![]() ![]() of the response code is equals to 200 it will mark it as OK otherwise for all other response code it will mark it as Error. Lets say you want to add a new field, for doing so you can use something like given below, it command will create a new field based on the IF condition i.e. There are multiple different functions available for eval command. ![]() Example: | sendemail subject="Test " sendpdf=true priority=highest message="Please find attached latest search result" sendresults=trueĭEDUP: This command helps de-duplicate the results based upon specified fields, keeping the most recent match.ĮVAL: This command helps to evaluate new or existing fields and their values.the results, set the priority of the email, give a message i.e. For instance to whom you want to send the email, if you want to keep anyone in cc/bcc, change the subject line (by default its "Splunk Results"), sendpdf(true or false) i.e. you just need to pass a couple of values to it. SENDEMAIL: This command helps you to send an email straight away from the search head itself. Another thing to notice is useother, this option specifies whether to merge all of the values which are not included in the results into a single new value called OTHER, accepted values t(true) or f(false).In this case, each bar(or line chart) in the bar graph will be of 5 mins. If you will notice, there is something called span (length of time for which the statistics are considered).Above query will help to create a timechart with respect to a specific field(it this case its action) from the events.Example: index=_audit | timechart span=5m count by action useother=f.TIMECHART: Helps you to create a time series chart with respect to event statistics. The output will be something like this $98,622.96.Above example is converting the value which is there in "avg_revenue" to a string which consists of '$' and 'commas'.Example: | eval "Average Revenue" = " $" + tostring(avg_revenue, " commas").let's say if the input value is a number, it re-formats and changes it to a string, on the other hand, lets say if the input value is boolean, it returns either "True" or "False". TOSTRING: Helps to convert an input value to a string. Round the value down to the nearest whole integer.Īpart from this, there are other functions as well which are used by eval command, for instance, pi(), sqrt() etc.Example: | eval Average= floor(Average).Give the output with the maximum possible number of decimal values.Example: | eval Average= exact(Average).Round the value up to the next highest integer. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |