Splunk Search

Community Activity

How to add time values together in search query? Basically just trying to add three time values together by doing this: eval total_time = queue_time + Duration + test... by cdgill Explorer in Splunk Search 01-30-2018 0 7	0	7
How to add values from two CSV files? I have multiple tables, can I add/OR/AND... on each cell of all the tables? For example, if I have below two tables,... by fzhao2 Engager in Splunk Search 01-30-2018 0 2	0	2
How to show multiple values in a Pie chart? Hi All, I have a dashboard, which contains a pie chart, that looks like this. As visible, there are only 5 values... by shiv1593 Communicator in Splunk Search 01-30-2018 0 6	0	6
How to create a table using different fields? i have this kind of data: event 1: field_name=field_value status="process" status_file="file_name" event 2: fiel... by chandana204 Communicator in Splunk Search 01-30-2018 0 2	0	2
Why does Field extraction requires trim? My iis data has a field name cs_uri_query, for example: Cmd=Sync&User=XYZ%5Cjqpublic%40xyz.com&DeviceId=SEC539D6F312... by JarrettM Path Finder in Splunk Search 01-30-2018 0 3	0	3
Why am I getting different Results when using a token in a timechart count By Action search compared to when I use the same search without the tokens? I am Trying to build a Dashboard based on the below search with a drop down picker for time span and a drop down Butt... by tnoelOTS Explorer in Splunk Search 01-30-2018 0 1	0	1
How to rename a dynamic header name? Hi, I need to format a search very specifically so that the client's automation receives a report correctly. All I ne... by Uwbspeicher New Member in Splunk Search 01-30-2018 0 3	0	3
how to find the average response time per minute for a selected timerange? Hello, I am doing a search for selected timerange 27th to 28th index=abc... \| bucket _time span=1d\|eval Time=strfti... by vrmandadi Builder in Splunk Search 01-30-2018 0 8	0	8
What search string do I need to get Pie Graph by Field Value? I don't know why this is so hard, but I'm having issues creating a simple pie chart. I'm relatively new to Splunk and... by jroes014 New Member in Splunk Search 01-30-2018 0 5	0	5
I am using a lookup table and I only want the results that have a match in the look up table. lookup Down.csv node AS host, BBB AS Circuit Table host,Circuit,msg,_time,node, BBB I only want events to hit the t... by jamesfdally Explorer in Splunk Search 01-30-2018 0 9	0	9
How to get multiple events in single row of table? I search logs for these strings: "member left" OR "left cluster" OR "asking member". It gives below output. These ev... by archananaveen Explorer in Splunk Search 01-30-2018 0 5	0	5
How to get the type extracted in regex? Hi, I have this data and I'm challenged (not hard to do) on how to get the type extracted. On the first line type=... by dbcase Motivator in Splunk Search 01-30-2018 0 15	0	15
How to write a regular expression to extract and count the number of calls per URL from Apache web access logs? Hi, I am trying to analyse the Apache web access logs for the below textpayload: IP -- [Date +0000] "POST /PATH/URI... by macadminrohit Contributor in Splunk Search 01-30-2018 0 1	0	1
How to use rex and sed to remove field prefix? I would like to remove a prefix from a field where certain criteria are met but leave the prefix on on fields where c... by dmcintosh1972 Explorer in Splunk Search 01-30-2018 0 1	0	1
How to get event count hourly the last 7 days graph each day need to display different line ? one particular system event count hourly the last 7 days graph each day need to display different line X - axis -- ... by kumar22 New Member in Splunk Search 01-30-2018 0 5	0	5
How to use a event value to create new field I have a event that returns me this what i want is to have a new field that will solve the equation like number... by jadengoho Builder in Splunk Search 01-30-2018 0 1	0	1
How to get active VPN Sessions Cisco ASA Logs with Datamodel? Hello together, I probe to get the active session count from our asa logs per minute. I created a datamodel (CASA) w... by ronpestler1 Explorer in Splunk Search 01-30-2018 0 0	0	0
How to add trend to event counts? I have the below search which shows 3 columns....the field1, index list and count of events. How can I add a trend li... by ReachDataScient Explorer in Splunk Search 01-30-2018 0 2	0	2
How to display the event count per index and distinct host count per index with a trend line. How to display the event count per index and distinct host count per index with a trend line. by ReachDataScient Explorer in Splunk Search 01-29-2018 0 2	0	2
Duration of a single event Splunkers! I need to compute the duration of a event, as the difference between the two field (END_TIME and OPEN_TIM... by CarmineCalo Path Finder in Splunk Search 01-29-2018 0 3	0	3
Why does my search not finish? index="king" source ="/King/East" I am confused why my search doesn't finish. I have a '2 month window' applied to t... by fraser8 Engager in Splunk Search 01-29-2018 1 3	1	3
how to search for a field containing timedate relative to todays date? I have a field named "Expiry date" that contains future dates. I want to make a search that list will all entries tha... by zaynaly Explorer in Splunk Search 01-29-2018 0 5	0	5
What is the search range given for beginning and end query? Given the following log lines: Alpha Beta Gamma Hello World Soup I would like to query ` \| first="Beta" \| last="W... by thomasreggi New Member in Splunk Search 01-29-2018 0 1	0	1
How to fix the mismatched bracket in regex? Hi, I have the below regex and Splunk keeps telling me I have a mismatched "[" and for the life of me I can't figure... by dbcase Motivator in Splunk Search 01-29-2018 0 2	0	2
How to pair values of the "FIELD" with values of the "VALUE" field? I'm trying to figure out the best way to extract values currently displayed under the field name "FIELD", for example... by johnward4 Communicator in Splunk Search 01-29-2018 0 6	0	6