Splunk Search

Community Activity

Option to output results to a lookup file I know there is somewhere in Splunk's UI where you can have a scheduled search dump to a lookup file (without adding ... by LukeMurphey Champion in Splunk Search 08-30-2017 0 1	0	1
How do I get a Sparkline to display as a pie chart? I am attempting to use the sparkline functionality to display a pie chart in a table. My data has an asset_type ( wo... by adam_reber Path Finder in Splunk Search 08-30-2017 0 2	0	2
Normalizing IBM log collector data into Splunk fields I'm trying to monitor log data that is displayed below, and extract the fields into ones that can be used in Splunk ... by johnward4 Communicator in Splunk Search 08-30-2017 0 2	0	2
How to merge cells in a table based on value I have a table like this: col1 \| col2 \| col3 samevalue \| value1 \| value2 samevalue \| value3 \| val... by szabados Communicator in Splunk Search 08-30-2017 0 5	0	5
Is there a way to combine field values from different events? Basically I am trying to see if there is a way to do an eval to grab a field value from two different events. For exa... by kdimaria Communicator in Splunk Search 08-30-2017 0 3	0	3
How do I extract the timestamp from this log? Hi All, Kindly help to exaction the time stamp from the below log. Aug 23 05:10:50 1.1.1.1 Aug 22 2017 19:10:51: %A... by sumitkathpal292 New Member in Splunk Search 08-30-2017 0 13	0	13
"Q" Encoding Hello, I have a field which contains values encoded in "Q" (I just discovered this encoding type : RFC 1522). It see... by olivier_ma Explorer in Splunk Search 08-30-2017 0 4	0	4
Determine the timing of a sequence of events Hi Splunk users, I have a simple request in appearance but I have been thinking about it the whole day without figur... by fbehe Explorer in Splunk Search 08-30-2017 0 5	0	5
How to take time from subsearch to main search I'm looking to take events from a subsearch, and find correlating events in a main search. The scenario is something... by wtaylor149 Explorer in Splunk Search 08-29-2017 0 2	0	2
All URL'S Not coming after using match functionality Hi ALL, I wrote the below query index=noact host=loss0* sourcetype=pro-e ( path="/desktop/account/" OR path="/des... by shabdadev Engager in Splunk Search 08-29-2017 0 3	0	3
Is it possible to create a view showing all events coming from an IP and/user name? I'd like to create a dashboard where I could easily search for events coming from a specific IP address or username. ... by carmella_vitug New Member in Splunk Search 08-29-2017 0 1	0	1
Like function overview? I am new to Splunk, Can someone please explain me what below query is doing and what does 1 mean at the end of Source... by jassikul Explorer in Splunk Search 08-29-2017 0 5	0	5
How can I change the order of the fields in my piechart? I have the following search: ....\| eval "cs"=case(CallRate<=250,"Under 250 kps", CallRate<=500,"Under 500 kps", Call... by tamduong16 Contributor in Splunk Search 08-29-2017 0 7	0	7
Regex for Dell Quest TPAM logs ? Has anyone done any work with Dell/Quest TPAM logs? Not enough experience with regex to know where to start. As an ... by plarsenDST Explorer in Splunk Search 08-29-2017 0 3	0	3
How to create a graph or table for the following query according to the Status Code ?? Please refer the result below. {"StatusCode":200,"ReasonPhrase":"OK","Method":"POST","PathAndQuery":"} {"StatusCode":404,"ReasonPhrase":"Not Found",... by JyotiP Path Finder in Splunk Search 08-29-2017 0 6	0	6
95% percentile of the transaction duration Hello I'd like to display the 95% percentile of the transaction duration. Any hint how I can do this? This is my cu... by mfritsch New Member in Splunk Search 08-29-2017 0 1	0	1
How can I show segments of user login counts sorted by groups of ten per segment (in a pie chart)? Hi, I am trying to get a pie chart which shows the Top 10 users logon count as a single slice, then the next 10 foll... by robettinger Explorer in Splunk Search 08-29-2017 0 2	0	2
Creating a table from a single event with multivalue field I have an event that has disk information like: there are hosts that have more mountpoints or less mountpoints. So I ... by ColinCH Path Finder in Splunk Search 08-29-2017 0 7	0	7
Connect to a non-default instance of MS SQL server How would I connect to a non-default instance of MS SQL server? I don’t see any fields in the GUI or database.conf.sp... by Dan Splunk Employee in Splunk Search 08-29-2017 2 5	2	5
Display Input Lookup Data Hi Team, How to display lookup fields along with search fields. search Query index=AA* host=ABC source=/tmp/process... by harsush Path Finder in Splunk Search 08-29-2017 0 2	0	2
Conditional Sum to find 99% average of total data Is there a way to using conditions to find all the values (SUM and COUNT) above a certain value to be used as part of... by sepkarimpour Path Finder in Splunk Search 08-29-2017 0 4	0	4
Can I dynamically filter on the table? Let's say I create the following table from my search index= x .... \| stats sum(x) by y y sum(x) Counter1 9... by HattrickNZ Motivator in Splunk Search 08-29-2017 0 3	0	3
What syntax can I use to run a search that sorts varying runtimes? I have data for 1 day where I want to sort it with activity like following manner, total number of records took 0-3 s... by JyotiP Path Finder in Splunk Search 08-29-2017 0 4	0	4
How can I change the time output from this timechart to show time when there is no event? This is my code, the data includes a field labeled "callId" (for this particular search there are 3 distinct callId) ... by patilsh Explorer in Splunk Search 08-28-2017 0 11	0	11
Is there a meta command to find old lookup files? hi, I created a lookup file a long time ago but I don't remember where it is, is there a meta command that can find... by alexl1 Path Finder in Splunk Search 08-28-2017 0 2	0	2