Splunk Search

Community Activity

How to replace the value when another field has "error"? If the "delta_value" is more than 2 then I'd like to replace the value1 to "error" Raw data No, _time, value1, de... by syokota_splunk Splunk Employee in Splunk Search 11-14-2017 0 8	0	8
how do I rank nodality from kmeans data I have been trying to do kmeans analysis of some data. I see some of my evaluation points falling into lots of clust... by MonkeyK Builder in Splunk Search 11-14-2017 0 2	0	2
Events from Docker do not have proper field extractions We are sending test data from a docker container to splunk via the splunk logging driver. I am able to vie the data b... by rwardwell Explorer in Splunk Search 11-14-2017 0 1	0	1
Windows Event Log 4625 - Eval Account_Name Search Issue Hello, I have the following search: index=security_wineventlog EventCode=4625 \| table _time, Workstation_Name, Sour... by zward Path Finder in Splunk Search 11-14-2017 0 2	0	2
Using Stats List to get multiple UserIDs into a single field by IP. Need to sort by UserID Might have trouble explaining this in an understandable way, might be why I was unable to google my answer. I'm usi... by GenericSplunkUs Path Finder in Splunk Search 11-14-2017 0 6	0	6
Why does geostats represent one and two arguments differently? Im trying to represent som values with geostats, when I do this: \| geostats values(OK) by name geostats present th... by snorri Path Finder in Splunk Search 11-14-2017 0 1	0	1
Can I do "add to search" without kicking off a new search? Sometimes when I am looking at search results, I would like to add several field's values to my search terms. Ideally... by MonkeyK Builder in Splunk Search 11-14-2017 1 1	1	1
Combine events based on timestamps in event I have events as following Category=a starttime="2017-11-14 05:25:22" Category=b starttime="2017-11-14 05:29:22" Cate... by manuarora12 New Member in Splunk Search 11-14-2017 0 2	0	2
How to group results from two rex together into one Column Chart? I am doing a search query where there will be a dynamic client ID with either a success or a failure result code -- ... by lordhans Explorer in Splunk Search 11-14-2017 0 2	0	2
eval to create temporary field for sorting I have a filed1 whose values are like below TS - asfdfe sdrerw TS - ieirrrr werr TS - ierr werflll BS - errriowr ere... by surekhasplunk Communicator in Splunk Search 11-14-2017 0 6	0	6
Can I custom code a Splunk table to include JSON in a cell (without having the line feeds/endings removed)? I have a Splunk application I am developing where I must put a pretty-print formatted JSON into the cell of a Splunk ... by jimdiconectiv Path Finder in Splunk Search 11-14-2017 0 7	0	7
Search for users logons from different geo locations I have build a query so far to look at users who log on from 2 different geo locations, however index=microsoft \|... by ecanmaster Explorer in Splunk Search 11-14-2017 0 1	0	1
Iist IPs from different columns Is it an easy way to list IP's from different columns into one? For instance, header ip1 ip2 ip3 ... by splunkrocks2014 Communicator in Splunk Search 11-14-2017 0 2	0	2
How can I write a search to find hosts that are not sending logs to Splunk or show the last time a host sent logs to Splunk? Hi we have list of hosts that are logging splunk and sending logs to splunk .Since when i created the lookup to check... by splunker969 Communicator in Splunk Search 11-14-2017 1 9	1	9
space in my field with the field I extracted with a regex Hi, Use a regex to extract some fields from my log with the regex101.com tool. but when I do the search for the mix ... by Carolina Engager in Splunk Search 11-14-2017 0 3	0	3
Strange behaviour with \| table * Hi all, I have some issues with the results from using \| table * I start with a simple data selection: source... by FrankSPL Path Finder in Splunk Search 11-14-2017 0 2	0	2
How to extract field with regex such as sentence with space Hi regex masters, Please help me. Below are sample xml logs. Incident Number: 151719935 Date Of Incident: 12/02... by syokota_splunk Splunk Employee in Splunk Search 11-14-2017 0 9	0	9
How to apply the fit command with a "by" field Hi Everyone, So I have data like this in my lookup table fields A \| B \| C 10\| 2 \| red 4 \| 6 \| red 9 \| 1 \| red... by tpirozzi Explorer in Splunk Search 11-14-2017 0 1	0	1
Almost no search results after upgrading to 7.0.0 Upgraded from 6.1 to 7.0 and now none of my old searches gives any results i.e dashboard searces. As a Splunk rookie... by erikwie Path Finder in Splunk Search 11-14-2017 0 4	0	4
How to trigger an action when no results are found (without using the settings in a saved alert) My organization using something called Ticketer to in Splunk to auto-generate an incident form when something shows u... by lordhans Explorer in Splunk Search 11-13-2017 0 3	0	3
single value trend with earliest I've got the followingsearch: \| stats values earliest(AG_Z) AS A_Z values earliest(D_AG) AS D_A_I \| eval eA_Z=strpt... by Mike6960 Path Finder in Splunk Search 11-13-2017 0 13	0	13
How to extract user behavior pattern during peak load from web access log From NFR perspective trying to figure out how to use Splunk to extract user behavior pattern during peak load conditi... by GaneshK New Member in Splunk Search 11-13-2017 0 2	0	2
How to make list(x) include all values? list(x) does not return all values. If I have white space as my value, list omits it. Here is a simplified example of... by jpayne1 New Member in Splunk Search 11-13-2017 0 2	0	2
Splunk Light Email Anonymization before Indexing Hello everybody, I am new to Splunk and I try to anonymize an email adress of my Logfile with the help of files pro... by mseidel New Member in Splunk Search 11-13-2017 0 2	0	2
We are getting error when we search with windows index , this is happening from past month Below is the error we got [hsplunkp01] Dispatch Runner: Configuration initialization for /opt/splunk/var/run/search... by Kaushikkatta03 Explorer in Splunk Search 11-13-2017 0 1	0	1