|
- How to Add objectGUID into this vbscript | Tek-Tips
mvsep = multivaluedsep ' seperator used when more than one value returned next objcsv write(q) case else ' Write value ' single double quotes " are replaced by double double quotes "" objcsv write(comma q replace(rs(j) value,q,q q) q) end select comma = "," ' all columns apart from the first column require a preceding comma
- Subsearch to only return multiple field values - Splunk Community
Hello, I am trying to only return the values of certain fields to be used in a subsearch The problem I'm encountering, is that I have multiple values from different fields which I want to extract I have 4 fields - src, src_port, dst, dst_port If I table out the results and use format, my search reads as such: "src"="<IP>" AND "src_port"="<port>" AND "dst"="<IP>" AND "dst_port"="<port>" What
- Subsearch to only return multiple field values - Splunk Community
Hello, I am trying to only return the values of certain fields to be used in a subsearch The problem I'm encountering, is that I have multiple values from different fields which I want to extract I have 4 fields - src, src_port, dst, dst_port If I table out the results and use format, my search
- Re: How can I pass dynamic values to the IN operator?
wrote: - Splunk will automatically add the IN operator Not exactly Splunk will automatically convert the subsearch into a series of OR clauses, which is the same thing it does with the IN operator
- return a list from subsearch and use it in main se. . . - Splunk Community
i have a splunk query below that returns me ( ( ( list_value2="dev1" OR list_value2="dev2" OR list_value2="dev5" OR list_value2="dev6" ) ) ) i want to use this 4 values as a list to query using IN operation from another main search as show in the second code snippet ``` index=main label=y userid=
- How can I pass dynamic values to the IN operator?
Or you can simplify to this in most cases: <your-search> [search <the search you wish to write> | table myField] - As far as field name myField is common in both searches - Splunk will automatically add the IN operator
- Music On Hold during vector wait step | Tek-Tips
We are playing around with moving to a VAL based MOH source Everything seems to be running fine except for one small inconvenience Whenever we break MOH in a vector for an announcement or a staffed skill check and then return to "wait hearing music", the music is restarted Is there any way
- Re: How can I pass dynamic values to the IN operator?
Or you can simplify to this in most cases: - As far as field name myField is common in both searches - Splunk will automatically add the IN operator
|
|
|