jonuwz
5,015
karma
|gentimes increment=7d start=-366|eval m=strftime(starttime,"%B") |stats values(m) as m|map search="|gentimes start=-1 |eval j=\"602152000422A11A31751272000B11B31051121911041000751011741041272\" |fields j|rex field=j max_match=0 (?<j>.)|mvexpand j|eval j=tonumber(j,16) |stats list(j) as j|eval j=mvjoin(j,\",\")|rex max_match=0 field=j \"(?<j>\d+,\d+,\d+),*\" |mvexpand j|eval m=$m$|makemv m"|rex field=j "(?<x>\d+),(?<y>\d+),(?<z>\d+)" |eval s=substr(mvindex(m,x),y,z)|eval s=if(len(s)>0,s," ") |rex mode=sed field=s "s/i/k/"|stats list(s) as s|eval s=mvjoin(s,"")
0 Apps
Built something useful with Splunk? Want to share it?
Why not package it into an app and upload it?
Uploads don't have to be complex. Even one useful script, saved search, or view can help others in the Splunk Community!
5 Questions
2
votes
1
answer
229
views
0
votes
0
answers
144
views
0
votes
3
answers
447
views
0
votes
1
answer
394
views
1
vote
2
answers
596
views
115 Votes
114
|
1
|
50 Tags
|
search
× 30 regex × 25 timechart × 23 how-to × 13 eval × 11 chart × 11 subsearch × 10 time × 10 advanced-xml × 10 field × 9 |
with
× 8 stats × 8 alerts × 7 fields × 7 multiple × 7 query × 7 column × 6 forwarder × 6 charting × 6 field-extraction × 6 |
universal-forwarder
× 5 extract × 5 performance × 5 jschart × 5 syslog × 5 graph × 5 splunk × 5 dashboard × 5 group × 5 singlevalue × 5 |
report
× 4 props.conf × 4 reports × 4 sourcetypes × 4 csv × 4 problem × 4 timestamp × 4 export × 4 searches × 4 rex × 4 |
indexing
× 4 flashchart × 4 forms × 4 data × 4 application.css × 4 earliest × 4 charts × 4 dynamic × 4 join × 4 date × 4 |