search

splunk / splunk-tableau-wdc

Splunk Tableau Web Data Connector (WDC) Example
Apache License 2.0
20 stars 13 forks source link

[feature] Auto translation of Splunk Field (with Special Char) to Tableau supported Field #19

Open mayurah opened 5 years ago

mayurah commented 5 years ago

From @actionpotato

This is looking really good so far. Still having our users test it. One caveat (not really an issue) is that I found that I needed to rename fields to have the WDC accept them.

Here is the test search I was using:

index=_audit action=search search=* user=* NOT user=splunk-system-user  earliest=-1h 
| rex field=search "index\s*=\s*\"*(?<indexname>[^\s\"]+)"  
| search indexname="*" 
| stats count by indexname user 
| rename count as searches
| stats list(indexname) by user searches

Because "stats list(indexname)" returns with brackets, I needed to modify the search as follows:

| rename list(indexname) as indexname

Not something I would consider an issue, but something for people who are migrating current searches to be aware of.

mayurah commented 5 years ago

Duplicate #15