The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
Joe Rizzo's Discussions
sum fields in same event
2 Replies
I need to sum fields by other fields in the same event.Here is an example event:_time somefieldname somefieldvalue6/26/10 3:09:23.000 AM A …Continue
Started this discussion. Last reply by Joe Rizzo Jun 30, 2010.
renaming searches, reports and dashboards
3 Replies
How can I rename searches, reports and dashboards?Thanks,JoeContinue
Started this discussion. Last reply by Joe Rizzo Nov 16, 2009.
Joe Rizzo's Page
Gifts Received
Joe Rizzo has not received any gifts yet
Latest Activity
Joe Rizzo replied to Joe Rizzo's discussion sum fields in same event"Thanks for the reply.
I ended up splitting the event into multiple events using split. Then I could use stats and timechart as expected.
Thanks,
Joe"
Michael Wilde replied to Joe Rizzo's discussion sum fields in same event"Have you considered using " | makemv" to turn that event in to a multi-value field, so you end up with a=1 a=2 b=2 b=2 and then do an | eval a = a+a | eval b = b + b"
Joe Rizzo posted a discussionsum fields in same event
I need to sum fields by other fields in the same event.Here is an example event:_time somefieldname somefieldvalue6/26/10 3:09:23.000 AM A 1 A 1 B 2 B 2How could I sum the values in somefieldvalue by somefieldname, then graph the sum. IE '| timechart…See More
Joe Rizzo replied to Joe Rizzo's discussion renaming searches, reports and dashboards"That is what I needed. Thanks!
FYI - There is a bug in the clone operation. If you were to look at the entry for the original report and the clone in the user's savedsearches.conf you will notice that the key "displayview" is omitted…"
Michael Wilde replied to Joe Rizzo's discussion renaming searches, reports and dashboards"As of version 4.0.6. It is not possible to rename searches from the UI. However, all of splunk's configs are stored in fairly easy to understand config files. Searches, for example, are stored in "savedsearches.conf" (docs page link).…"
Dave P replied to Joe Rizzo's discussion renaming searches, reports and dashboards"I haven't figured out how to rename them, but I did figure out that if you clone them and give them a new name, it's essentially the same thing. If it's not, I haven't discovered the difference yet.
-dave"
Joe Rizzo posted a discussionrenaming searches, reports and dashboards
How can I rename searches, reports and dashboards?Thanks,JoeSee More
Profile Information
- Are you an existing splunk user?
- Licensed
- What do you do for your day job?
- IT Manager (Online)
- Web / Blog Address
- http://www.swtor.com
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
