Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
Joe Rizzo's Discussions
sum fields in same event
2 Replies
I need to sum fields by other fields in the same event.Here is an example event:_time somefieldname somefieldvalue6/26/10 3:09:23.000 AM A …Continue
Started this discussion. Last reply by Joe Rizzo Jun 30, 2010.
renaming searches, reports and dashboards
3 Replies
How can I rename searches, reports and dashboards?Thanks,JoeContinue
Started this discussion. Last reply by Joe Rizzo Nov 17, 2009.
Joe Rizzo's Page
Gifts Received
Joe Rizzo has not received any gifts yet
Latest Activity
Joe Rizzo updated their profile photo
Joe Rizzo replied to Joe Rizzo's discussion 'sum fields in same event'
Thanks for the reply.
I ended up splitting the event into multiple events using split. Then I could use stats and timechart as expected.
Thanks,
Joe
Michael Wilde replied to Joe Rizzo's discussion 'sum fields in same event'
Have you considered using " | makemv" to turn that event in to a multi-value field, so you end up with a=1 a=2 b=2 b=2 and then do an | eval a = a+a | eval b = b + b
sum fields in same event
I need to sum fields by other fields in the same event.Here is an example event:_time somefieldname somefieldvalue6/26/10 3:09:23.000 AM A 1 A 1 B 2 B 2How could I sum the values in somefieldvalue by somefieldname, then graph the sum. IE '| timechart…See More
Discussion posted by Joe Rizzo
Joe Rizzo replied to Joe Rizzo's discussion 'renaming searches, reports and dashboards'
That is what I needed. Thanks!
FYI - There is a bug in the clone operation. If you were to look at the entry for the original report and the clone in the user's savedsearches.conf you will notice that the key "displayview" is omitted…
Michael Wilde replied to Joe Rizzo's discussion 'renaming searches, reports and dashboards'
As of version 4.0.6. It is not possible to rename searches from the UI. However, all of splunk's configs are stored in fairly easy to understand config files. Searches, for example, are stored in "savedsearches.conf" (docs page link).…
Dave P replied to Joe Rizzo's discussion 'renaming searches, reports and dashboards'
I haven't figured out how to rename them, but I did figure out that if you clone them and give them a new name, it's essentially the same thing. If it's not, I haven't discovered the difference yet.
-dave
renaming searches, reports and dashboards
How can I rename searches, reports and dashboards?Thanks,JoeSee More
Discussion posted by Joe Rizzo
Profile Information
- Are you an existing splunk user?
- Licensed
- What do you do for your day job?
- IT Manager (Online)
- Web / Blog Address
- http://www.swtor.com
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
