Splunk Search

Community Activity

How to search for a event then check ocurrence during a period of time using another SPL Ok, so here is my question These 3 lines denote possible values for scheduled downtime MSG WHEN DOWNTIME START ST... by zanoefel New Member in Splunk Search 11-27-2017 0 1	0	1
Need help with rex extraction including double quotes and slashes Hi, I am currently trying to extract the numbers from this field example: message.data ... {\"MyID\":\"111111\", ... by gamerkhang New Member in Splunk Search 11-27-2017 0 3	0	3
How to combine continuous values within 5 minutes? Hi Experts, I'd like to filter the record when the "delta_value" has the same value within 15 seconds (or repeats 3 t... by syokota_splunk Splunk Employee in Splunk Search 11-27-2017 0 10	0	10
How to remove zeros from appearing on my stacked column chart? I am trying to get a stacked column chart with items sold by agent at each location. I have the below search: stats... by chintan_shah Path Finder in Splunk Search 11-27-2017 1 2	1	2
Parse a string into multiple fields for my App - Custom Parser I have a custom log as below: 1 2017-11-27T09:42:05.449123+00:00 generus0002 Sonahock - - [timeQuality tzKnown="1" i... by rajim Path Finder in Splunk Search 11-27-2017 0 2	0	2
Find call duration I am trying to find the amount of time people are on the phone to the help desk but are not getting any results back ... by DanielASG Explorer in Splunk Search 11-27-2017 0 8	0	8
Search and Alert produce different results When I type this search in the normal Splunk search app, I get normal expected results: "usb" \| transaction host sta... by jlbark Explorer in Splunk Search 11-27-2017 0 4	0	4
Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer The error message that I got is this one. But I found that it is a general error and would like to know the root caus... by daniel_splunk Splunk Employee in Splunk Search 11-27-2017 4 4	4	4
Using non timestamp field to produce search for yesterday I have a date field called "Closed date" in following format "%Y/%m/%d" that IS NOT my timestamp field & want to crea... by jackreeves Explorer in Splunk Search 11-27-2017 0 5	0	5
Splunk refuses to ingest particular variable I am attempting to retrieve the SNMP metrics ifHCInOctet and ifHCOutOctet. I have a Python script that does this. Wh... by EricLloyd79 Builder in Splunk Search 11-27-2017 0 38	0	38
How to calculate time between events within a session I have events like session_id = 1 device_time = 2017-11-26T12:13:32 session_id = 1 device_time = 2017-11-26T12:13:35... by jy190 New Member in Splunk Search 11-27-2017 0 5	0	5
Pattern: loopable lookup table to bypass map subsearch limits - looking for feedback This is not so much a question. But I don't see a solutions.splunk.com, so I will post this solution here, improve i... by MonkeyK Builder in Splunk Search 11-27-2017 1 10	1	10
Query for Splunkd Status Hi Guys, There's any query in the splunk web that I'm able to see if the splunkd is not running in a forwarder? Tks... by wvalente Explorer in Splunk Search 11-27-2017 0 4	0	4
Arithmatic operations based on selected rows Hi, I am a beginer My data something like this CategoryGroup \| Category \|Price A\|A1\|1 B\|B1\|2 B\|B2\|3 C\|C1\|1 C\|C2\|2 C\|C... by deepa_purushoth Engager in Splunk Search 11-27-2017 0 9	0	9
how to find equal values In my data I have event which contain requests and answers for that requests In the initial request i have a field "R... by Mike6960 Path Finder in Splunk Search 11-27-2017 0 19	0	19
eval command after stats command not working Hi, I'm having a problem with this search: index="pcmm" "Technical Proficiency"!=NA \| stats count("Resource Name")... by jvmerilla Path Finder in Splunk Search 11-26-2017 0 8	0	8
How to assign value for muliselect option with another token? Hi , I have a token $hosstype$ which will get values as 'web', 'rpt' etc. If All option is selected the value to be p... by sangs8788 Communicator in Splunk Search 11-26-2017 0 5	0	5
Search string to filter filed not updated in last 24 hours Hi, I use the below search to filer the source which were not updated on current day(Today) index=index sourcetype=... by Gowtham0809 New Member in Splunk Search 11-26-2017 0 3	0	3
How to ignore failed seq ids? Hello Seniors, I have the below log snippet 11/7/17 8:37:25 PM [INFO] \|Send\|staring to send\|seq id "234567" 11/7/17 ... by Deepz2612 Explorer in Splunk Search 11-25-2017 0 10	0	10
"Join" information from two log sources I have two sourcetypes with data as follows: First sourcetype: tx_id=1, event=error, extra=foo tx_id=1, event=erro... by mpdude Explorer in Splunk Search 11-25-2017 0 4	0	4
Not using chartTime or bucket -- I want this search to display the trend for daily, week and monthly in signal query Mongo Collection Data : - Id : 1 StartDate : some date EndDate : Some Date X : Foo : “foo1’ Count : 1... by jw44250 New Member in Splunk Search 11-25-2017 0 6	0	6
corresponding cell addition column wise for each row in splunk dashoard. Hi, Do we have a feature in splunk to add 1st row.field1 from 2 different panels and sum it in another panel. i ha... by surekhasplunk Communicator in Splunk Search 11-25-2017 0 3	0	3
How to find difference in field total over time? I have event data in below format: Sep 15 2017 07:06:07 app=yahoo dataconsumed=50 Sep 15 2017 08:16:07 app=... by sohaibomar Explorer in Splunk Search 11-25-2017 0 4	0	4
Is there any more accurate way to correlate it? Good moring,everyone. I have some events. They come from the same sourcetype.I want to get a detailed registration i... by xsstest Communicator in Splunk Search 11-25-2017 0 2	0	2
Stats table manipulation I created the following search to audit the changes made to our network infrastructure: (index=ise Protocol=Tacacs ME... by _smp_ Builder in Splunk Search 11-25-2017 0 12	0	12