Thanks for the video!!, one question, using selfjoin command with append command is faster that join command when you are trying to join two result datasets using a match condition between both datasets?
Sir, I am a beginner, I want to follow your video, can you please suggest how to get the TMDB app into Splunk? I just want to type the same thing and get the same result. Thank you in advance.
Hi Sid, one question. In selfjoin video, you told that selfjoin command checks and compares next rows(adjacent rows) and return result which is common. Whereas in this video for the result set at 4:32, genre_id 28 and 99 respectively are not in adjacent rows(next rows). Then how is it creating a row for 28 and 99 with name field of subsearch? ideally it should compare next row with same genre_id and since its not same, it should return same first table right? please clarify.
actually what I wanted to say was that genre_id can be in adjacent rows or separated by few rows, the selfjoin works in same ways. Unfortunately the example I choose most of the rows were adjacent. So the behavior you are seeing is correct.
can you help in this sourcetype=access_* action=purchase | stats dc(clientip) as clientip BY categoryId | append [search sourcetype=access_* action=purchase | top 1 clientip BY categoryId] | table categoryId, clientip, count results sharing the same field values please help in the reformat the output.. i think by using the rename command
@@splunk_ml Thanks so much for your reply, Sid. I've been very much following your uploads and learning tons. Thank you! If you click on triple dot, right next to "SAVE", it should give an option of "Open Transcript". If you check your other uploads, it does display transcript. However, on this upload, it does not display. Unfortunately, I cannot upload a screenshot for your reference. But as a simple reference, your upload th-cam.com/video/R86phfbo9KQ/w-d-xo.html does contain a ready transcript.
Hi Sir... Very nice explaination... I have one doubt..I have 2 searches that are fetching fields and showing as table command....I am trying to combine these 2 searches using appendcols...but sometimes the numbers of rows won't be matching....so it is mapped to the wrong row...eventhough Im using sort based on time... As the number of rows are not matching it's jus mapping first set of rows... Is there any way to overcome this please...any suggestions will be appreciated...
appendcols will never make sure the proper mapping. Its just appending columns from the second search. If you need to maintain proper mapping please use join command.
Thànk you.. I want to achieve all my lookup values to displayed even though there are no related events.. and I am using inputlookup with chart command..but I am getting 1 instead of 0.. how can I get 0 for the no events.. pls help..thnk u
It is a very good video to understand the commands
Thanks for the video!!, one question, using selfjoin command with append command is faster that join command when you are trying to join two result datasets using a match condition between both datasets?
Sir, I am a beginner, I want to follow your video, can you please suggest how to get the TMDB app into Splunk? I just want to type the same thing and get the same result. Thank you in advance.
Amazing Video , thank you for that.
Hi Sid, one question. In selfjoin video, you told that selfjoin command checks and compares next rows(adjacent rows) and return result which is common. Whereas in this video for the result set at 4:32, genre_id 28 and 99 respectively are not in adjacent rows(next rows). Then how is it creating a row for 28 and 99 with name field of subsearch? ideally it should compare next row with same genre_id and since its not same, it should return same first table right? please clarify.
actually what I wanted to say was that genre_id can be in adjacent rows or separated by few rows, the selfjoin works in same ways. Unfortunately the example I choose most of the rows were adjacent. So the behavior you are seeing is correct.
Appreciate your effort
can you help in this
sourcetype=access_* action=purchase
| stats dc(clientip) as clientip BY categoryId
| append
[search sourcetype=access_* action=purchase
| top 1 clientip BY categoryId]
| table categoryId, clientip, count
results sharing the same field values please help in the reformat the output.. i think by using the rename command
Sid, is it possible to turn on 'Transcript' bit on ? It is not showing any transcripts
:( I am not able to see any settings related to "Transcipt" Alex. May be something needs to set in your youtube player?
@@splunk_ml Thanks so much for your reply, Sid. I've been very much following your uploads and learning tons. Thank you! If you click on triple dot, right next to "SAVE", it should give an option of "Open Transcript". If you check your other uploads, it does display transcript. However, on this upload, it does not display. Unfortunately, I cannot upload a screenshot for your reference. But as a simple reference, your upload th-cam.com/video/R86phfbo9KQ/w-d-xo.html does contain a ready transcript.
Hi Sir... Very nice explaination... I have one doubt..I have 2 searches that are fetching fields and showing as table command....I am trying to combine these 2 searches using appendcols...but sometimes the numbers of rows won't be matching....so it is mapped to the wrong row...eventhough Im using sort based on time...
As the number of rows are not matching it's jus mapping first set of rows...
Is there any way to overcome this please...any suggestions will be appreciated...
appendcols will never make sure the proper mapping. Its just appending columns from the second search. If you need to maintain proper mapping please use join command.
@@splunk_ml Thanq so much for reply Sid..But join will cause performance issues..we are dealing with huge data..That's why..
In dbxquery,how to use field value from 1 select query in another select query...it's more of like dbxquery inner query.please provide the syntax
you mean the subquery? well you can write the whole qur=ery including the subquery and then execute it using dbxquery.
Thànk you.. I want to achieve all my lookup values to displayed even though there are no related events.. and I am using inputlookup with chart command..but I am getting 1 instead of 0.. how can I get 0 for the no events.. pls help..thnk u
can you please elaborate ur question? u can send me email if it is too much writing here.
how to find a index value in csv
please provide path of the previous video u r refering in this video in starting for "index="tmdb_index" set up.
Hi Abhishek,
I have created the path in the video. Thanks for pointing this out. FYI the link as well.
th-cam.com/video/JshI6JT60Rs/w-d-xo.html
Sid