Splunk Search

Community Activity

	Search inside the files based on keywords to do sub search in splunk I have following types of txt files in my source and contents of each files are mentioned below in CAPS: a1.txt: ... by rojit Explorer in Splunk Search 02-08-2018 0 9	0	9
	Cannot Call A Search Command from Search Macro Hello everyone; I am trying to call a search command from a search macro. Does anyone have a suggestion. Example: Ty... by spraus Explorer in Splunk Search 02-08-2018 0 6	0	6
	Why does Splunk suggest using Regex101.com? The Regex I create extract fields inside the Regex101 site, but do nothing in Splunk. What gives? Regex in use on R... by panderla Loves-to-Learn Lots in Splunk Search 02-08-2018 0 9	0	9
	How can I reverse grouping in nested JSON block? I have a JSON block that contains one account id and a number of nested resources. I can easily get a list of resourc... by a238574 Path Finder in Splunk Search 02-08-2018 0 0	0	0
	Is it possible to add "starting the search" to the link switcher option? Hi, I would like to implement some options to show/hide panels in a dashbaord. Currently the plan to have an option ... by HeinzWaescher Motivator in Splunk Search 02-08-2018 0 4	0	4
	How to join two tables? Hi All, I have a search: \| savedsearch Cycle_11 \| append [\| savedsearch Cycle_10] with the results: ... by jvmerilla Path Finder in Splunk Search 02-08-2018 0 10	0	10
	evaluation with condition I have two values x and y. Both values are dynamic (keeps on changing). x indicates _time and y indicates a value tha... by zacksoft Contributor in Splunk Search 02-08-2018 0 23	0	23
	Lookup match Hi, I am trying to do the following: 1 - Search an index; 2 - For each result, search for matches in lookup table 1,... by robettinger Explorer in Splunk Search 02-08-2018 0 14	0	14
	Map a field to a value within the log file I am working with clock sync log files. The top 3 lines have the ip address -> MAC address mapping... The rest of the... by neltonk Path Finder in Splunk Search 02-07-2018 0 1	0	1
	How can I tie together Windows Logon and Linux SSH Events to monitor root and other linux admin accounts? Hi! My goal is to be able to tie together events from Linux events and Windows events in order to track Windows user... by matthewssa Path Finder in Splunk Search 02-07-2018 0 4	0	4
	What is an alternate way to do this query: count(eval(like('some.field',"A"))) AS accepted? SPLUNK NINJAS! I NEED YOUR HELP! I have a firewall issue where any IP outside of our intranet, Splunk throws errors ... by charliedgz Path Finder in Splunk Search 02-07-2018 0 2	0	2
	Transacting with High Cardinality Groups and Memory Consumption of stats Data Set Characteristics We have an index containing ~100k events that are each about 1k in size, making a roughly 1... by kulick Path Finder in Splunk Search 02-07-2018 0 0	0	0
	How can I analyze different events where the field is the same but different keywords and get a count of events where one event led to another? Hi Experts, I have got a requirement where I have a few events where one of the fields contains some keyword say "Un... by macadminrohit Contributor in Splunk Search 02-07-2018 0 6	0	6
	How to pass a value to the \|inputlookup where , inside a subsearch I have a search: index=examp1 sourcetype=json application=myservice NOT [\|inputlookup aps_test_filter.csv where appl... by AVOLLMER Explorer in Splunk Search 02-07-2018 0 6	0	6
	How to calculate a percentage of distinct id's from a group of events which have never had a field matching a certain value? I have a group of log entries with an id field, and a status field. For a given id, over a given amount of time, stat... by dg_fuze New Member in Splunk Search 02-07-2018 0 3	0	3
	How can I search a lookup table for rows that match an input string in any field? I need to search a lookup table for rows that match an input string in any field. I've tried \|inputlookup...... \| se... by matstap Communicator in Splunk Search 02-07-2018 0 5	0	5
	Why am I receiving negative values for jenkins build times? Here is my search query, though this issue is common across a number of different custom searches we are attempting: ... by cdgill Explorer in Splunk Search 02-07-2018 0 3	0	3
	Using two seperate inputlookups I have two files which I have uploaded into Splunk, and both work as intended. One is a detailed file containing peo... by samwatson45 Path Finder in Splunk Search 02-07-2018 0 10	0	10
	How to make the date as header in table? I need to do a table which look like this (see below). As of now my table look like this How can I make the month... by katrinamara Path Finder in Splunk Search 02-07-2018 0 8	0	8
	Lookup works on one instance, but not another I'm seeing a weird issue - I have two Splunk instances, one for prod and one for dev. I have a lookup created that lo... by jwalzerpitt Influencer in Splunk Search 02-07-2018 0 5	0	5
	How can I display ONLY the overlay Total on a visualization? I'm trying to figure out how to display just the Total for an overlay instead of displaying the value of each stacked... by johnward4 Communicator in Splunk Search 02-07-2018 0 3	0	3
	How to extract a field using rex that may or may not be present? Consider I am having two string - "YY02State" and "Y02State" In the above strings, I have to extract the fields like... by Naren26 Path Finder in Splunk Search 02-07-2018 0 4	0	4
	How can I take keywords from a field in a search, compare them to another field in the search and the field values that match the keyword, bring them together? Hi All, I have two data fields, called "Issues" and "Complete issue" which look like this. What I want to do is th... by shiv1593 Communicator in Splunk Search 02-07-2018 0 2	0	2
	Parallel stats - most efficient structure I frequently have to create stats reports where some parts are, essentially, executable in parallel with others. An ... by JeToJedno Explorer in Splunk Search 02-07-2018 0 3	0	3
	Eval expression with gentimes is not generating new fileds Here is my SPL - \| gentimes start=02/07/2017 end=02/08/2017 increment=1h \| convert timeformat="%Y-%m-%d %H:%M:%S" ... by jagadeeshm Contributor in Splunk Search 02-07-2018 0 4	0	4