Splunk stats unique12/2/2023 the results, set the priority of the email, give a message i.e. For instance to whom you want to send the email, if you want to keep anyone in cc/bcc, change the subject line (by default its "Splunk Results"), sendpdf(true or false) i.e. you just need to pass a couple of values to it. SENDEMAIL: This command helps you to send an email straight away from the search head itself. Another thing to notice is useother, this option specifies whether to merge all of the values which are not included in the results into a single new value called OTHER, accepted values t(true) or f(false).In this case, each bar(or line chart) in the bar graph will be of 5 mins. If you will notice, there is something called span (length of time for which the statistics are considered).Above query will help to create a timechart with respect to a specific field(it this case its action) from the events.Example: index=_audit | timechart span=5m count by action useother=f.TIMECHART: Helps you to create a time series chart with respect to event statistics. The output will be something like this $98,622.96.Above example is converting the value which is there in "avg_revenue" to a string which consists of '$' and 'commas'.Example: | eval "Average Revenue" = " $" + tostring(avg_revenue, " commas").let's say if the input value is a number, it re-formats and changes it to a string, on the other hand, lets say if the input value is boolean, it returns either "True" or "False". TOSTRING: Helps to convert an input value to a string. Round the value down to the nearest whole integer.Īpart from this, there are other functions as well which are used by eval command, for instance, pi(), sqrt() etc.Example: | eval Average= floor(Average).Give the output with the maximum possible number of decimal values.Example: | eval Average= exact(Average).Round the value up to the next highest integer.
0 Comments
Leave a Reply.AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |