Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About directtv999
directtv999
Loves-to-Learn Lots
Member since:
11-14-2022
02-03-2023
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-14-2022 |
Activity Feed
- Posted Re: How to find data which does not exist in index1 when compare to index2? on Splunk Search. 02-03-2023 06:25 AM
- Posted Re: How to find data which does not exist in index1 when compare to index2? on Splunk Search. 02-02-2023 07:46 PM
- Posted Re: How to find data which does not exist in index1 when compare to index2? on Splunk Search. 02-01-2023 12:32 PM
- Posted How to find data which does not exist in index1 when compare to index2? on Splunk Search. 02-01-2023 12:01 PM
- Tagged How to find data which does not exist in index1 when compare to index2? on Splunk Search. 02-01-2023 12:01 PM
- Posted Re: How to extract dynamic key from nested json? on Splunk Search. 11-15-2022 11:29 AM
- Posted Re: How to extract dynamic key from nested json? on Splunk Search. 11-15-2022 11:28 AM
- Posted Re: How to extract dynamic key from nested json? on Splunk Search. 11-14-2022 10:20 AM
- Tagged How to extract dynamic key from nested json? on Splunk Search. 11-14-2022 06:55 AM
- Posted Re: How to compare two different tables in two different indexes and show unique values? on Reporting. 11-14-2022 06:46 AM
- Posted How to extract dynamic key from nested json? on Splunk Search. 11-14-2022 05:58 AM
- Posted How to compare two different tables in two different indexes and show unique values? on Reporting. 11-14-2022 05:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
02-03-2023
06:25 AM
yes its value of the field how to print the values only exist in index1 just do table indices? its not giving any output
... View more
02-02-2023
07:46 PM
when compared field1 with field2, I need data of field1 which does not exist in field2.
... View more
02-01-2023
12:32 PM
I wrote this query but not working as expected index=index1 OR index=index2 | eval index=if(index=="index1",1,2) | stats values(field1) as field1 by field2, index | join type=left field1 [search index=index1 OR index=index2 | stats values(field2) as field2 by field1, index] | eval missing=if(isnull(field2), field1, "") | search missing!="" | table field1 field2 index missing
... View more
02-01-2023
12:01 PM
I want to compare two index index1 and index2 and print values where index1 values does not exists in index2
fro ex:
Index1. index2
field1. field2
1 1
2 3
3 4
output
2
... View more
- Tags:
- query
Labels
- Labels:
-
search job inspector
11-15-2022
11:29 AM
Appreciate your response @yuanliu will try to be more clear from next time. I tried your query and I can see the missing clusters working as expected and listing all the clusters for each event. I want only unique values from all events for ex below table I tried dedup but no luck cluster xyz1 xyz2 xyz3 xyz4 your query is giving below output cluster xyz1 xyz2 xyz3 xyz2 xyz3 xyz4 xyz1 xyz2 xyz4 xyz1
... View more
11-15-2022
11:28 AM
Thanks for the reply @ITWhisperer I need cluster names in a table not hosts cluster xyz1 xyz2 xyz3
... View more
11-14-2022
06:46 AM
Thanks for the reply @gcusello , I didn't get the desired output it is displaying whole fields from table2 in table3 so here is table1 coming from a dynamic nested json and am using below query to extract it before your eval and stats query foreach hosts.*.table1 [| eval cluster=isnotnull('<<FIELD>>'),'<<FIELD>>,table1)]
... View more
11-14-2022
05:58 AM
sample json:
Hosts: { [-] Nodepool1: { [-] Cluster: xyz1 Accountid: idxyz Nodepool3: { [-] Cluster: xyz1 Accountid: idxyz Nodepool5: { [-] Cluster: xyz1 Accountid: idxyz
am trying below query but it display list of servers but missing few servers randomly, please correct the query if am missing something.
index=index1 | eval cluster="" | foreach hosts.*.cluster [| eval cluster=isnotnull('<<FIELD>>'),'<<FIELD>>,cluster)] | table cluster
... View more
- Tags:
- query
Labels
- Labels:
-
other
11-14-2022
05:47 AM
index A has table1 and Index B has table2
table1 table2. table3
aaa. zzz. aaa
bbb. aaa. bbb
ccc. ccc
ddd ddd
I want do output new table with values doesn't exist when compare with table1 with table2
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-03-2023
11:06 PM
|
