Splunk Search

Community Activity

How to calculate the percentages of the field values (yes/no) in a field? Hi I have a Splunk search as follows: My search \| table host_name, last_seen_in_24hours which displays the result ... by pavanae Builder in Splunk Search 09-12-2017 0 2	0	2
How do I make fields with a replacement for an argument work inside a saved search with the map command? I'm sure there's a really easy answer, but it isn't coming to me so I'd greatly appreciate some help. If I define a ... by triest Communicator in Splunk Search 09-12-2017 0 1	0	1
'outputlookup' command: Could not write to file I'm trying to use outputlookup to generate a lookup table based on search results and I'm running into the following ... by Lowell Super Champion in Splunk Search 09-12-2017 0 7	0	7
chart over multiple fields hello splunkers, We are trying to get the chart over for multiple fields sample as below , we are not able to get it... by Jyothik New Member in Splunk Search 09-12-2017 0 13	0	13
Regex for Windows Event from Syslog agent Hi, I'm trying to get the Target Account ID from the Windows Event parsed from a syslog agent. I'm trying to capture ... by leonheart78 Explorer in Splunk Search 09-12-2017 0 3	0	3
Stats function by multiple fields I have a table of data like this Time1 Time2 Time3 Total 36.650000 16.050000 0.133333 74 44.866667 ... by byu168168 Path Finder in Splunk Search 09-12-2017 0 2	0	2
Top 10 list of failed login attempts for a specific application by user name I am trying to get a top 10 list of failed login attempts for a specific application by user name over a period of ti... by snix Communicator in Splunk Search 09-12-2017 0 9	0	9
How to Trim string at @ - need help creating rex search Hello, I cannot figure out the syntax of the rex function. I have a field called email with multiple domains: katz.r... by katzr Path Finder in Splunk Search 09-12-2017 0 8	0	8
How to create and use a form input to run searches on data from multiple sources? I would like to create a look-up tool for my incident responders. they often only have an IP and I would like to be ... by hartfoml Motivator in Splunk Search 09-12-2017 0 5	0	5
Host Regex Help Hello All, I really need to get good at regex and learn to do this myself but alas there are so many other things th... by edwardrose Contributor in Splunk Search 09-12-2017 0 5	0	5
Is the Splunk predict command useful? So, I have a graph that shows the total user logins per day for an application and I thought it would be cool to show... by kdimaria Communicator in Splunk Search 09-12-2017 0 4	0	4
Visualize JSON array of array Hi guys, I would like to convert the following event into a table: { Id: 1505207351 Start: 1505207651 ... by faustf Communicator in Splunk Search 09-12-2017 0 5	0	5
Where command -- How can I use this on a search without affecting the base search? I want to compare two identical searches but one looking for just count and the other using count \| where the average... by sepkarimpour Path Finder in Splunk Search 09-12-2017 0 6	0	6
Save number to a value from .log file Hello all. I'm totally new to splunk. And I'm totally desperate now. I have .log file in which i have to search for s... by davidlajda Engager in Splunk Search 09-12-2017 0 8	0	8
How to prevent injection from field in a dashboard? I create a simple dashboard and put a text field (token: field1) and a panel with shows result search query. <form> ... by takaakinakajima Path Finder in Splunk Search 09-12-2017 1 8	1	8
Multisearch alert to go off only from one side + sourcetype count optimisation I've tried to set up an alert to go off whenever the number of hosts from one search is not the same for another sear... by sepkarimpour Path Finder in Splunk Search 09-12-2017 0 3	0	3
Time chart with events consist of unique count i have a user login info log file like below for eg, when i prepare a time chart for last 2 days, i need the unique u... by iamjosh007 New Member in Splunk Search 09-12-2017 0 1	0	1
delta then sum then graph from multiple hosts I have log entries from multiple hosts which contain cumulative counters. One log entry per host about every 5 minut... by charleswheelus Path Finder in Splunk Search 09-11-2017 3 4	3	4
Field Extraction -- Break Field at Explicit Character All - I need someone to bring me sanity with a regex I am trying to write. Essentially I want to capture everything ... by himynamesdave Contributor in Splunk Search 09-11-2017 0 2	0	2
Results for each minute in an hour (even if there's no data) Hello All, Suppose I want a search results for past 60minutes, how spunk works now is if there is any event in past ... by patilsh Explorer in Splunk Search 09-11-2017 0 7	0	7
How can I get the total count of payments and total amount of payments? index = elm-retail-rws source="/opt/app/jboss/current/standalone/log/PosMultipaymentProfile.log" by gowthambr New Member in Splunk Search 09-11-2017 0 7	0	7
Having difficulties at search trying to use sed to find and replace a @ (at sign) I'm trying to filter down a list of internal email addresses at search time in a field called "email." They are all t... by splunk_newb Explorer in Splunk Search 09-11-2017 0 17	0	17
Part TWO: Need a little help troubleshooting my subsearch... This query works great index=fireeye sourcetype=hx_json [search index=fireeye sourcetype=hx_cef_syslog act="Detect... by packet_hunter Contributor in Splunk Search 09-11-2017 0 14	0	14
How to get _time at median value? Hello everyone, Now, I encountered hard problem that I can't solve for long times. I was also google on many hours b... by luanvn Explorer in Splunk Search 09-11-2017 1 7	1	7
Find inconsistencies in the IDs of results Hello, I'm new to Splunk in general, and I was wondering is there was a way to highlight inconsistencies in the IDs ... by ilomax New Member in Splunk Search 09-11-2017 0 1	0	1