Splunk Search

Community Activity

Table of results with transactions levels of durations Hi, how can we generate the below table statistics for transactions durations? X=duration Date, TotalNumberOfTrans... by niroren New Member in Splunk Search 02-25-2018 0 2	0	2
Delete a search-time field after extraction I have a set of logs that require a pretty complex set of regexes to parse. The data has about 8 columns separated by... by _smp_ Builder in Splunk Search 02-24-2018 0 2	0	2
best way to build asset inventory and compliance i wanted to build a list of assets and based on periodic searches update items we are checking for compliance such as... by gdavid Path Finder in Splunk Search 02-24-2018 0 1	0	1
Creating a stacked bar chart I feel silly asking this question as I think it should be relatively straight forward, but I am not able to get the f... by BearMormont Path Finder in Splunk Search 02-24-2018 0 2	0	2
IP address of current user? I'm trying to write a query to display the IP address of the current user. Anyone know how to do this? by matstap Communicator in Splunk Search 02-23-2018 0 3	0	3
transaction function and deduping mv values Is there an efficient way to mvdedup on all fields at once? Result is from transaction. Rather not convert to stats... by mschellhouse Path Finder in Splunk Search 02-23-2018 0 3	0	3
Find number of days between date and now() Hello trying something I assume is pretty easy just cant get it right for some reason. I have a field called "Due Da... by tkwaller_2 Communicator in Splunk Search 02-23-2018 0 2	0	2
Why is summary index search returning duplicate and incorrect counts of data? Hi Team, I am populating the data in summary index using the following Splunk search index=data" \| sistats count a... by smaran06 Path Finder in Splunk Search 02-23-2018 0 8	0	8
Get database Size per day and Total size of all databases I would like to get o/p as below I am using index=xxxx sourcetype="log" "Database =" AND "Size" host=xxxxx \| ev... by dpatiladobe Explorer in Splunk Search 02-23-2018 0 5	0	5
geostat question for multiple indexes i have a unique type of column in 4 different indexes , but they all have similar latitude and longitude. can i sho... by jiaqya Builder in Splunk Search 02-23-2018 0 3	0	3
Does Splunk support regex support with look behind and look ahead? Does Splunk support regex look behind and look ahead? Specifically, I have a log that has the following: CN=LastNam... by santorof Communicator in Splunk Search 02-23-2018 0 8	0	8
lookup files for alert creating I have 3 lookup files. I want to take EmpNum from fiel1.csv searching for that in file2.csv to get the email id and ... by surekhasplunk Communicator in Splunk Search 02-23-2018 0 6	0	6
Dedup case insensitive? When searching in our list of usernames that have logged in, I dedup the usernames but the results are case sensitive... by gascoynt Engager in Splunk Search 02-23-2018 0 1	0	1
Why is the Time Picker searching by time rather than creation date? Hi, When I run a search I am using a time picker and select 24h, 7d, 30 and the search runs for this time. But I pul... by colinmchugo Explorer in Splunk Search 02-23-2018 0 10	0	10
How can I extract nested JSON at index time as their own event? I am using the REST API to get a large sample of JSON data every minute from the Bittrex Exchange but I would like t... by DHastie Engager in Splunk Search 02-23-2018 0 1	0	1
Create a Time Table with multiple 'by' fields I need a table that looks like a chart containing multiple 'by' values. sample output: time_bin, farmName, errorCou... by dreeck Path Finder in Splunk Search 02-22-2018 0 2	0	2
How can I create color Tables based on Dynamic Values in Splunk 7? Hi I have the following data column_A column_B 10 20 15 5 16 100 I want to... by robertlynch2020 Influencer in Splunk Search 02-22-2018 0 3	0	3
JOIN on "_time +- 3sec" Hi, I'm new to splunk  This is my query: * Tagname="series" Wert="54" \| JOIN _time [SEARCH Tagname="workload" ] ... by BOstermeier Explorer in Splunk Search 02-22-2018 1 6	1	6
How to format field values of a varying field name? Hey Guys, I have events with duration (seconds), then I chart the sum of duration per week. So now, the field names ... by auaave Communicator in Splunk Search 02-22-2018 0 1	0	1
Use transforming command on all events In Searching, it looks like it is not possible to use a transforming command directly. For example, I would like find... by flow2k Explorer in Splunk Search 02-22-2018 0 1	0	1
How to search for events that occured on the last 4 weeks where the week starts on Monday? Hi Guys, How do I search events that occurred on the last 4 work weeks that starts on Monday and doesn't include the... by auaave Communicator in Splunk Search 02-22-2018 1 3	1	3
What does the "timechart per_day(total)" do in the Splunk documentation for Time functions? I was reading the documentation on per_day, here: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/... by flow2k Explorer in Splunk Search 02-22-2018 0 6	0	6
I am looking for a search which will display my gigs per day each indexer is taking? All, Anyone have a search handy I can run that shows the gigs per day by each indexer? thanks -Daniel by daniel333 Builder in Splunk Search 02-22-2018 0 1	0	1
How to plot per_second with eval, will it be count or value? I'm trying to understand this query: timechart per_second(eval(errorValue>0)) Does this plot the value of errorValu... by davidch12 Explorer in Splunk Search 02-22-2018 0 1	0	1
How do I recognize the date/time stamp? We have the following - What would be the props.conf change? by ddrillic Ultra Champion in Splunk Search 02-22-2018 0 2	0	2