I first want to say that I am just learning powershell and this might be a very simple answer, but I have done some research and can't find the exact thing I am looking for.
My Goal:
I am using the SQL cmdlets to try and exclude some databases that we need to run scripts on. Below is my code to get the databases
$ExcludeDBs=Invoke-Sqlcmd -ServerInstance $EDDSServer -Database EDDS -InputFile $InactiveCaseSQLPath
This works fine, it is after this when I am trying to use a foreach loop and try to compare the properties so I can determine which SQL cluster it is on. Below is my code:
$str="__SQL Cluster 13 (ALL NEW CASES HERE)"
$ExcludeDbs | foreach{
if($ExcludeDBs | Where-Object SQLclusterName -eq $str){
$SQLClusterName="ClusterNameSQL"}
}#end foreach loop
I get the following error:
Cannot bind parameter 'FilterScript'. Cannot convert the "SQLclusterName" value of type "System.String" to type "System.Management.Autom
ation.ScriptBlock".
I think this has something to do with type casting, but I am not sure where to go from here. Any help would be very much appreciated.
SQLClustername is being handled as a string - is it a field being returned from your query?
Also, you shouldn't need the where-object inside the foreach
$str="__SQL Cluster 13 (ALL NEW CASES HERE)"
$ExcludeDbs | foreach{
if($_.SQLclusterName -eq $str){
$SQLClusterName="ClusterNameSQL"}
}#end foreach loop
Related
Sorry for the lame question, I am new to Splunk.
What I am trying to do is to join my search result with a declared in the search body fake record, something like
index=...
| joint type=outer <column>
[ | <here declare a record to join with>
......
The idea is to make sure there is at least one record in the resulting search. There are the following cases expected:
the original search returns records
the original search does not return anything because the result is filtered
the original search does not return anything because the source is empty
I need to distinguish cases 2 and 3, which the join is for. The fake record will eliminate the case 3 so I will only need to filter the result.
There's a better way to handle the case of no results returned. Use the appendpipe command to test for that condition and add fields needed in later commands.
| appendpipe [ stats count | eval column="The source is empty"
| where count=0 | fields - count ]
Is there a way to use independently the outputs of a checkbox list in the Active Choices plugin on Jenkins ? (as in my example, I need to access to the selected check boxes one at a time
Here are a few screens to explain my problem :
Active Choices configuration in the job
The script
Checkboxes selected
Output
I would like to be able to access first to only the Debian_6, then only the Debian 6 32bits :)
Thanks !
As the result is comma-separated, maybe you could split the output:
# This is a way to split in bash
osArr=(${OS//,/ })
# And then access a result as
os1=${osArr[0]}
Or maybe iterate them in a for block
for os in ${OS//,/ } ; do
echo "${os}"
done
You can store the comma separated values into an array and iterate them
#!/bin/bash
OS_selected=($(echo $OS | tr "," "\n"))
for values in ${OS_selected[#]}
do
echo $values
done
I looked through some similar question but couldn't find an example of this sort of logic- what im looking for is a way to parse through a large return of usernames in powershell. User names that are not service accounts or kiosks have a specific naming convention of 6 grouped numeric characters: for example- username123456. I was thinking there has to be a way of using the where-object command but can't find anything on the syntax on technet or other PS resources. The one liner to get a return from the local domain is:
Search-ADAccount -PasswordNeverExpires | Select-Object Name, Enabled
This returns a list of domain accounts that have the password set to never expire. I want to only see the ones with the above naming convention ^^ I know you can achieve this with regex but my regex is quite rusty---if it can be done with where-object that would be optimal. I also looked into using pattern, but it seems to be for more complex returns than this... Thanks!
Are they under a specific OU? You could then use the -Searchbase parameter to limit the scope of the search to that OU.
Otherwise, Regex is probably going to be a good option to accomplish this.
Search-ADAccount -PasswordNeverExpires | Select-Object Name, Enabled | Where {
$_.name -match '\D\d{6}$'
}
I am new to splunk and facing an issue in comparing values in two columns of two different queries.
