cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
philh
Explorer
Member since: ‎11-22-2021
‎06-24-2023
Community Statistics
Posts 4
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎11-22-2021
Activity Feed
View All

Re: How can I resolve Return 0 for "No Results Fou...

by in Splunk Search
‎06-06-2023 12:48 PM
‎06-06-2023 12:48 PM
@diogofgm This works great thank you! ... View more

How can I resolve return 0 for "No Results Found"?

by in Splunk Search
‎06-05-2023 02:01 PM
‎06-05-2023 02:01 PM
Hi, I have a query where I'm extrapolating type based on a conditional then counting by type. This works great when there are events for both cases, but I'd also like to show a value of 0 for a given type when there aren't any events for that type. I've seen some other posts using fillnull and appendpipe but those examples haven't worked for my use case. Any help would be appreciated!   | eval type=if(user_action="place_order", "AddInOrdersPlaced", "AddInForwardedOrders") | convert timeformat="%Y-%m-%d" ctime(_time) AS date | chart count over date by type     ... View more
Labels

Re: Use of Summary Indexing for Long Term Data fro...

by in Knowledge Management
‎11-22-2021 08:50 AM
‎11-22-2021 08:50 AM
Thanks for the reply. I can't extend the retention period for the index since it is the established company retention length. But you're saying I can extract that partial data and hold it in the summary index without it being overwritten, correct?  For example, I'd have the summary index run on the original index once every 30 days so it can grab all the partial data before it is removed. So after 2 runs, my summary index would have 60 days of partial data.  Is this logic correct? ... View more

Use of Summary Indexing for Long Term Data from Ro...

by in Knowledge Management
‎11-22-2021 07:35 AM
‎11-22-2021 07:35 AM
Hi all, I have the following problem set: I have an index that rolls out data every 30 days (ie data older than 30 days is removed). There is a subset of data from this index that I would like to query for a longer period of time, say 12 or 24 months.  I'm fairly new to the idea of summary indexes, but it sounds like the logical solution. However, I'm concerned about losing previous data (that's been removed from the original index) each time the summary index is scheduled to run. Is there a way for a summary index to store the data from old runs so I can build a dataset that encompasses multiple months from the original index?    Thanks in advance! ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-24-2023 03:37 AM
Karma given to
View All