Splunk Search

Community Activity

How can I search for all domains for "All Time" and limit results by second criteria -- First seen date of today or yesterday? Hey All, Sorry if this is a duplicate, or already been answered, but I've tried numerous ideas from posts, and the d... by ag100 Explorer in Splunk Search 10-20-2017 0 4	0	4
How do you write rex to extract unstructured field? I have the below log. I want to extract the sixth column as a field, in that column I have different types values. So... by haja4nhn New Member in Splunk Search 10-20-2017 0 7	0	7
How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process. Hi ,For my current project i need to implement a Tracker functionality which basically shows various phases of Onboar... by shivendra_infy Path Finder in Splunk Search 10-20-2017 0 10	0	10
Use other events fields as a field for your search Hi, I need to use events on a data source as a reference for other events Example: ID . \| Name . \|Type . \| IDC... by pmgahan New Member in Splunk Search 10-20-2017 0 9	0	9
Search data for All Time but only graph a specified time range Hello, I am charting IT help desk tickets and I need to make a chart showing how many tickets are opened and closed ... by kyule New Member in Splunk Search 10-20-2017 0 6	0	6
Why Raw events table (populated using tokens) displays raw events for some events but not the others? Hi, Would really appreciate if someone could help me with this issue: I have a Table that displays Host and "Error ... by aina_sloan New Member in Splunk Search 10-20-2017 0 4	0	4
Need to make a new field with values of new made fields from two indexes Hi, Maybe a simple question, but im struggling with it. I would like to make a new field with eval which consist of ... by jpsolognier New Member in Splunk Search 10-20-2017 0 9	0	9
How to filter out the list of hosts that are in the lookup but not in my search result? I have a query as follows which displays the list of hosts and their host details as follows host field_A fiel... by pavanae Builder in Splunk Search 10-20-2017 0 4	0	4
streamstats and exclude field values that changed their state to a particular value Hi All, I am hoping you can help me out with the following : I am preparing a report from the logs of our monitori... by saurabhkunte Path Finder in Splunk Search 10-20-2017 0 3	0	3
How can I create a table with the currently logged in VPN users? Hi, I wanted to display in a form of a table the current logged in VPN users. my search command is this host="" u... by 5plunked Explorer in Splunk Search 10-19-2017 0 3	0	3
eval wildcards I have a search that uses some wildcards: sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT \| rex fie... by gnovak Builder in Splunk Search 10-19-2017 4 5	4	5
Combining unique field values I have the following problem I would like to solve Numbers1 Numbers 2 1 6 2 ... by sahr Path Finder in Splunk Search 10-19-2017 0 3	0	3
My count is double. Can I use field from search to search lookup table? 1) I have got a query whose output are events that contains a field called CV4_TExCd. The base query looks like this:... by mmdacutanan Explorer in Splunk Search 10-19-2017 0 6	0	6
Linechart with multiple lines of data on one chart? Dummy question. I have a CSV file that contains three columns (fields) <date>, <value>,<group> 2017-01-01, 10, ... by sed1565 New Member in Splunk Search 10-19-2017 0 1	0	1
Is there any benefit to explicit field extraction vs letting splunk do it on it's own? All, I have a soucetype that is quite complex. So I need to leave autoKV extractions on. In one of the logs there i... by daniel333 Builder in Splunk Search 10-19-2017 0 1	0	1
Can I use relative time for bin span? I want to run a query with rolling time span (rolling every minute) and want to count events in last 1 hour relative ... by mpatel11 Explorer in Splunk Search 10-19-2017 0 9	0	9
set timezone in search most of my data sets to UTC, and all data sources are properly tagged to convert to UTC if they are not. My user is ... by GeorgeStarkey Path Finder in Splunk Search 10-19-2017 0 2	0	2
How to modify the results in required format? I have a lookup query as follows \| inputlookup hosts.csv \| rename hostname as my_hostname \| table my_hostname the ... by pavanae Builder in Splunk Search 10-19-2017 0 1	0	1
How would I configure my regex to also include Windows data? I have a query that will identify all the logs in my instance for a certain index, it list everything running except ... by bluemarvel Path Finder in Splunk Search 10-19-2017 0 8	0	8
Time field always gives nanoseconds without format variable `xd_index`_alerts SiteName="*" ServerType="Member"\| eval _time=_time-(strptime(strftime(_time,"%Y-%m-%dT%H:%M:%S")." ... by jooi New Member in Splunk Search 10-19-2017 0 1	0	1
How can I search for results that share the same Mac address? I think I'm close. Just need a little help. here is my current search index=windows sourcetype=dhcpsrvlog \| stats dc(... by shandman Path Finder in Splunk Search 10-19-2017 0 6	0	6
Can I graph data in text over time? I have data that is in text value that I want to graph over time. index=pcrf sourcetype=rac* ha_state=* \| table ... by bpfoster7 New Member in Splunk Search 10-19-2017 0 1	0	1
Transforming Field Value with Rex/Regex? Hey! So I have this field: "user1 user2 user3 user4 user5 user6 (.....)" and I wanted it to look like "(account="use... by pamcarvalho Path Finder in Splunk Search 10-19-2017 0 5	0	5
check if value is in subsearch table result Hi, I need a way to check if a value is in a sub search table result. for example I use the code that doesent work: ... by matansocher Contributor in Splunk Search 10-19-2017 0 9	0	9
Simple way to turn multivalue field into a table? Is the a function that does this: ... \| mvmap data (fname, lname, age, height) \| table lname, age (where data is a... by alexander_lucas Explorer in Splunk Search 10-19-2017 0 2	0	2