Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About eranhauser
eranhauser
Path Finder
Member since:
12-30-2021
03-22-2024
Community Statistics
| Posts | 30 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 12-30-2021 |
Activity Feed
- Posted Re: extract only xml part from an event on Splunk Search. 03-22-2024 11:35 AM
- Posted Re: extract only xml part from an event on Splunk Search. 03-22-2024 09:06 AM
- Posted extract only xml part from an event on Splunk Search. 03-22-2024 06:45 AM
- Tagged extract only xml part from an event on Splunk Search. 03-22-2024 06:45 AM
- Posted Re: assign value from another eval param on Splunk Search. 10-10-2023 12:46 PM
- Posted Re: assign value from another eval param on Splunk Search. 10-10-2023 12:14 PM
- Posted assign value from another eval param on Splunk Search. 10-10-2023 12:07 PM
- Got Karma for Re: assign value to earliest. 10-06-2023 07:35 PM
- Posted Re: assign value to earliest on Splunk Search. 10-06-2023 06:27 PM
- Posted Re: assign value to earliest on Splunk Search. 10-06-2023 02:21 PM
- Posted Re: assign value to earliest on Splunk Search. 10-06-2023 01:38 PM
- Posted assign value to earliest on Splunk Search. 10-06-2023 12:12 PM
- Tagged assign value to earliest on Splunk Search. 10-06-2023 12:12 PM
- Posted Re: Splunk UI query start and end time on Splunk Search. 10-05-2023 05:04 PM
- Posted Re: Splunk UI query start and end time on Splunk Search. 10-05-2023 04:13 PM
- Posted Splunk UI query start and end time on Splunk Search. 10-05-2023 02:14 PM
- Posted Re: How to convert json events results into one json event? on Splunk Search. 10-05-2023 01:24 PM
- Posted How to convert json events results into one json event? on Splunk Search. 10-04-2023 08:58 AM
- Posted Re: change events only on Splunk Search. 09-27-2023 06:25 PM
- Posted Re: change events only on Splunk Search. 09-27-2023 03:50 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-22-2024
11:35 AM
it loos like this is the first line this is the second line <!DOCTYPE....> ......... the rest of the xml is here this is the third line <!DOCTYPE...> .......rest of the xml is here this is the fourth line this is the fifth line
... View more
03-22-2024
09:06 AM
I am trying to get values from xml part of an event. The event starts with few lines than it has xml part, after that few more lines and another xml part. I want to extract at first only the parts of the event that are in xml format.
... View more
03-22-2024
06:45 AM
Hi, my event has unstructured data i.e. few strings than xml part than few more strings and another xml follow by few more strings. How do I extract only the xml parts from the event when there is no pattern to the string i.e. number of lines before and after the xml nor the string content has a pattern.
... View more
- Tags:
- xml extraction
Labels
- Labels:
-
other
10-10-2023
12:46 PM
Unfortunately it does not work. using sub search will change the query source value but not the collect one
... View more
10-10-2023
12:14 PM
I edited my question. That works in two eval parameters but not on the source parameter in the | collect
... View more
10-10-2023
12:07 PM
How to assign the value of param name original to the source in the | collect statement index=123 | eval original=abcd, | collect index=qaz source=original
... View more
Labels
- Labels:
-
other
10-06-2023
06:27 PM
1 Karma
Below is the query one should use:
[| makeresults
| eval earliest=(floor(now()/600))*600-600,
latest=(floor(now()/600))*600
]
| search index=test ....
because the sub search is being executed first the query becomes:
earliest=1234 latest=5678 index=test ...
if one tries to rename earliest or latest with a different names (like my_early_time, my_latest_time) there will be no result as the query will be:
my_early_time=1234 my_latest_time=5678 index=test ...
... View more
10-06-2023
02:21 PM
Thank you. Putting the earliest and latest in the subserch worked
... View more
10-06-2023
01:38 PM
We think alike. I tried that before and although I got no error I also got no result
... View more
10-06-2023
12:12 PM
How I can assign a value to the earliest argument in my query which is the rounded to the last 10 minutes? when I try index=aaa earliest=((floor(now()/600))*600 I get an error that ((floor(now()/600))*600 is an invalid term
... View more
- Tags:
- search
Labels
- Labels:
-
other
10-05-2023
04:13 PM
I am going to run my query using a scheduler so I want to record in each event the time span the query used to capture that event
... View more
10-05-2023
02:14 PM
How can one add to the result of a Splunk query running on Splunk UI the time span i.e. the values one can put in earliest_time and latest_time (the earliest and latest time are coming only from the drop down of the time span in Splunk UI)
... View more
Labels
- Labels:
-
other
10-05-2023
01:24 PM
Thank you. The first solution is exactly what I wanted to achieve
... View more
10-04-2023
08:58 AM
My query returns many events, each event is in a form of a json i.e. { "key1": "val1", "key2":"val2"} I would like to convert all events to one event that contains all the original events using sha256 of the original event as the key so the new json file will look like: {
sha256a: { "key1": "val1", "key2":"val2"}, sha256b: { "key1": "val1a", "key2":"val2a"},
}
where sha256a is from | eval sha256a=sha256({ "key1": "val1", "key2":"val2"})
... View more
Labels
- Labels:
-
other
09-27-2023
06:25 PM
There should be something similar to SQL in splunk like right outer joint no?
... View more
09-27-2023
03:50 PM
a change event is considered if any combination of key1, key2 & key3 is new. In your example key1=A, key2=B,key3=D will be considered as a new event.
... View more
09-27-2023
02:08 PM
I have events with the following keys: key1, key2 & key3.
I would like to get the change events i.e. events that their key1, key2 & key3 values are not in the events of previous day.
What should the query look like?
... View more
- Tags:
- eventstats
Labels
- Labels:
-
join
09-22-2023
06:48 AM
Is there away to point to an existing event in Splunk using a URI link like https://mysplunk.mycompany.com/....
... View more
- Tags:
- splunk search
Labels
- Labels:
-
other
01-19-2022
05:11 PM
I am passing a unix date as the latest value and I would like to to set the earliest always to be 4,000 second less
... View more
01-19-2022
01:02 PM
I am trying to assign a value to a parameter in a macro that is based on a calculation of a value being sent to the macro but I do not get the expected result. index=my_index ... earliest=exact($time$-4000) latest=$time$... How can I assign the earliest value which suppose to be 4,000 seconds less than the value $time$ ?
... View more
Labels
- Labels:
-
other
01-18-2022
12:02 PM
eval empID=trim(`my_macro(EMP_SRC_IP, SESSION_START_TIME)`)
... View more
01-18-2022
11:17 AM
The query works great if I pass to the macro values and not params: trim(`my_macro("8.8.8.8", 1642031990)`) but once try to use params I get the errors
... View more
01-18-2022
11:11 AM
After removing the $ I get the following error: Invalid value "SESSION_START_TIME" for time term 'latest'
... View more
01-18-2022
10:58 AM
My query looks like: ... | stats min(_time) AS SESSION_START_TIME max(Source_Network_Address) AS EMP_SRC_IP ... | eval empID=trim(`my_macro($EMP_SRC_IP$, $SESSION_START_TIME$)`)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-22-2024
04:13 PM
|
