About 373782073

373782073 · ‎01-21-2020

That worked great. Thanks a lot

373782073 · ‎01-20-2020

Hi, I've got a search that provides a table of 60 filenames. 30 filenames with a -3 days from today's date and 30 filenames with a -2 days from today's date. Everytime the search will run it is expected to result in 60 events with 60 filenames found containing 2 separate dates within their names. Search output: Filename filename1-2020-01-21 filename2-2020-01-21 ... filename30-2020-01-21 filename1-2020-01-22 filename2-2020-01-22 filename3-2020-01-22 ... filename30-2020-01-22 How can I modify my table so that a second column with the total number of files is also created with the first field having the total =30 for all files from -3days and 30 files with -2days? Also is there a way a way to setup a third column that will say INVALID if the filename doesnt contain either -3days date or -2days date? Example NOT 2020-01-22 or 2020-01-21? Expected Search output: Filename Total Valid filename1-2020-01-21 30 VALID filename2-2020-01-21 " ... " filename30-2020-01-21 " filename1-2020-01-18 1 INVALID filename1-2020-01-22 VALID filename2-2020-01-22 " filename3-2020-01-22 " ... " filename30-2020-01-22 " Thanks

373782073 · ‎01-13-2020

That's awesome, it works perfectly, now I just need to tweak it turn run on my search and extracted fields!

373782073 · ‎01-12-2020

Thanks that is roughly what I want to achieve but I have the problem that my search finds 30 files dated with -3 days dates and the exact same 30 files dated -2 days from the present date, this being due to daily backups across 30 hosts being kept for -3days and -2days.... The response above provides a single row compounded result for all files. To explain this better I am seeing this from my search: filename size(bytes) abc-1986-01-08-16:00:43-level1.tar 1000 def-1986-01-08-16:00:43-level1.tar 700 abc-1986-01-09-16:00:43-level1.tar 1200 def-1986-01-09-16:00:43-level1.tar 800 ...x 30 instances of separate files dates with both -3days and 30 files with -2days the command provided does a count and % increase computation of all disregarding that different files and their sizes are being used in the percentage increase computation. I am after a per file % increase difference in size for the same file name from the previous date. Would you know how to separate individual files size increases per file names across all 30 files and list them per row? Eg: filename size(bytes) Increase-from-previous-date(%) abc-1986-01-08-16:00:43-level1.tar 1000 0 abc-1986-01-09-16:00:43-level1.tar 1200 20 def-1986-01-08-16:00:43-level1.tar 700 0 def-1986-01-09-16:00:43-level1.tar 800 14 thanks

373782073 · ‎01-08-2020

Hi, Apologies for the unclear title. I could not think of a logical description for the problem statement. I have created a table from a search with two columns being filename and size(bytes) filename size(bytes) abc-1986-01-08-16:00:43-level1.tar 1000 abc-1986-01-09-16:00:43-level1.tar 1200 The filename field results have dates embedded (shown as examples 1986-01-08 and 1986-01-09 above). I'd like to create a separate column that will show the percentage difference in size for the same file name (but with different dates). Example: filename size(bytes) Increase-from-previous-date(%) abc-1986-01-08-16:00:43-level1.tar 1000 0 abc-1986-01-09-16:00:43-level1.tar 1200 20 Note: The table results only contains files with 2 dates n and n-1 ( n = today -1 day) Thanks in advance

373782073 · ‎01-08-2020

Great. I was able to add the rex statement to my existing search and strip the info I wanted into separate fields. Thanks a lot!

373782073 · ‎01-08-2020

Yes this is the field extracted which has the date embedded

373782073 · ‎01-08-2020

Hi, I have incoming syslog events for which I've used the Field Extraction wizard in SPLUNK to separate a the filename of the events which results in the field values look like this: abc-servicen.City-backup-1986-01-08-16:00:43-level1.tar I would like to eventually extract and tabulate the filename (I've called it bkp_filename when I extracted this field earlier) as well as the date YYYY-MM-DD for each filename in a separate field (call it bkp_file_date). Can anyone suggest how to use regex or an in-built function to achieve the date extraction into a separate field or column? Thanks

373782073 · ‎11-04-2019

That did the trick. Not sure why I steered into looking at inputlookup. Would you have any examples on applying inputlookup ?

373782073 · ‎11-04-2019

Hi, I am trying to use an inputlookup to enrich my search results table with additional fields from my inputlookup csv. The scenario is that I am using a search to look for hostnames from events to match my CSV Device Name field and add the model number from my CSV also. I plan to add several more fields from my CSV but model field values is a start. I have tried to run the inputlookup sub-search but struggling to associate fields that are named differently between my search results and my CSV column titles. Many thanks

373782073 · ‎07-23-2019

I found that the following worked. | eval ValueY=case( match(Status, "StringValue_A") AND Priority == "StringValue_B", "StringValue_C") | table Status Priority ValueY thanks anyway

373782073 · ‎07-23-2019

Hi all I am trying to use the eval case function to populate a new field based on the values of 2 existing fields that meet certain string value matching. For example: | eval ValueY=case(Status == StringValue_A) AND (Priority == StringValue_B)), "StringValue_C") | table Status Priority ValueY So as you can see the above is not working and was wondering if anyone has tried to do something similar so that the exact combination of StringValueA and StringValue_B can be used to define if StringValue_C is used to populate a third column on a table. Hope it makes sense Many thanks

Posts	12
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎07-23-2019

Online Status	Offline
Date Last Visited	‎09-02-2021 12:20 AM

Sum of total files with same date

Working out % change of field value based on event...

Using regex on Extracted field

Using inputlookup to enrich results table with a c...

How to use conditional comparison of two field val...

Re: Sum of total files with same date

Sum of total files with same date

Re: Working out % change of field value based on e...

Re: Working out % change of field value based on e...

Working out % change of field value based on event...

Re: Using regex on Extracted field

Re: Using regex on Extracted field

Using regex on Extracted field

Re: Using inputlookup to enrich results table with...

Using inputlookup to enrich results table with a c...

Re: How to use conditional comparison of two field...

How to use conditional comparison of two field val...