Splunk Search

Community Activity

How can I analyze different events where the field is the same but different keywords and get a count of events where one event led to another? Hi Experts, I have got a requirement where I have a few events where one of the fields contains some keyword say "Un... by macadminrohit Contributor in Splunk Search 02-07-2018 0 6	0	6
How to pass a value to the \|inputlookup where , inside a subsearch I have a search: index=examp1 sourcetype=json application=myservice NOT [\|inputlookup aps_test_filter.csv where appl... by AVOLLMER Explorer in Splunk Search 02-07-2018 0 6	0	6
How to calculate a percentage of distinct id's from a group of events which have never had a field matching a certain value? I have a group of log entries with an id field, and a status field. For a given id, over a given amount of time, stat... by dg_fuze New Member in Splunk Search 02-07-2018 0 3	0	3
How can I search a lookup table for rows that match an input string in any field? I need to search a lookup table for rows that match an input string in any field. I've tried \|inputlookup...... \| se... by matstap Communicator in Splunk Search 02-07-2018 0 5	0	5
Why am I receiving negative values for jenkins build times? Here is my search query, though this issue is common across a number of different custom searches we are attempting: ... by cdgill Explorer in Splunk Search 02-07-2018 0 3	0	3
Using two seperate inputlookups I have two files which I have uploaded into Splunk, and both work as intended. One is a detailed file containing peo... by samwatson45 Path Finder in Splunk Search 02-07-2018 0 10	0	10
How to make the date as header in table? I need to do a table which look like this (see below). As of now my table look like this How can I make the month... by katrinamara Path Finder in Splunk Search 02-07-2018 0 8	0	8
Lookup works on one instance, but not another I'm seeing a weird issue - I have two Splunk instances, one for prod and one for dev. I have a lookup created that lo... by jwalzerpitt Influencer in Splunk Search 02-07-2018 0 5	0	5
How can I display ONLY the overlay Total on a visualization? I'm trying to figure out how to display just the Total for an overlay instead of displaying the value of each stacked... by johnward4 Communicator in Splunk Search 02-07-2018 0 3	0	3
How to extract a field using rex that may or may not be present? Consider I am having two string - "YY02State" and "Y02State" In the above strings, I have to extract the fields like... by Naren26 Path Finder in Splunk Search 02-07-2018 0 4	0	4
How can I take keywords from a field in a search, compare them to another field in the search and the field values that match the keyword, bring them together? Hi All, I have two data fields, called "Issues" and "Complete issue" which look like this. What I want to do is th... by shiv1593 Communicator in Splunk Search 02-07-2018 0 2	0	2
Parallel stats - most efficient structure I frequently have to create stats reports where some parts are, essentially, executable in parallel with others. An ... by JeToJedno Explorer in Splunk Search 02-07-2018 0 3	0	3
Eval expression with gentimes is not generating new fileds Here is my SPL - \| gentimes start=02/07/2017 end=02/08/2017 increment=1h \| convert timeformat="%Y-%m-%d %H:%M:%S" ... by jagadeeshm Contributor in Splunk Search 02-07-2018 0 4	0	4
How to create a search with eval where you know the value of the field 'sum' and save the sum's value in a variable? Not sure if this can be achieved by eval command. A bit silly question indeed. "I want to know the value of the fiel... by zacksoft Contributor in Splunk Search 02-07-2018 0 12	0	12
Conversion to UNIX time I want to convert my default _time field to UNIX/Epoch time and have it in a different field. This is how the Time fi... by zacksoft Contributor in Splunk Search 02-07-2018 0 8	0	8
Get just 7 characters of field to search I have a userID with 9 characters and want to search a lookup with just 7 characters. I have tried to use RegEx but ... by dlcrooks Explorer in Splunk Search 02-07-2018 0 4	0	4
Can I concatenate a complete search query to the already filtered stats results which only executes if an input checkbox is checked I want to add a checkbox input which just concatenates my search with something like " \| search Error" if I check tha... by varun99 Path Finder in Splunk Search 02-06-2018 0 2	0	2
How can I compare 2 latest events and search for the second latest event by host? Hi, I'd like to create a search that detects a failover, i.e. it would compare the two latest events by host and whe... by packland Path Finder in Splunk Search 02-06-2018 0 2	0	2
How to create Splunk query to validate missing Domain Controller security log events? As we are using the AD Domain Controller security logs for audit purposes, we want a query to validate there are no m... by rhysbee New Member in Splunk Search 02-06-2018 0 0	0	0
How to extract and find the difference in time between two fields using regex? Hi , I have 2 events like below and I need to find the difference in time between 2 events. There may be a lot of o... by rrkollip New Member in Splunk Search 02-06-2018 0 7	0	7
How can I sort field values depending on the another field values ? PFB the search query that I am using for my panel. PFA the view of th dashboard as well. index=scampservices OSIT4 ... by varun99 Path Finder in Splunk Search 02-06-2018 0 3	0	3
How can I build regex to extract data from unstructured Domain Time Logs? Hi, Log files contain header and summary information in the beginning of the file. The number of header + summary li... by neltonk Path Finder in Splunk Search 02-06-2018 0 3	0	3
How to create two searches combined into one chart, or timechart with calculated percent of total (rate) by fields? I have transactions logged across different sales "channels" (catering, mobileApp, faceToFace, etc.). I am trying to ... by rvazquez8113 New Member in Splunk Search 02-06-2018 0 2	0	2
Why is coalesce working only for one of the two fields I am combining, depending on the sequence the fields are being combined? I have two existing fields - "narrative" and "alarm_type" that I am trying to combine into a new single field "alert_... by christopheryu Communicator in Splunk Search 02-06-2018 1 3	1	3
How can I create a lookup where if the user is not found, the result should be NULL? When searching a lookup and the user is not found then I need the result to be NULL. Any ideas? by dlcrooks Explorer in Splunk Search 02-06-2018 0 3	0	3

Get Updates on the Splunk Community!

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

To help practitioners build a stronger foundation, we launched the Data Management & Federation ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games Think you have what it takes to beat the clock? ...

Splunk Search

How can I analyze different events where the field is the same but different keywords and get a count of events where one event led to another?

How to pass a value to the |inputlookup where , inside a subsearch

How to calculate a percentage of distinct id's from a group of events which have never had a field matching a certain value?

How can I search a lookup table for rows that match an input string in any field?

Why am I receiving negative values for jenkins build times?

Using two seperate inputlookups

How to make the date as header in table?

Lookup works on one instance, but not another

How can I display ONLY the overlay Total on a visualization?

How to extract a field using rex that may or may not be present?

How can I take keywords from a field in a search, compare them to another field in the search and the field values that match the keyword, bring them together?

Parallel stats - most efficient structure

Eval expression with gentimes is not generating new fileds

How to create a search with eval where you know the value of the field 'sum' and save the sum's value in a variable?

Conversion to UNIX time

Get just 7 characters of field to search

Can I concatenate a complete search query to the already filtered stats results which only executes if an input checkbox is checked

How can I compare 2 latest events and search for the second latest event by host?

How to create Splunk query to validate missing Domain Controller security log events?

How to extract and find the difference in time between two fields using regex?

How can I sort field values depending on the another field values ?

How can I build regex to extract data from unstructured Domain Time Logs?

How to create two searches combined into one chart, or timechart with calculated percent of total (rate) by fields?

Why is coalesce working only for one of the two fields I am combining, depending on the sequence the fields are being combined?

How can I create a lookup where if the user is not found, the result should be NULL?

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

Announcing Modern Navigation: A New Era of Splunk User Experience

Casting Call: Compete in Cyber Games

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation