Splunk Search

Community Activity

Transaction : How to exclude Night hour and Week-end period time of duration calculation Hi, For calculate Application unavailable Time on Workhours, I try to find a solution to exclude period time : 7PM ... by romux Engager in Splunk Search 12-20-2017 0 2	0	2
length of string (Urgent Requirment pls) HI All. i want lenght of string with include space ,double quotes everything special charecters. \|eval length=len("E... by harishalipaka Motivator in Splunk Search 12-20-2017 0 5	0	5
How does punct work? NOTE: I figured that a lot of people will search "How does punct work?" and want to know. So if you were wondering: ... by cpeteman Contributor in Splunk Search 12-20-2017 3 5	3	5
How to convert monetary values to a single currency? Is there an app to provide exchange rates for this calculation? We have events containing amounts in different currencies that we would like to normalize into euros (for example). I... by marcusnilssonmr Path Finder in Splunk Search 12-20-2017 1 1	1	1
Inner search for database-fetched data I have fetching data to Splunk from a transaction tracker table. My scenario is as given below. Here is the example ... by biju3705 New Member in Splunk Search 12-19-2017 0 2	0	2
How to convert duration in seconds to [h]:mm:ss? Hi, I have a table with duration in seconds, how can I convert it to [h]:mm:ss? I want it to count the number of hou... by auaave Communicator in Splunk Search 12-19-2017 0 5	0	5
How to get response time from this search? How to get response time from my search? APIName is from my inputlookup \|inputlookup SolutionCenter.csv \| append [s... by karthi2809 Builder in Splunk Search 12-19-2017 0 10	0	10
Rex extraction question I'm pretty new to rex extraction using splunk and I can't figure out why my extraction isn't working. I have a raw e... by brajaram Communicator in Splunk Search 12-19-2017 0 3	0	3
count events in multivalue field Hi, I want to deal the multivalue field to get the counts whch is satisfied the conditions I set. For example, in... by perlish Communicator in Splunk Search 12-19-2017 0 7	0	7
Help with regex I have the below sample data sample 1 `<TargetCode key="Zip5">78216</TargetCode>` sample 2 <adm:TargetCode key="... by vrmandadi Builder in Splunk Search 12-19-2017 0 6	0	6
foreach with mvexpand to iterate over server fields and perform an expansion I have various fields like "Server 1" "Server 2" ... And I want to perform an expansion of those fields like so: ... by greggz Communicator in Splunk Search 12-19-2017 0 19	0	19
Field-extraction wizard error: "The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings." I just started indexing Windows printer logs and noticed I need to add some additional fields to extract. Here is an ... by snix Communicator in Splunk Search 12-19-2017 1 11	1	11
How to explicitly count an occurrence of a string when another similar string exists I am trying to count the occurrence of some specific strings in a field value. The below query works for counting occ... by WyldeRhoads Engager in Splunk Search 12-19-2017 0 2	0	2
How do I search for event with null values in fields I'm trying to find all events in the logs that have no value in a field. What's the simplest query for that? by JChodagam Splunk Employee in Splunk Search 12-19-2017 4 6	4	6
Eventtype and Subsearch problem after migration Hi everybody. After migrating splunk from one node to another I started having problems with eventtypes and subsearc... by danyx32 New Member in Splunk Search 12-19-2017 0 2	0	2
subsearch not running Hi at all, I have a very strange question: I have a search with a subsearch that's correctly running on a test enviro... by gcusello SplunkTrust in Splunk Search 12-19-2017 0 7	0	7
Use Regex to extract the fields I have data like- 2017-12-19 09:39:41\|INFO\|4b483c4b138de23b2f83a208c2313c4a\|8de3f071aed6401d9ff5c4289694e852\|a\|b\|c 2... by siddharthmis Explorer in Splunk Search 12-19-2017 0 6	0	6
How to split props/transforms from a standalone to an indexer clustering environment? I've got a multi-character delimited file, which looks something like this: "27-MAY-16 04.25.26.746000 AM"\|;\|""\|;\|"S... by coltwanger Contributor in Splunk Search 12-19-2017 0 11	0	11
Column Chart - Sorting months chronologically and not alphabetically Morning Splunk Gurus Can you tell me what is the simplest way of arranging months into order of date rather than alp... by DDewarSplunk New Member in Splunk Search 12-19-2017 0 11	0	11
timechart per month even if some months are missing data I have this search: index=alpha asset_id=100 \| timechart span=1mon latest(score) by asset_id This gives me a cha... by claatu Explorer in Splunk Search 12-19-2017 0 2	0	2
how can I set $SPLUNK_HOME remotely? Hi guys I am trying to deploy an app that contains a scripts that uses the variable $SPLUNK_HOME the issue comes whe... by asimagu Builder in Splunk Search 12-19-2017 0 2	0	2
Remove 99% of Data from a file with Transforms.conf I have data coming into SPLUNK [service] , but i only need the file name not the data in the file. The data is getti... by robertlynch2020 Influencer in Splunk Search 12-19-2017 0 6	0	6
Converting default table numeric format to Italy ( convert .(dot) values to ,(comma) values in table rows) Hi, My current requirement is showing the table values in Italy numeric format instead of default American format. I... by balachandar Engager in Splunk Search 12-19-2017 0 2	0	2
Splunk search join Hello, I am trying to join two searches so i could get number of declined transactions in time. First i look for inb... by Ponczi1 Explorer in Splunk Search 12-19-2017 0 5	0	5
EC2 instance uptime monthly basis The EC2 instances in my AWS environment are daily shutdown and startup on next day as per requirement. I want to deve... by samindradey New Member in Splunk Search 12-19-2017 0 4	0	4