splunk>docs

===================================================================================
===================================================================================
==

1. source="*" | stats sum(*) BY EventCode | addtotals row=f col=t

labelfield=EventCode sum(*)
===================================================================================
===================================================================================
==
Comparison and Conditional functions:
-------------------------------------
1. sourcetype=access_* | eval description=case(status == 200, "OK", status ==404,
"Not found", status == 500, "Internal Server Error") | table status description
2. source=all_month.csv | eval Description=case(depth<=70, "Low", depth>70 AND
depth<=300, "Mid", depth>300, "Deep") | stats count min(mag) max(mag) by
Description
3. source=all_month.csv | eval Description=case(depth<=70, "Low", depth>70 AND
depth<=300, "Mid", depth>300, "Deep") | stats count min(mag) max(mag) by
Description | eval sort_field=case(Description="Low", 1, Description="Mid", 2,
Description="Deep",3) | sort sort_field
4. source=all_month.csv | eval isLocal=if(cidrmatch("123.132.32.0/25",ip), "local",
"not local") | stats by isLocal
5. source=all_month.csv | eval ip=coalesce(clientip,ipaddress)
6. source="all_month.csv" | eval err=if(error == 200, "OK", "Error") | table *
7. source="all_month.csv" | eval isLocal=if(cidrmatch("123.132.32.0/25",ip),
"local", "not local")
8. source="all_month.csv" | eval isLocal=if(cidrmatch("123.132.32.0/25",ip),
"local", "not local") | stats
9. source="all_month.csv" | eval isLocal=if(cidrmatch("123.132.32.0/25",ip),
"local", "not local") | stats by isLocal
10. source="all_month.csv" | where in(gap,"71", "72") | table *
11. source="all_month.csv" |where in(date_hour,"5", "13", "16") | where
in(gap,"71", "72") | table *
12. source="all_month.csv" |where in(date_hour,"5", "13", "16") | where
in(gap,"71") | table *
13. source="all_month.csv" | where gap in("72") | where date_hour in("5") | table
*
14. source="all_month.csv" | where gap in("72") | where date_hour in("5", "10") |
table *
15. source="all_month.csv" | where gap in("72", "71") | where date_hour in("5",
"10") | table *
16. source="all_month.csv" | eval new_field=if(in(gap,"71"), "value-
if_true","value-if-false") | stats by new_field
17. source="all_month.csv" | eval error=if(in(status, "error", "failure",
"severe"),"true","false") | stats by error
18. source="all_month.csv" | eval error=if(in(status,
"404","500","503"),"true","false") | stats count by error
19. source="all_month.csv" | eval error=if(in(status,
"404","500","503"),"true","false") | stats by error
20. source="all_month.csv" | eval is_a_foo=if(like(date_month, "foo%"), "yes a
foo", "not a foo") | table is_a_foo *
21. source="all_month.csv" | eval is_a_foo=if(like(date_hour, "6"), "yes a foo",
"not a foo") | stats by is_a_foo
22. source="all_month.csv" | where like(gap, "72") | stats count by gap
23. source="all_month.csv" | where like(gap, "72") | stats by gap
24. source="all_month.csv" | where like(gap, "72") | table *
25. source="all_month.csv" | eval n=if(match(field,
"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), 1, 0) | stats by n
26. source="all_month.csv" | eval n=if(match(_raw,
"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), 1, 0) | table n *
27. source="all_month.csv" | eval matches = if(match(date_wday,"friday"), 1, 0) |
stats by matches
28. source="all_month.csv" | eval matches = if(match(date_wday,"sunday"), 1, 0) |
stats by matches
29. source="all_month.csv" | eval matches = if(match(date_wday,"friday"), 1, 0) |
stats count by matches
30. source="all_month.csv" | eval n=nullif(gap,count) | table gap count *
31. | makeresults 1 | eval _raw = "x=hi y=bye" | eval x="hi" | eval y="bye" | eval
test=if(searchmatch("x=hi y=no"), "yes", "no") | table _raw test x y
32. | makeresults 1 | eval _raw = "x=hi y=bye" | eval x="hi" | eval y="bye" | eval
test=if(searchmatch("x=hi y=*"), "yes", "no") | table _raw test x y
33. source="all_month.csv" | eval test=if(searchmatch("date_hour=1 date_mday=1"),
"yes", "no") | stats by test
34. source="all_month.csv" | eval test=if(searchmatch("date_hour=6"), "yes", "no")
| table test date_hour date_mday
35. source="all_month.csv" | eval test=if(searchmatch("date_mday=31"), "yes", "no")
| stats by test
36. source="all_month.csv" | eval test=if(searchmatch("date_mday=31 date_hour=6"),
"yes", "no") | stats by test
37. source="all_month.csv" | eval test=if(searchmatch("date_mday=31
date_hour=5,6"), "yes", "no") | table test date_mday date_hour
38. source="all_month.csv" | eval test=if(searchmatch("date_mday=31 date_hour=6
date_minute=49"), "yes", "no") | table test date_mday date_hour date_minute
39. source="all_month.csv" | eval test=if(searchmatch("date_mday=31 date_hour=6
date_minute=49"), "yes", "no") | stats by test
40. sourcetype=access_* | eval description=case(status==200,"OK", status==404, "Not
found", true(), "Other") | table status description
41. source="all_month.csv" | eval n=validate(isint(port), "ERROR: Port is not an
integer", port >= 1 AND port <= 65535, "ERROR: Port is out of range") | stats by n
42. sourcetype=access_* | eval n=validate(isint(port), "ERROR: Port is not an
integer", port >= 1 AND port <= 65535, "ERROR: Port is out of range") | table n
===================================================================================
===================================================================================
====
CONVERSION FUNCTION :=

