Splunk Search

Discussions

Thread Info

Tips on using sort and count: It is possible to generate a: "* |stats values(y) count by x | sort -x" but where each value of y is count separately and also sorted?

I'm trying to generate a table where the output is something like this: ValueY ValueX 　　Count ValueY1 V...

by Explorer in

How to get earliest and latest time for the last one hour and compare it with the same hour last week?

How to get earliest and latest time for the last one hour to compare with the same hour last week for which I don't k...

by New Member in

Map fields from two sourcetypes based on a certain time range

Hello, A project I'm working on requires that I monitor who is logging into an application. As it is, the logs of ...

by Path Finder in

Regex formating help

Can anyone help me format a regular expression for Splunk? I can create the regular expression using regexr.com and ...

by Explorer in

Streamstats count

I want a cumulative count of a field that has multiple values. Somehow this isn't working: base search| streamstat...

by Path Finder in

Separate values in stacked bars

How can I still have a separation between 'xls' and 'xlsx' in the bar that says 'Excel'? eval ExtTyp = case(extens...

by Path Finder in

Real-time alert is skipped.

Hello, I have the following message in the scheduler activity window on DMC, that states I have reached the limit ...

by Communicator in

How to show the percentage of unique values

Hi, I have a simple search that uses top to get the top 10 countries: search ........ | top Country It w...

by Path Finder in

How to display dates of month in columns

Hi Team, I have a scenario to display dates of selected month in columns. For Example , if i select August month i...

by Explorer in

Splunk Admin Role- unable to change app visibility.

Hello community, I have splunk admin role on splunk GUI, I access Splunk from web which is hosted on remote machi...

by New Member in

KMZ file with markers on map - How can I add more details to the map?

Hello, I am using a geospatial lookup with a kmz file, it works and shows the polygons on the map, but I need more...

by New Member in

Find values that only match a specific list of values and nothing else

I am working with an event log from an email system where all the different recipients of an email are being listed a...

by Explorer in

How can I figure out why my lastlog directory is huge?

Hi guys, Why is my lastlog directory so huge? -rw-r--r--. 1 root root **216G** Aug 7 17:35 lastlog Wha...

by Explorer in

Need to extract the store id, mop and amount from the event and restrict the amount to 2 decimal point

900 200 138 203.009999999999990905052982270717620849609375 MASTERCARD

by New Member in

Put the time into a column instead of a row

Hi everyone, I hope you can help. I have the following search: index=rb_idx_default_summary (report=EXCHANGE...

by Engager in

Convert Multiple Values in single field to multiple fields

I am needing some assistance with the following issue with a field with multiple Values. Since this is coming from a ...

by Explorer in

Left join not working properly in Splunk Enterprise 6.6.2

Hi, I have written a simple left join query which doesn't seem to work properly. Objective: To find out host wh...

by Contributor in

Chart one value field and multiple value field within same time bucket

Hi, Thanks up front your time I have duration field generated from some transaction command and I would love to draw...

by Contributor in

Can I check that a transaction does not contain more than 1 arbitrary field?

I have a log that tracks fruit names (Ok, not really, but let's go with that) over the course many log entries compri...

by Path Finder in

Is there a way to send a single sourcetype to a heavy forwarder?

Hi there, Is there a way to send specific sourcetype to a heavy forwarder? For example, I would like to send the "...

by Path Finder in

Using timechart, is there a way to calculate mean/max/min, etc while including the 'zero-event' seconds?

I have a process that experiences about 8640 events per day, or what I would expect to be an average of 0.1 events pe...

by New Member in

How can I escape the < > signs so that the token will properly hold my regex with these symbols?

I am trying to set a token to have the following regex value rex "by (?<SU>[^(]+)". This regex is part of a larger se...

by Explorer in

Multiple correlation of different eventtypes.

Hello everybody, I am in the process of building a use case, which consists of 5 real-time alerts. In order to mak...

by Engager in

Splunk : chart of two timeperiods

Hello, I want to know if it's possible to create a chart where there are two periods of time. For example, I want ...

by Communicator in

Any alternates for Splunk outer join in my search?

I set up a savedsearch to monitor the status from some critical reports (from a "critical_reports.csv" lookup) within...

by Communicator in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Tips on using sort and count: It is possible to generate a: "* |stats values(y) count by x | sort -x" but where each value of y is count separately and also sorted?

How to get earliest and latest time for the last one hour and compare it with the same hour last week?

Map fields from two sourcetypes based on a certain time range

Regex formating help

Streamstats count

Separate values in stacked bars

Real-time alert is skipped.

How to show the percentage of unique values

How to display dates of month in columns

Splunk Admin Role- unable to change app visibility.

KMZ file with markers on map - How can I add more details to the map?

Find values that only match a specific list of values and nothing else

How can I figure out why my lastlog directory is huge?

Need to extract the store id, mop and amount from the event and restrict the amount to 2 decimal point

Put the time into a column instead of a row

Convert Multiple Values in single field to multiple fields

Left join not working properly in Splunk Enterprise 6.6.2

Chart one value field and multiple value field within same time bucket

Can I check that a transaction does not contain more than 1 arbitrary field?

Is there a way to send a single sourcetype to a heavy forwarder?

Using timechart, is there a way to calculate mean/max/min, etc while including the 'zero-event' seconds?

How can I escape the < > signs so that the token will properly hold my regex with these symbols?

Multiple correlation of different eventtypes.

Splunk : chart of two timeperiods

Any alternates for Splunk outer join in my search?

Developer Spotlight with Paul Stout

Preparing your Splunk Environment for OpenSSL3

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Using Machine Learning Toolkit to detect auth abus...

Proactively stream data to different index after C...

Write Splunk log with Laminas

Issues in multiselect input dropdown

Using splunk-sdk in user-defined functions in Spar...