Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Splunk Answers
- :
- About xoamanda12xo
xoamanda12xo
Explorer
Member since:
08-20-2021
06-22-2022
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 08-20-2021 |
Activity Feed
- Posted How to get rid of everything in parentheses on the right hand of a string value? on Splunk Search. 06-09-2022 11:06 AM
- Karma Re: How to extract multiple values from a single value in a field for shivanshu1593. 06-07-2022 03:16 PM
- Posted Re: How to extract multiple values from a single value in a field on Splunk Search. 05-26-2022 01:05 PM
- Karma Re: How to extract multiple values from a single value in a field for richgalloway. 05-26-2022 01:03 PM
- Karma Re: How to extract multiple values from a single value in a field? for shivanshu1593. 05-26-2022 01:03 PM
- Posted How to extract multiple values from a single value in a field? on Splunk Search. 05-25-2022 11:54 AM
- Posted How to create a dashboard with inputs and already written search queries? on Other Usage. 10-07-2021 06:01 PM
- Posted Re: Subtracting two timestamps returning incorrect difference? on Getting Data In. 08-20-2021 12:05 PM
- Posted Subtracting two timestamps returning incorrect difference? on Getting Data In. 08-20-2021 11:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-09-2022
11:06 AM
Basically my data is formatted as a message and then info in parentheses on the right. Example: " LL - VPN Activity (list) (monitor)" " LL - Assess (iCloud) Storage (not conf) (approve)" etc. What I want to do is for every message, get rid of the contextual info on the right hand side. So in these cases, it would become: "LL - VPN Activity" "LL - Assess (iCloud) Storage" Any ideas?
... View more
05-26-2022
01:05 PM
Thanks, this helped alot. Do you know how to extract a sentence? For example if the risk type was Type - Monitor User Activity Type - USB I would want a value with: "Type - Monitor User Activity" and "Type - USB". This solution only gives me "Type - Monitor" in this scenario
... View more
05-25-2022
11:54 AM
I have a field called "Risk Type" that has categorical data associated with the type of risk of an event. For example, for one event it might say "Type - Network", but for another event that has more than one risk type it will say "Type - Network Type - USB Type - Data" where the three risk types are in a single value. What I want to do is to extract each type as a separate value, so for event X there would be three entries for each type. Ex: Event X Type - Network
Event X Type - USB
Event X Type - Data
I tried doing mvexpand but this did not separate each type into multiple values. I also thought of using the rex command but I do not know what the regular expression would be to do this. How do I accomplish this?
... View more
10-07-2021
06:01 PM
I am new to splunk and I am a bit lost reading the documentation for how to create a dashboard and implement inputs to prompt the user for values to use in searches. The data I have is a series of prices that I am comparing against an average price for a certain time period (example 30 days). My goal is to create a dashboard that allows the user to enter a value that will be used in my search in an equation that increases some values to go over this threshold and some to go below. I already have this query written out. I am not sure how to proceed with creating the dashboard and inputs and then incorporating my already written query. Do I need to make this a saved search? Please help thank you!
... View more
Labels
- Labels:
-
data model
-
other
-
saved search
08-20-2021
12:05 PM
That didn't return any results for me 😞
... View more
08-20-2021
11:15 AM
I am using the splunk field: _time and subtracting my own time field: open_date from the time field. The goal is to get the difference between these two time stamps. For example, one entry in the _time field is: "2021-03-11 11:17:13" and one entry in the open_date field is: "2021-06-07T14:50:42". I am running the current query operations: | eval difference = abs(_time - strptime(open_date, "%Y-%m-%dT%H:%M:%S")) | eval difference = strftime(difference,"%Y-%m-%dT%H:%M:%S") When running this for the above example entries I get a difference output of "1970-03-29T20:10:19", which is obviously incorrect. What am I doing wrong and how can I get the correct difference between these two fields?
... View more
Labels
- Labels:
-
field extraction
-
Mac
-
other
-
sourcetype
-
Windows
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-22-2022
07:07 PM
|
