Splunk Search

Community Activity

searching across multiple indexes with lookups we have two indexes with some overlap in fields. specifically IP addresses. what I would like to is do an initial s... by caseysutherland Engager in Splunk Search 12-20-2017 0 4	0	4
Count of events based on two where conditions Hello All, I have to provide two where conditions in my query and need to count the events by individual counts and ... by bharathkumarnec Contributor in Splunk Search 12-20-2017 0 7	0	7
Left JOIN using two searches I have these two searches below and I want to join the fieldname Path from the first query to the second query using ... by davidcraven02 Communicator in Splunk Search 12-20-2017 0 8	0	8
rex to extract a field How do I extract connection attempt failed from the below log 2017-12-20T07:51:05.847Z I REPL [ReplicationExe... by Mohsin123 Path Finder in Splunk Search 12-20-2017 0 3	0	3
How to format the duration on weekly summary Hi, I have the below Query. I want to have the sum of duration per week / description on time format [h]:mm:ss. On l... by auaave Communicator in Splunk Search 12-20-2017 0 2	0	2
Erex example Hi, I have the below log and values for "days" field are 4, 10 , 15, 30. Could you please extract the "days" fi... by amarish_vlabs New Member in Splunk Search 12-20-2017 0 9	0	9
How to search for values in a lookup table with wildcard My lookup table is a simple list of malicious domains. How can I do a search such that I can search for the maliciou... by DEAD_BEEF Builder in Splunk Search 12-20-2017 0 5	0	5
Transaction : How to exclude Night hour and Week-end period time of duration calculation Hi, For calculate Application unavailable Time on Workhours, I try to find a solution to exclude period time : 7PM ... by romux Engager in Splunk Search 12-20-2017 0 2	0	2
length of string (Urgent Requirment pls) HI All. i want lenght of string with include space ,double quotes everything special charecters. \|eval length=len("E... by harishalipaka Motivator in Splunk Search 12-20-2017 0 5	0	5
How does punct work? NOTE: I figured that a lot of people will search "How does punct work?" and want to know. So if you were wondering: ... by cpeteman Contributor in Splunk Search 12-20-2017 3 5	3	5
How to convert monetary values to a single currency? Is there an app to provide exchange rates for this calculation? We have events containing amounts in different currencies that we would like to normalize into euros (for example). I... by marcusnilssonmr Path Finder in Splunk Search 12-20-2017 1 1	1	1
Inner search for database-fetched data I have fetching data to Splunk from a transaction tracker table. My scenario is as given below. Here is the example ... by biju3705 New Member in Splunk Search 12-19-2017 0 2	0	2
How to convert duration in seconds to [h]:mm:ss? Hi, I have a table with duration in seconds, how can I convert it to [h]:mm:ss? I want it to count the number of hou... by auaave Communicator in Splunk Search 12-19-2017 0 5	0	5
How to get response time from this search? How to get response time from my search? APIName is from my inputlookup \|inputlookup SolutionCenter.csv \| append [s... by karthi2809 Builder in Splunk Search 12-19-2017 0 10	0	10
Rex extraction question I'm pretty new to rex extraction using splunk and I can't figure out why my extraction isn't working. I have a raw e... by brajaram Communicator in Splunk Search 12-19-2017 0 3	0	3
count events in multivalue field Hi, I want to deal the multivalue field to get the counts whch is satisfied the conditions I set. For example, in... by perlish Communicator in Splunk Search 12-19-2017 0 7	0	7
Help with regex I have the below sample data sample 1 `<TargetCode key="Zip5">78216</TargetCode>` sample 2 <adm:TargetCode key="... by vrmandadi Builder in Splunk Search 12-19-2017 0 6	0	6
foreach with mvexpand to iterate over server fields and perform an expansion I have various fields like "Server 1" "Server 2" ... And I want to perform an expansion of those fields like so: ... by greggz Communicator in Splunk Search 12-19-2017 0 19	0	19
Field-extraction wizard error: "The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings." I just started indexing Windows printer logs and noticed I need to add some additional fields to extract. Here is an ... by snix Communicator in Splunk Search 12-19-2017 1 11	1	11
How to explicitly count an occurrence of a string when another similar string exists I am trying to count the occurrence of some specific strings in a field value. The below query works for counting occ... by WyldeRhoads Engager in Splunk Search 12-19-2017 0 2	0	2
How do I search for event with null values in fields I'm trying to find all events in the logs that have no value in a field. What's the simplest query for that? by JChodagam Splunk Employee in Splunk Search 12-19-2017 4 6	4	6
Eventtype and Subsearch problem after migration Hi everybody. After migrating splunk from one node to another I started having problems with eventtypes and subsearc... by danyx32 New Member in Splunk Search 12-19-2017 0 2	0	2
subsearch not running Hi at all, I have a very strange question: I have a search with a subsearch that's correctly running on a test enviro... by gcusello SplunkTrust in Splunk Search 12-19-2017 0 7	0	7
Use Regex to extract the fields I have data like- 2017-12-19 09:39:41\|INFO\|4b483c4b138de23b2f83a208c2313c4a\|8de3f071aed6401d9ff5c4289694e852\|a\|b\|c 2... by siddharthmis Explorer in Splunk Search 12-19-2017 0 6	0	6
How to split props/transforms from a standalone to an indexer clustering environment? I've got a multi-character delimited file, which looks something like this: "27-MAY-16 04.25.26.746000 AM"\|;\|""\|;\|"S... by coltwanger Contributor in Splunk Search 12-19-2017 0 11	0	11