Query 1
index="abc_ndx" source="*/jkdhgsdjk.log" call_id="**" A_to="**" A_from="**" | transaction call_id keepevicted=true | search "xyz event:" | table _time, call_id, A_from, A_to | rename call_id as Call_id, A_from as From, A_to as To
Query 2
index="abc_ndx" source="*/ jkdhgsdjk.log" call_id="**" B_to="**" B_from="**" | transaction call_id keepevicted=true | search " xyz event:"| table _time, call_id, B_from, B_to | rename call_id as Call_id, B_from as From, B_to as To
These are my two different queries. I want to compare each values in A_from column with each values in B_from column and if the value matches, then display the those values of A_from.
Is it possible?
I have run the two queries separately and exported the results of each into csv and used vlookup function. But the problem is there is a limit of max 10000 rows of data which can be exported and so I miss out lots of data as my data search has more than 10000 records.
Any help?
Haven't got any data to test this on at the moment, however, the following should point you in the right direction.
When you have the table for the first query sorted out, you should 'pipe' the search string to an appendcols command with your second search string. This command will allow you to run a subsearch and "import" a columns into you base search.
Once you have the two columns in the same table. You can use the eval command to create a new field which compares the two values and assigns a value as you desire.
Hope this helps.
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Appendcols
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
I'm not sure why there is a need to keep this as two separate queries. Everything is coming from the same sourcetype, and is using almost identical data. So I would do something like the following:
index="abc_ndx" source="*/jkdhgsdjk.log" call_id="**" (A_to="**" A_from="**") OR (B_to="**" B_from="**")
| transaction call_id keepevicted=true
| search "xyz event:"
| eval to=if(A_from == B_from, A_from, "no_match")
| table _time, call_id, to
This grabs all events from your specified sourcetype and index, which have a call_id, and either A_to and A_from or B_to and B_from. Then it transactions all of that, lets you filter based on the "xyz event:" (Whatever that is)
Then it creates a new field called 'to' which shows A_from when A_from == B_from, otherwise it shows "no_match" (Placeholder since you didn't specify what should be done when they don't match)
There is also a way to potentially tackle this without using transactions. Although without more details into the underlying data, I can't say for sure. The basic idea is that if you have a common field (call_id in this case) you can just use stats to collect values associated with that field instead of an expensive transaction command.
For example:
index="abc_ndx" index="abc_ndx" source="*/jkdhgsdjk.log" call_id="**"
| stats last(_time) as earliest_time first(A_to) as A_to first(A_from) as A_from first(B_to) as B_to first(B_from) as B_from by call_id
Using first() or last() doesn't actually matter if there is only one value per call_id. (You can even use min() max() avg() and you'll get the same thing) Perhaps this will help you get to the output you need more easily.
In short, currently I am using the following code to pull records from multiple tables in a Sqlite Db and insert them in a single combobox ($SearchBar):
set SrchVals1 [db eval {SELECT DISTINCT Stitle From Subcontract Order By Stitle ASC}]
set SrchVals2 [db eval {...
set SrchVals3 ...
set SrchValsALL [concat $SrchVals1 $SrchVals2 $SrchVals3]
$SearchBar configure -value $SrchValsAll
For the variable "SrchVals1", I am trying to figure out a way to concatenate the text "Sub: " to each individual record in SrchVals1. For example, if SrchVals1 shows the following records in the combobox:
First Title
Second Title
Third Title
I would like to concatenate so that the records in the combobox look like this:
Sub: First Title
Sub: Second Title
Sub: Third Title
I understand that I might have to use a foreach statement; however, I am having no luck writing one that adds "Sub: " in front of each record, as opposed to one. This seems like something that should be pretty easy, but I cannot seem to figure it out.
Does anyone know how I can achieve these results?
Thank you,
DFM
You're right. The foreach command is the right way to do it. Here's how:
set SrchValsALL {}
foreach value [concat $SrchVals1 $SrchVals2 $SrchVals3] {
lappend SrchValsALL "Sub: $value"
}
$SearchBar configure -value $SrchValsAll