About supriyagaw08

supriyagaw08 · ‎01-04-2021

Any help on this will be appreciated, thanks.

supriyagaw08 · ‎12-24-2020

Hi All, I am trying to add dropdown on workname but output always comes as no records found although that workname is present in the dashboard output. Below is my code: $Env$ sourcetype = s $field2$$input$ | table XMIT_NM,USER_NM,WORK_ID,FILE_NM,FILE_ID | join [ search $Env$ sourcetype=b | table WORK_ID WORK_NM ] | table XMIT_NM,USER_NM,WORK_NM,FILE_NM,FILE_ID Below is my XML: <input type="dropdown" token="field2" searchWhenChanged="true"> <label>Search</label> <choice value=""*"">Any</choice> <choice value="USER_NM">username</choice> <choice value="WORK_NM">Work name</choice> <default>"*"</default> <initialValue>"*"</initialValue> I have tried <choice value="WORK_NM=">Work name</choice> and <choice value=""WORK_NM"">Work name</choice> as well but its not working but search using USER_NM is working fine, please suggest is it due to WORK_NM is output from join command and hence it cannot be used or any other ways to make this work.

supriyagaw08 · ‎12-15-2020

Hi @nickhills thanks for your help the issue was with search 2 it was not giving complete search I was looking for , fixed that and issue was resolved.

supriyagaw08 · ‎12-11-2020

@nickhills user_nm is correct common field between 2 search, also yes in output of second search USER_NM and USER_ID are in same row

supriyagaw08 · ‎12-11-2020

HI @nickhills thanks for the reply but i used this and its showing the fileds USER_ID indicator as blanks even i remove dedup. The output from my search 1 is Date| A_USER_NM| FILE_ID FILE_NM |filecount and output 2 has many fields from which i want only USER_ID and indicator. Both search has common index but different search reports

supriyagaw08 · ‎12-11-2020

Hello all, I want to join 2 search based upon one common filed from both the search , index=14 search_name="Daily Counts" |rename A_USER_NM as USER_NM|table Date USER_NM FILE_ID FILE_NM filecount| join USER_NM [ search index=14 earliest=-24h@h latest=now sourcetype=user source=O 001 | dedup USER_NM | table USER_NM USER_ID indicator ] I tried above search its working but its not displaying all results, few records are getting missed, let me know where am I making mistake or any other method that i can use.

supriyagaw08 · ‎12-11-2020

Thanks for your help @ITWhisperer i got why the count was always coming as 1.

supriyagaw08 · ‎12-09-2020

I want to sum the output that is stored in summary index and display the output in dashboard which shows sum of all counts for one week. Below is the code i am using but the output comes as the previous day output stored in summary index: index=*1 search_name="Daily File Transfer Counts" | dedup BASE_FILE_ID |table Date USER_NM BASE_FILE_ID FILE_NM File_Count_By_Day | bin _time as week span=7d | stats sum(File_Count_By_Day) as oneweek by XMIT_AUTH_USER_NM,XMIT_BASE_FILE_ID,XMIT_BASE_FILE_NM | eval week=strftime(_time,"%Y - %U") My code in Daily File Transfer Counts is as below: index=*1 sourcetype=s source="p" "File Catalog" "Completed" | dedup FILE_ID | eval Date=strftime(_time, "%b/%d/%Y ") | stats count(FILE_ID) as "File_Count_By_Day" by Date,XMIT_AUTH_USER_NM,XMIT_BASE_FILE_ID,XMIT_BASE_FILE_NM I am looking to count all the file that was transfers within a week for particular file(sum of File_Count_By_Day within a week)

supriyagaw08 · ‎11-23-2020

I have file transfers events , I have got the first part of code but filtering it and displaying it based upon the count of file transfers in one day, one week and one month is where i am facing issue. |bucket span=1mon _time | eval day=strftime(_time,"%Y-%m-%d") | eval week=strftime(_time, "%V") | eval w_month=strftime(_time, "%d/%m") |stats count(BASE_filename) as oneday by day | stats count(BASE_filename) as oneweek by week|stats count(BASE_filename) as onemonth by w_month

supriyagaw08 · ‎11-23-2020

how to count the number of file transferred within one month by an user id using particular file and display events in below manner: username filename count_of_files_tras_in1day count_of_files_trasferred_in_1week count_of_files_trasferred_in_1mon

Posts	10
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎11-23-2020

Online Status	Offline
Date Last Visited	‎01-04-2021 06:48 AM

Dropdown and input options on output which is obta...

How to join 2 search

Sum function on output of summary index

How to count the number of file transferred within...

Re: Dropdown and input options on output which is ...

Dropdown and input options on output which is obta...

Re: How to join 2 search

Re: How to join 2 search

Re: How to join 2 search

How to join 2 search

Re: Sum function on output of summary index

Sum function on output of summary index

Re: how to count the number of file transferred wi...

How to count the number of file transferred within...