43. sourcetype=access_* | eval n=tonumber("0A5",12) | table n *

44. sourcetype=access_* | eval n=tonumber("0A5",12) | stats by n
45. sourcetype=access_* | eval foo=615 | eval foo2 = tostring(foo, "duration") |
stats by foo, foo2
46. sourcetype=access_* | eval n=sha1(bytes) | table n
47. sourcetype=access_* | eval n=md5(bytes) | table n
48. sourcetype=access_* | eval n=sha256(bytes) | table n
49. sourcetype=access_* | eval n=sha512(bytes) | table n
===================================================================================
===================================================================================
====
TIME AND DATE :=
50. sourcetype=access_* | eval n=relative_time(now(), "+1d") | table n
51. source="all_month.csv" | eval n=relative_time(now(), "-1d@d") | stats by n
52. | makeresults | eval StartTimestamp="1521467703049000000"| eval
starttime=strftime(StartTimestamp/pow(10,9),"%Y-%m-%dT%H:%M:%S.%Q")
53. | makeresults | eval StartTimestamp="1521467703049000000"| eval
hour_min=strftime(_time, "%H:%M")
54. | makeresults
55. | makeresults | eval week=strftime(_time,"%V")
56. | makeresults | eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%S.%Q")
57. | makeresults | eval mytime=strftime(_time,"%a %B %d %Y %H:%M:%S.%N")
58. | makeresults | eval mytime=strftime(_time,"%Y/%m/%d %H:%M:%S.%N")
59. | makeresults | eval n=strptime(timeStr, "%H:%M")
60. | gentimes start=8/13/18 increment=2h | fields starthuman endhuman | eval
startunix=strptime(starthuman,"%a %B %d %H:%M:%S.%N %Y")
61. | gentimes start=8/13/18 increment=6h | fields starttime starthuman | eval
epoch_time=strptime(starttime,"%s") | eval testtime=time()
===================================================================================
===================================================================================
=====
INFORMATIONAL FUNTION :=
62. | gentimes start=8/13/18 increment=6h | eval n=if(isint(2),"int", "not int")
63. | gentimes start=8/13/18 increment=6h | eval n=if(isint(string),"int", "not
int")
64. | gentimes start=8/13/18 increment=6h | where isint(1)
65. | gentimes start=8/13/18 increment=6h | eval
n=if(isnotnull(starttime),"yes","no")
66. | gentimes start=8/13/18 increment=6h | where isnotnull(endtime)
67. | gentimes start=8/13/18 increment=6h | eval n=if(isnull(endtime),"yes","no")
68. | gentimes start=8/13/18 increment=6h | eval n=if(isnull(nofield),"yes","no")
69. | gentimes start=8/13/18 increment=6h | eval n=if(isnull(nofield),"yes","no") |
where isnull(n)
70. | gentimes start=8/13/18 increment=6h | eval n=if(isnum(endtime),"yes","no")
71. | gentimes start=8/13/18 increment=6h | eval n=if(isnum(endtime),"yes","no") |
where isnum(endtime)
72. | gentimes start=8/13/18 increment=6h | eval n=if(isstr(endhuman),"yes","no")
73. | gentimes start=8/13/18 increment=6h | eval n=if(isstr(field),"yes","no")
74. | gentimes start=8/13/18 increment=6h | eval n=if(isstr(endhuman),"yes","no") |
where isstr(n)
75. | gentimes start=8/13/18 increment=6h | where isstr(starttime)
76. | gentimes start=8/13/18 increment=6h | eval n=typeof(12) + typeof("string") +
typeof(1==2) + typeof(badfield)
77. | makeresults | eval t=typeof(_time)
===================================================================================
===================================================================================
====
MATHEMATICAL FUNCTION :=
78. | makeresults | eval absnum=abs(5+5)
79. | makeresults | eval n=ceil(1.1)
80. | makeresults | eval n=exact(3.14 * 6) | eval m=exact(4 * 4)
81. | makeresults | eval n=exact(3.14 * 6) | eval y=exp(3)
82. | makeresults | eval n=floor(6.443)
83. | makeresults | eval lnBytes=ln(4)
84. | makeresults | eval lnBytes=ln(4) | eval num=log(10) | eval num1=log(2, 2)
85. | makeresults | eval lnBytes=ln(4) | eval area_circle=pi()*pow(5,2)
86. | makeresults | eval lnBytes=ln(4) | eval n=round(3.6) | eval m=round(3.4)
87. | makeresults | eval n=round(2.555, 0) | eval m=round(2.555, 1) | eval
l=round(2.555, 2) | eval p=round(2.555, 3) | eval q=round(2.555, 4)
88. | makeresults | eval n=sigfig(1.00*1111) | eval m=sigfig(2.00*1111)
89. | makeresults | eval n=sqrt(9) | eval m=sqrt(10) | eval p=sqrt(1000)
===================================================================================
===================================================================================
===
MULTIVALUE EVAL FUNCTION :=
90. source="all_month.csv" | eval x=commands("search foo | stats count | sort
count") | stats by x
91. source="all_month.csv" | eval fullName=mvappend("123", "middle value", "1000")
| stats by fullName
92. source="all_month.csv" | eval fullName=mvappend("123", "middle value", "1000")
| table fullName *
93. source="all_month.csv" | eval n=mvcount(date_mday) | stats by n | table n *
94. source=WinEventLog* | eval n=if(match(Account_Name, "micro"), 1, 0) | stats by
n