Splunk Search

Community Activity

Issues with appendcols Hi everybody, I have a problem with an "appendcols" command. I have a query which needs to count how many times a fi... by netanelm7 Path Finder in Splunk Search 12-12-2017 0 3	0	3
Pie chart syntax for disk use I have the values I just don't have the syntax. host="app-1" source="df" \| stats max(storage_used) as storage_used b... by fsrodriguez New Member in Splunk Search 12-12-2017 0 3	0	3
Search log for alert Have good day for Everybody Pls help me to search exactly the content. My input log is: status system replication si... by dangtran Explorer in Splunk Search 12-12-2017 0 5	0	5
Compare the output of two searches and timechart the latest output only if different than the the older output I have two timecharts that only hit on http status code of 500 (one for the past hour and one for the same hour but l... by robrang558 Explorer in Splunk Search 12-12-2017 0 8	0	8
Running Specific Query Based on Radio Button Selection? Hello, I'm attempting to use a Splunk view to edit a Lookup table based on an input field and a radio button selecti... by meechy85 New Member in Splunk Search 12-12-2017 0 3	0	3
how to Combine results of a lookup and an index? Hi There. I have a lookup like below. end_date activity description start_date 1496325600 run XYZ ... by snipedown21 Path Finder in Splunk Search 12-12-2017 0 1	0	1
joining multiple select statements in dbxquery How to join multiple select statements in dbxquery Need to display output as Total Defects 532 Open defects 147 Close... by kishen2017 Path Finder in Splunk Search 12-12-2017 0 5	0	5
Time picker doesn't pass time to search? Hey everyone, I'm building a simple dashboard to show some info about SFTP traffic. I'm using a time picker to pick t... by belle501 Path Finder in Splunk Search 12-12-2017 0 2	0	2
How to make a line chart that shows 6 months of data with each datapoint being a sum of the previous 6 months? Im trying to show a trend in event data by platform. I want to create a line chart showing the last 6 months with on... by glenngermiathen Path Finder in Splunk Search 12-12-2017 0 2	0	2
Search Query Total Browsing time per user in a month. Hi Splunkers, I want to generate a catogery wise Browsing time report per user. Here is my search given below : hos... by jibin1988 Path Finder in Splunk Search 12-12-2017 0 3	0	3
Percentage calculation based on derived value and show it is as new row My data looks something like below, here first two rows are indexed data and 3,4th rows are derived data and added as... by deepa_purushoth Engager in Splunk Search 12-12-2017 0 1	0	1
Having trouble with field extractor on 7.0 I have ton a couple of events like this: Mime.stuff.1 = 10 Mime.pop = "blabla" Basically I want to create a field "... by greggz Communicator in Splunk Search 12-12-2017 0 5	0	5
How to combine WinHostMon and Perfmon data to get CPU usage per MSSQL server instance? The goal here is to get CPU usage per SQL instance. As far as I can tell there is no perfmon counter that will give y... by kamgineer Explorer in Splunk Search 12-12-2017 0 1	0	1
What is the regex for the following output ? Query : "POST" "200" "api/platform/v1/Session" FirmName Output: Level="INFO", Date="2017-12-12 04:06:26,200", Messag... by JyotiP Path Finder in Splunk Search 12-12-2017 0 2	0	2
How to get all field values from large "\| stats values(field)" command? Any search that has many field values and ends in "\| stats values(field)" will show a short list of field values foll... by woodcock Esteemed Legend in Splunk Search 12-12-2017 1 2	1	2
How to hide a field from the legend in a bar chart? Hi, My current search I'm using to populate the value is given below. source= transaction.csv \| stats values(A... by Shan Builder in Splunk Search 12-12-2017 0 7	0	7
How to build a query from 2 different multivalue inputs I have a bunch of indexes in the format of <environment>-<machineType> This is something like test-manager, staging-... by ByteFlinger Engager in Splunk Search 12-12-2017 0 2	0	2
How to subtract one date from another? I hold a list of two dates that I want to subtract one from another these dates are an outcome from: \|conv... by eranday New Member in Splunk Search 12-12-2017 0 7	0	7
How do to a "dedup" on a single event? I have events which have multiple of the same fields but with different values. E.g; Event 1: deviceName="device1" a... by ZacEsa Communicator in Splunk Search 12-12-2017 0 13	0	13
How to perform search only using PhoneNum? I have 2 sourcetypes: Eg. sourcetypeA has fields such as ServiceProvider, GroupID, DeviceUsed, DeviceSerialNum ... by hkchew New Member in Splunk Search 12-12-2017 0 4	0	4
Simple Column sorting (with variable column name) Hi Guys context: i want a table grouped by region, count per region and quarter in a table for example Re... by christianhuber Path Finder in Splunk Search 12-12-2017 0 2	0	2
How to add a new column to existing stats result after performing a calculation on each value in a column ? Hi I am new to splunk and still exploring it. How do i create a new result set after performing some calculation on e... by UdayAditya New Member in Splunk Search 12-11-2017 0 5	0	5
Can I create a threat intelligence lookup that automatically updates the list of known, bad ip addresses from threat intel websites? I'd like to be able to create lookups of known bad ip addresses (SANS, BOGON, etc) and have the lookups update automa... by b_bunch New Member in Splunk Search 12-11-2017 0 1	0	1
How to remove duplicate events in INDEX , not on Search ? I do have many data including duplicate data , and i want to remove duplicate data from the index , without using th... by jadengoho Builder in Splunk Search 12-11-2017 0 5	0	5
Jirarest add-on returning a subset of results I'm using the Jirarest add-on in the following way, passing through a specific search (sometimes with changelog): \| ... by SplunkIsLife Explorer in Splunk Search 12-11-2017 0 2	0	2