Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dorbi
dorbi
Explorer
Member since:
07-18-2022
01-05-2023
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 07-18-2022 |
Activity Feed
- Posted Re: delete events from specific time on Splunk Search. 12-29-2022 12:47 AM
- Karma Re: delete events from specific time for ITWhisperer. 12-29-2022 12:46 AM
- Karma Re: delete events from specific time for PickleRick. 12-29-2022 12:46 AM
- Posted delete events from specific time on Splunk Search. 12-28-2022 11:49 PM
- Karma Re: Where and how do I configure a sourcetype for generic xml? for richgalloway. 12-24-2022 11:31 PM
- Posted Re: Where and how do I configure a sourcetype for generic xml? on Getting Data In. 12-22-2022 01:28 AM
- Posted Re: Where and how do I configure a sourcetype for generic xml? on Getting Data In. 12-21-2022 02:38 AM
- Karma Re: Where and how do I configure a sourcetype for generic xml? for richgalloway. 12-21-2022 02:35 AM
- Posted Where and how do I configure a sourcetype for generic xml? on Getting Data In. 12-20-2022 07:11 AM
- Karma Re: Where can I find my sourcetype definitions? for kristian_kolb. 12-07-2022 11:12 PM
- Posted Re: Help with Splunk DB connect Rising search on All Apps and Add-ons. 09-19-2022 12:50 AM
- Posted Help with Splunk DB connect Rising search on All Apps and Add-ons. 09-11-2022 05:14 AM
- Posted Re: interplay multiple panels in a dashbaord on Dashboards & Visualizations. 07-18-2022 04:01 AM
- Posted How to interplay multiple panels in a dashboard? on Dashboards & Visualizations. 07-18-2022 02:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-29-2022
12:47 AM
I'm seeing by your comment that i misunderstood the "Where" command .. what a blunder. thanks for the explanation.
... View more
12-28-2022
11:49 PM
hey, im trying to delete events that got into the system on a specific time range. i see the events when i use splunk time range picker but when i try and use where to find those events without time picker i can't find them and im too scared to just run delete query without specifying exactly what i want to delete. iv'e also tried only one "where" clause with earliest and latest didn't worked too. what am i doing wrong?
... View more
Labels
- Labels:
-
other
12-22-2022
01:28 AM
is there a way to see how it will work before applying it ? so if it won't work as planned i won't have to delete all the data inserted? did you happen to check how it works on generic xml files or any sample from some place else?
... View more
12-21-2022
02:38 AM
Writing regex with Rex field =_raw.. Is a great solution but I would like to do it at source type level so I won't have to write long and complicated querys. I tried xmlkv and kv_mode = xml both doesn't extract fields with 2 or more levels of hierarchy so I'm missing a lot of fields. Any more suggestions please?
... View more
12-20-2022
07:11 AM
Hey there!
I'm trying to monitor(batch)) a folder congaing xml files,
the XML files don't necessarily have the same structure, also they have multiple hierarchy and the level of it might vary .
where and how do i configure a sourcetype the know's how to handle this kind of a case so i won't have to parse the data with rex on search time.
example for a file that may exists:
... View more
Labels
- Labels:
-
sourcetype
-
XML
09-19-2022
12:50 AM
The problem was with the data itself (heavy). Issues can be closed
... View more
09-11-2022
05:14 AM
i have this search:
SELECT
C_ID,
REPLACE(REPLACE(REPLACE(REPLACE(C_XML,'"',''''), CHAR(13), ''), CHAR(10), ''),' ','') as C_XML,
C_TENANT_ID,
C_MESSAGE_PRIORITY,
C_CREATED_DATE_TIME,
C_WAS_PROCESSED,
C_LOGICAL_ID
FROM "ElbitErrorHandlingDB"."dbo"."COR_INBOX_ENTRY"
WHERE C_CREATED_DATE_TIME > ?
ORDER BY C_CREATED_DATE_TIME ASC
and i want to add
and
clause to the where section.
for some reason it doesn't work.
i tried:
SELECT
C_ID,
REPLACE(REPLACE(REPLACE(REPLACE(C_XML,'"',''''), CHAR(13), ''), CHAR(10), ''),' ','') as C_XML,
C_TENANT_ID,
C_MESSAGE_PRIORITY,
C_CREATED_DATE_TIME,
C_WAS_PROCESSED,
C_LOGICAL_ID
FROM "ElbitErrorHandlingDB"."dbo"."COR_INBOX_ENTRY"
WHERE C_CREATED_DATE_TIME > ?
and C_CREATED_DATE_TIME > convert(varchar,'2022-08-31',121)
ORDER BY C_CREATED_DATE_TIME ASC
and i tried:
SELECT
C_ID,
REPLACE(REPLACE(REPLACE(REPLACE(C_XML,'"',''''), CHAR(13), ''), CHAR(10), ''),' ','') as C_XML,
C_TENANT_ID,
C_MESSAGE_PRIORITY,
C_CREATED_DATE_TIME,
C_WAS_PROCESSED,
C_LOGICAL_ID
FROM "ElbitErrorHandlingDB"."dbo"."COR_INBOX_ENTRY"
WHERE C_CREATED_DATE_TIME > convert(varchar,'2022-08-31',121)
AND C_CREATED_DATE_TIME > ?
ORDER BY C_CREATED_DATE_TIME ASC
both didn't worked.
any advice?
... View more
Labels
- Labels:
-
other
07-18-2022
04:01 AM
thanks for your reply! so just to ensure, there isn't a way to make an in-screen drill-down? is it must take me to another page? any way to make one chart affect another without opening a new page? (if they share the same data but different query)
... View more
07-18-2022
02:46 AM
Hello
i have 2 charts created with Splunk search
a. pie chart showing all failed tasks names in a system
b. line chart showing the amount of failed task names by day in the past 30 days.
i want to be able to connect those 2 charts so when i click on a name of a chart in the pie chart the line chart will show this task name highlighted.
is that an option? if yes then how do i do that?
thanks in advanced
... View more
Labels
- Labels:
-
chart
-
Dashboard Studio
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-05-2023
09:14 AM
|
