Kevin
- Total activity 271
- Last activity
- Member since
- Following 0 users
- Followed by 0 users
- Votes 0
- Subscriptions 75
Activity overview
Latest activity by Kevin-
Kevin commented,
The following should name the field. Let me know if you already tried this. (_sourceCategory="my/thing")| timeslice 1d| count as newname by _timeslice
-
Kevin commented,
Hi Patrick. If you want to do a 1 time upload I'd suggest posting your file to an HTTP Source. You can use a Curl command to upload your file to the HTTP Source endpoint provided after creating you...
-
Kevin commented,
Hi Iain, It looks like your getting the default color, possibly due to the value not meeting one of the thresholds. In the "To" value for the Green value can you try changing this to 100.0001 and s...
-
Kevin commented,
Will, From your screenshot it looks like your performing the outlier operation on the _timeslice field instead of the count field. Those really high numbers are actually epoch times, which is what ...
-
Kevin commented,
Might try something like the following. _sourceCategory = company/gsuite/drive "\"applicationName\": \"drive\"" "\"type\": \"access\"" "\"name\": \"download\""| json "id", "ipAddress", "events", "...
-
Kevin commented,
Hi Will, Could you provide the query you are currently trying to use, the one that presents the error? It sounds like you have not referenced the timeslice in your aggregations or the timeslice get...
-
Kevin created an article,
Node.js 8.x End of Life
On December 31, 2019 the Node community will stop support for Node.js 8.x and will provide no further bug fixes, improvements or security updates after this date. In order to ensure you continue to...
-
Kevin commented,
Possible, but will require an additional "transactionize" and "merge" operation. | parse regex ", 'item': u(?<local_intf>.*?)," multi| transactionize _raw (merge local_intf join with ", ", _raw ...
-
Kevin commented,
Hi Zafar, I put your test message into a test account and tried your parsing expression and this appeared to work for me. Again, note that each parsed value will be placed into a new row, under the...
-
Kevin commented,
You will want to look at the "multi" option of the parse regex operator. This flag will tell the parsing operation to parse each occurrence of the expression within a single message. Thes parsed va...