Splunk Search

Community Activity

How to merge cells in a table based on value I have a table like this: col1 \| col2 \| col3 samevalue \| value1 \| value2 samevalue \| value3 \| val... by szabados Communicator in Splunk Search 08-30-2017 0 5	0	5
Is there a way to combine field values from different events? Basically I am trying to see if there is a way to do an eval to grab a field value from two different events. For exa... by kdimaria Communicator in Splunk Search 08-30-2017 0 3	0	3
How do I extract the timestamp from this log? Hi All, Kindly help to exaction the time stamp from the below log. Aug 23 05:10:50 1.1.1.1 Aug 22 2017 19:10:51: %A... by sumitkathpal292 New Member in Splunk Search 08-30-2017 0 13	0	13
"Q" Encoding Hello, I have a field which contains values encoded in "Q" (I just discovered this encoding type : RFC 1522). It see... by olivier_ma Explorer in Splunk Search 08-30-2017 0 4	0	4
Determine the timing of a sequence of events Hi Splunk users, I have a simple request in appearance but I have been thinking about it the whole day without figur... by fbehe Explorer in Splunk Search 08-30-2017 0 5	0	5
How to take time from subsearch to main search I'm looking to take events from a subsearch, and find correlating events in a main search. The scenario is something... by wtaylor149 Explorer in Splunk Search 08-29-2017 0 2	0	2
All URL'S Not coming after using match functionality Hi ALL, I wrote the below query index=noact host=loss0* sourcetype=pro-e ( path="/desktop/account/" OR path="/des... by shabdadev Engager in Splunk Search 08-29-2017 0 3	0	3
Is it possible to create a view showing all events coming from an IP and/user name? I'd like to create a dashboard where I could easily search for events coming from a specific IP address or username. ... by carmella_vitug New Member in Splunk Search 08-29-2017 0 1	0	1
Like function overview? I am new to Splunk, Can someone please explain me what below query is doing and what does 1 mean at the end of Source... by jassikul Explorer in Splunk Search 08-29-2017 0 5	0	5
How can I change the order of the fields in my piechart? I have the following search: ....\| eval "cs"=case(CallRate<=250,"Under 250 kps", CallRate<=500,"Under 500 kps", Call... by tamduong16 Contributor in Splunk Search 08-29-2017 0 7	0	7
Regex for Dell Quest TPAM logs ? Has anyone done any work with Dell/Quest TPAM logs? Not enough experience with regex to know where to start. As an ... by plarsenDST Explorer in Splunk Search 08-29-2017 0 3	0	3
How to create a graph or table for the following query according to the Status Code ?? Please refer the result below. {"StatusCode":200,"ReasonPhrase":"OK","Method":"POST","PathAndQuery":"} {"StatusCode":404,"ReasonPhrase":"Not Found",... by JyotiP Path Finder in Splunk Search 08-29-2017 0 6	0	6
95% percentile of the transaction duration Hello I'd like to display the 95% percentile of the transaction duration. Any hint how I can do this? This is my cu... by mfritsch New Member in Splunk Search 08-29-2017 0 1	0	1
How can I show segments of user login counts sorted by groups of ten per segment (in a pie chart)? Hi, I am trying to get a pie chart which shows the Top 10 users logon count as a single slice, then the next 10 foll... by robettinger Explorer in Splunk Search 08-29-2017 0 2	0	2
Creating a table from a single event with multivalue field I have an event that has disk information like: there are hosts that have more mountpoints or less mountpoints. So I ... by ColinCH Path Finder in Splunk Search 08-29-2017 0 7	0	7
Connect to a non-default instance of MS SQL server How would I connect to a non-default instance of MS SQL server? I don’t see any fields in the GUI or database.conf.sp... by Dan Splunk Employee in Splunk Search 08-29-2017 2 5	2	5
Display Input Lookup Data Hi Team, How to display lookup fields along with search fields. search Query index=AA* host=ABC source=/tmp/process... by harsush Path Finder in Splunk Search 08-29-2017 0 2	0	2
Conditional Sum to find 99% average of total data Is there a way to using conditions to find all the values (SUM and COUNT) above a certain value to be used as part of... by sepkarimpour Path Finder in Splunk Search 08-29-2017 0 4	0	4
Can I dynamically filter on the table? Let's say I create the following table from my search index= x .... \| stats sum(x) by y y sum(x) Counter1 9... by HattrickNZ Motivator in Splunk Search 08-29-2017 0 3	0	3
What syntax can I use to run a search that sorts varying runtimes? I have data for 1 day where I want to sort it with activity like following manner, total number of records took 0-3 s... by JyotiP Path Finder in Splunk Search 08-29-2017 0 4	0	4
How can I change the time output from this timechart to show time when there is no event? This is my code, the data includes a field labeled "callId" (for this particular search there are 3 distinct callId) ... by patilsh Explorer in Splunk Search 08-28-2017 0 11	0	11
Is there a meta command to find old lookup files? hi, I created a lookup file a long time ago but I don't remember where it is, is there a meta command that can find... by alexl1 Path Finder in Splunk Search 08-28-2017 0 2	0	2
How to specify the time range chosen on a chart's y-axis? For a timechart such as " .. \| timechart count", there will be an arbitrary bucket size selected depending on certain... by pstickne Explorer in Splunk Search 08-28-2017 0 1	0	1
Optimisation: Search counting DNS Connections over 30d and 24hrs. Alert when 24hrs is 3* greater than daily "average". Hi All, TL;DR: I could use some assistance with search string optimization, or help re-writing the search string to... by MikeElliott Communicator in Splunk Search 08-28-2017 0 2	0	2
How to filter Windows Events from one host using Regex? Hi, How to filter out the events with EventCodes (4624, 4672, 4634) and Account _svc_abd with Security Id "S-1-5-21-... by kiran331 Builder in Splunk Search 08-28-2017 0 5	0	5