id (eg: abc: <correlation_Id>. when I try index=ind1 [search sttring 1 | table correlationId], the log which has the string of "abc: <correlation_Id>" is not coming back. But if i search for one of the correlationIds from the table I get that event. I'm not sure what I'm doing wrong here. That event I'm trying to get has a string "abc" in front and I feel like that's causing the results to not come back.
... View more
Labels
- Labels:
-
field extraction
-
rex
-
subsearch
-
table
06-06-2021
09:00 AM
apologies but I should've mentioned that I tried that. After that if I do a stats command on it, the pie chart only shows one of the values
... View more
06-04-2021
04:24 PM
I have a boolean field which I get from the search, now when I do a stats count by boolean_field, the pie chart will show boolean_field=true and boolean_field=false. How do I rename these values to something custom/more meaningful?
... View more
04-28-2021
08:24 AM
I was able to get it by slightly altering the search | eval client=mvindex(split(domain,"."),1) Thanks!
... View more
04-28-2021
07:00 AM
I have a drop down in my dashboard which looks up a csv file having client information in one of the rows named domain and is of the form "<number>.<client_name>.<network>". Eg: s122.clientA.cmbs.com My drop down is configured as below <input type="dropdown" token="token" searchWhenChanged="true">
<label>Client</label>
<choice value="*">All</choice>
<initialValue>*</initialValue>
<fieldForLabel>display</fieldForLabel>
<fieldForValue>domain</fieldForValue>
<search>
<query>| inputlookup domains.csv</query>
<earliest>0</earliest>
<latest></latest>
</search>
<default>*</default>
</input> Then in my search, I'm just appending "... AND client=$domain$" but in this case the domain value will be client=s122.clientA.cmbs.com. How do I extract only the client name from the drop down and use that in the search instead? Eg: client=*clientA* should be appended to the search after extraction instead of the whole string (client=*s122.clientA.cmbs.com*)
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
03-17-2021
04:10 AM
so I have one of the searches which provides the timer information (which includes the timerName and Id) and the other search is just a string which contains id and type. I need to combine these two searches to produce count by timerName and type. I tried appending the 2 searches and doing a count but that did not help.
... View more
03-10-2021
02:53 PM
example from indexer 1: 172.22.83.162 - - [10/Jul/2018:14:46:42 +0000] "GET /tests/benefits HTTP/1.1" 200 337 "-" "Ruby" 0 example from indexer 2: 172.22.83.162 - - [10/Jul/2018:14:46:42,+0000] "GET /tests/benefits HTTP/1.1" 200 337 "-" "Ruby" 0 The timestamp has a comma instead of a space
... View more
03-10-2021
02:43 PM
I have http statuses that come in from 2 different indexes, with almost the same event but the event from one indexer has a combination of space and comma as a delimiter and other just has spaces. How do I split the event from the search string such that I get the status from both indexes. I have | rex field=_raw "^(?:[^\s]*\s){8}(?P<statusCode>\d+)" but this only check for space, I need to also include comma as a delimiter too
... View more
03-03-2021
03:28 PM
One of the search queries provides a TimerName and an ID as a field. Another search provides the TYPE of the ID as a field. I need to display the number of times the timerName gets called for the different type of these ids. How do I create a search which extracts the timerName and ID from the first search and the TYPE from the second search (using the ID from the first search) and displays the count of the TimerName called for the different TYPEs?
... View more
Labels
- Labels:
-
field extraction
-
stats
-
subsearch
03-03-2021
01:53 PM
@richgalloway so this is a result from one of the indexers from which I extract this dynamic field while another indexer already has the field in its search. So how do I go about combining them? I tried renaming the dynamic field (eg: "source") which I extract from the 1st indexer with the same name as the field from the search result of the other indexer (also named "source") but when I do "| stats count source", it shows up as two different results even though the name of the source is the same.
... View more
03-02-2021
09:49 AM
I have a field from the search query called source which has a pattern of "text:text:text:dynamicText:dynamicText:dynamicText" where text->hardcoded values and dynamicText->keeps changing for different logs. I want to extract the 2nd dynamic text as its own field and then perform a stats count on that field. I'm not able to figure out how to navigate over the 1st dynamic field using regular expressions
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
03-02-2021
09:32 AM
Those work, thank you! 🙂
... View more
02-23-2021
02:57 PM
I found this to remove the trailing "_" but I still haven't figured out how to merge the two results from the different indexes into one
... View more
02-23-2021
02:41 PM
I have 2 splunk indexes from which I need to gather data from, so I have a simple splunk search (that queries for different timers) which retuns the different timer names used in our service but one of the indexes returns the same timer name with a trailing "_". Eg: timerName=ABC.transaction_ How can I remove the trailing "_" from the timerName from the results obtained so that when I perform the stats command, it doesn't show the trailing "_"? Also, how can I merge the results from the 2 indexes into one? Any help is appreciated, thanks!
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
-
stats
06-10-2020
07:39 PM
@dmarling I tried your suggestion but it still keeps displaying data for all the 7 days. Both my saved searches retrieves all the fields ( | fields *) if that matters .
... View more
06-10-2020
09:19 AM
I have 2 saved searches (non-transforming) on my dashboard and those are set to run every morning collecting data for the last 7 days . I have a global time picker on my dashboard and I was under the assumption that any time range (eg: last 2 days) within the time range of the saved search (last 7days) would yield results but it looks like I always get back the data for the last 7 days.
<form>
<label>Test1</label>
<search id="query1" ref="query_01">
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<search id="query2" ref="query_02">
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time_token" searchWhenChanged="true">
<label></label>
<default>
<earliest>-7d@d</earliest>
<latest>@d</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<title>Count by Resource</title>
<search base="query2">
<query>| timechart count by timerName limit=0 | fields - NULL</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Day</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="height">319</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
<panel>
<single>
<title>Count</title>
<search base="query02">
<query>| search "x=null" | stats count</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
</form>
I'm not sure what I'm doing wrong, any help is appreciated. Thanks!
... View more
Labels
- Labels:
-
saved search
01-28-2020
09:11 AM
I made the change to just do
count(eval(searchmatch("processedObject"))) as Sign by user
since my search already includes ("processedObject=" AND "failure=null") and this worked!
... View more
01-28-2020
08:30 AM
This works too but for Event5,
processedObject=processedObject[attribute1=ID, attribute2=VERSION, attribute3=TYPE1, attribute4=TYPE2, failure=null]
this is the log I'm trying to get a count of: So I specifically need failure=null in this log, that's why I'm trying ("processedObject=" AND "failure=null"). Reading up on searchmatch, I think it takes in a boolean argument. so I'm not sure how to go about fixing this.
... View more
