Splunk Search

Community Activity

Why are there two different time formats in the columns? Hi - I had splunk import a fairly simple two column file - column 1 was a date/time column2 is some info... the probl... by tb5821 Communicator in Splunk Search 02-10-2018 0 14	0	14
Have an alert where there is violation of license and a search where top 10 consumers of license, how do i combine both , where if there is a violation of license send me alert with top consumers? Is it possible? Have an alert where there is violation of license and a search where top 10 consumers of license, how do i combine bo... by sarwshai Communicator in Splunk Search 02-10-2018 1 3	1	3
Help with Chart overlay over Bar chart Hi All, Need help in building below visualization having overlay. x-axis - represents hour [24 hour format] y-axis ... by newbie2tech Communicator in Splunk Search 02-09-2018 0 4	0	4
How can I change a field to a date field? Hello Everyone I have a field Month which has values like April 2017, May 2018,... I am calculating with these usin... by maria2691 Path Finder in Splunk Search 02-09-2018 0 4	0	4
Why are the values disappearing in timechart and sparklines? I have an intermittent problem with some of my timecharts and sparklines, where the results will start to render corr... by tschrantz New Member in Splunk Search 02-09-2018 0 2	0	2
Unknown error message from Admin Manager Hi, has anyone seen the error message below? ERROR AdminManager - Argument "actual_only" is not supported by this ... by kochera Communicator in Splunk Search 02-09-2018 2 8	2	8
How to separate SNMP GETBULK ARP table MIB Data into something readable? Hi Guys I'm fairly new to Splunk and SPL can someone help me break the below data into readable fields? RFC1213-MIB:... by pzharyuk New Member in Splunk Search 02-09-2018 0 3	0	3
Monitoring Static file Hi there, I am trying to monitor a file that doesn't change often - WebSphere nodeagent monitor.state file. I unders... by aina_sloan New Member in Splunk Search 02-09-2018 0 9	0	9
Why am I getting a "extracting multiple fields" error when try to extract fields on a log file that contains XML? Hi, I am trying to do a field extraction on a log file that contains XML as below however when I try to extract the ... by bradleycruicksh New Member in Splunk Search 02-09-2018 0 3	0	3
How can I return a list of distinct users and the number of connections from IIs logs? I want to get a list of distinct Users from IIs logs using the CS_USERNAME field Any examples out there for me to get... by lbonnes Observer in Splunk Search 02-09-2018 0 1	0	1
How to count the number of occurrences of a string in multiple fields? I have a team of Unix admins, each of which manages multiple applications. I created a CSV lookup file that contains ... by pfhendr Explorer in Splunk Search 02-09-2018 0 6	0	6
Comparing two files and output the difference for one column Hope you can help ! I have two CSV files: RESULTS1 and RESULTS2 RESULTS1 has two columns CAR T... by Derben New Member in Splunk Search 02-09-2018 0 10	0	10
Why is streamstats resetting incorrectly twice in the dataset when it should not be? Hey all, we are having a bit of trouble with the streamstats command, as the title indicates. The following code retu... by DigitalBibleSoc New Member in Splunk Search 02-09-2018 0 5	0	5
How do I formulate a regex to discard events when applying sourcetype? Hello, I'm currently creating a new sourcetype that has a TRANSFORMS-null setting with value discardit. Within my tr... by andrewtrobec Motivator in Splunk Search 02-09-2018 0 8	0	8
Does splunk user should query data using Index value? Hello All, can users in splunk query data without using the index defined in search query? i mean can user search da... by saifuddin9122 Path Finder in Splunk Search 02-09-2018 0 3	0	3
eval,passing a value in eval Hi all, Please help me … not been success in passing the output of the search into a new search (different table).... by jaygamini New Member in Splunk Search 02-09-2018 0 1	0	1
How to split a table-formatted event into multiple events during search time? Is it possible to have each piece of software as an event of its own so that I could search for a particular item? C... by davidcraven02 Communicator in Splunk Search 02-09-2018 0 2	0	2
Field extrations from XmlWinEventLog Hi, I've been trying to find a good solution to extract fields from some XML windows event logs. For instance sourcet... by hcpr Path Finder in Splunk Search 02-09-2018 0 4	0	4
How to remove all null fields to prevent gaps in my table of results? Hi there, I have a table with four fields inputted, but the issue is that some are blank in some of the events so it ... by gracemaher Explorer in Splunk Search 02-08-2018 2 11	2	11
Search inside the files based on keywords to do sub search in splunk I have following types of txt files in my source and contents of each files are mentioned below in CAPS: a1.txt: ... by rojit Explorer in Splunk Search 02-08-2018 0 9	0	9
Cannot Call A Search Command from Search Macro Hello everyone; I am trying to call a search command from a search macro. Does anyone have a suggestion. Example: Ty... by spraus Explorer in Splunk Search 02-08-2018 0 6	0	6
Why does Splunk suggest using Regex101.com? The Regex I create extract fields inside the Regex101 site, but do nothing in Splunk. What gives? Regex in use on R... by panderla Loves-to-Learn Lots in Splunk Search 02-08-2018 0 9	0	9
How can I reverse grouping in nested JSON block? I have a JSON block that contains one account id and a number of nested resources. I can easily get a list of resourc... by a238574 Path Finder in Splunk Search 02-08-2018 0 0	0	0
Is it possible to add "starting the search" to the link switcher option? Hi, I would like to implement some options to show/hide panels in a dashbaord. Currently the plan to have an option ... by HeinzWaescher Motivator in Splunk Search 02-08-2018 0 4	0	4
How to join two tables? Hi All, I have a search: \| savedsearch Cycle_11 \| append [\| savedsearch Cycle_10] with the results: ... by jvmerilla Path Finder in Splunk Search 02-08-2018 0 10	0	10