Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About zhanweiw
zhanweiw
Explorer
Member since:
03-24-2021
11-16-2021
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-24-2021 |
Activity Feed
- Posted Re: How to loop through the record to get the diff between them on Splunk Search. 11-16-2021 12:34 AM
- Posted Re: How to loop through the record to get the diff between them on Splunk Search. 11-16-2021 12:07 AM
- Posted Re: How to loop through the record to get the diff between them on Splunk Search. 11-15-2021 11:26 PM
- Posted How to loop through the record to get the diff between them on Splunk Search. 11-15-2021 05:36 PM
- Posted Re: How to filter the search with the following record on Splunk Search. 03-25-2021 04:54 PM
- Posted Re: How to filter the search with the following record on Splunk Search. 03-25-2021 01:04 AM
- Posted How to filter the search with the following record on Splunk Search. 03-24-2021 06:36 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
11-16-2021
12:34 AM
Hi ITWhisperer, Not sure why after I copy again and paste it to the search engine. It is working as expected. Thank for your help 🙂
... View more
11-16-2021
12:07 AM
Hi ITWhisperer, Thanks for your respond but not sure why the result is empty after I run it. Can you help to confirm?
... View more
11-15-2021
11:26 PM
Thanks for pointing out, I have updated the post. You seem to be comparing the first event in version 1.1 with the first event in version 1.2, and the second event in version 1.1 with the second event in version 1.2, and so on. Is this correct? Ya, I am comparing version 1.2 against 1.1 then 1.3 against 1.2. Is there some other way to identify which events should be compared against each other? No other way. Not sure is it possible to use mvindex to get list of uniq version then do zipping like below and compare against each other. [(1.2, 1.1) (1.3, 1.2)]
... View more
11-15-2021
05:36 PM
Hi there, I am trying to diff the new version against the one version older record and extract the diff from them. For example, ver 1.3 against 1.2 and ver 1.2 against 1.1 to only extract the diff between them. I hope to do it in a flexible ways as in future I may have ver 1.4 and so on... I also want to limit the results to only latest 5 version diff. For example, I got 1.1, 1.2, ..., 1.10 version, but I only want the result for 1.6, 1.7, ..., 1.10 when diff against the previous one version. Is that possible? Currently I have data like this: records: ============================================ index=a, ver=1.1, a="halo", b="haha", c="nana" index=a, ver=1.1, a="testing", b="haha", c="nana" index=a, ver=1.1, a="halo", b="kaka", c="testing" index=a, ver=1.2, a="halo", b="haha", c="nana" index=a, ver=1.2, a="lala", b="haha", c="nana" index=a, ver=1.2, a="halo", b="kaka", c="TESTING" index=a, ver=1.3, a="halo", b="haha", c="nana" index=a, ver=1.3, a="lala", b="haha", c="tata" index=a, ver=1.3, a="halo", b="kaka", c="lala" index=a, ver=1.3, a="halo", b="kaka", c="kakaka" ============================================ Result expected when comparing ver 1.2 against 1.1 and ver1.3 against 1.2: ver added record (merging a b c using ",") removed record (merging a b c using ",") 1.2 lala,haha,nana halo,kaka,TESTING testing,haha,nana halo,kaka,testing 1.3 lala,haha,tata halo,kaka,lala halo,kaka,kakaka lala,haha,nana halo,kaka,TESTING
... View more
Labels
- Labels:
-
other
03-25-2021
04:54 PM
Hi Bowesmana, I understood now. Thank you for your help. The last two lines are what I needed: | stats values(ver) as ver by index a b c | where ver="1.1" AND mvcount(ver) = 1
... View more
03-25-2021
01:04 AM
Hi bowesmana, thank you for your answer, it works as expected. However, I have pushed these records to Splunk database. If I want to get the data from Splunk database and produce the same result, what query should I form?
... View more
03-24-2021
06:36 PM
Hi there, Can I know how to get the record from ver 1.1 by case sensitive excluding record from ver 1.2? Currently I have data like this: records: ============================================ index=a, ver=1.1, a="halo", b="haha", c="nana" index=a, ver=1.1, a="testing", b="haha", c="nana" index=a, ver=1.1, a="halo", b="kaka", c="testing" index=a, ver=1.2, a="halo", b="haha", c="nana" index=a, ver=1.2, a="lala", b="haha", c="nana" index=a, ver=1.2, a="halo", b="kaka", c="TESTING" ============================================ Result expected: index=a, ver=1.1, a="testing", b="haha", c="nana" index=a, ver=1.1, a="halo", b="kaka", c="testing" Is that possible to be done?
... View more
Labels
- Labels:
-
subsearch
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-16-2021
08:27 AM
|
