Splunk Search

Community Activity

	How can I remove excess characters from my fields? Hi, In my log file one field called Script Name contains some unnecessary details, which I want to remove. My requi... by AKG1_old1 Builder in Splunk Search 08-15-2017 0 2	0	2
	How to edit the conditional count in my stats/eval search? Hello, I am trying to add fields for month and include the count of tickets in each month. I bolded the part of the ... by katzr Path Finder in Splunk Search 08-15-2017 0 3	0	3
	Can I query an already existing report? I am looking to write an alert that would query a report I have saved that runs every day. I would like it to look fo... by JustRoot Path Finder in Splunk Search 08-15-2017 0 2	0	2
	Timechart involving multiple "group by" I've given all my data 1 of 3 possible event types. In addition, each event has a field "foo" (which contains roughly... by mumblingsages Path Finder in Splunk Search 08-15-2017 0 5	0	5
	How to generate a table where the values of my "serviceType" field appear as a column headers? Below is the example of single request with multiple lines where ServiceType is different. Required result to be a... by kaushik1218 New Member in Splunk Search 08-15-2017 0 2	0	2
	How can I extract a file name from a file path? Hello, So currently, one of my indices logs has the file path which contains the file name but doesn't have a separa... by JustRoot Path Finder in Splunk Search 08-15-2017 0 4	0	4
	How can I use joins (or an alternative) for a search that joins 3 different event types each on different time scales? Hi, I've written a query (see original query below) which joins 3 different event types to display A_events started... by DrRich Explorer in Splunk Search 08-15-2017 0 6	0	6
	How to use 'OR' boolean in an eval expression? We're combining many types of searches into one tabled alert. We create our own variables with an eval statement and ... by drizzo Path Finder in Splunk Search 08-15-2017 0 4	0	4
	How can I customize my chart with a new y-axis label? Is there a way to customize the column charts label, or the y-axis? What I want to do is create a column with the co... by michaelrosello Path Finder in Splunk Search 08-14-2017 0 4	0	4
	How can I sort a field alphabetically and then by total? I have the following search in which I'm trying to sort first alphabetically and then by total, but the Processes fie... by jwalzerpitt Influencer in Splunk Search 08-14-2017 0 7	0	7
	Create a variable that combines two string values I have a simple question: I have two variables foo and bar, each containing a set of strings, and I would like to c... by viggor Path Finder in Splunk Search 08-14-2017 0 3	0	3
	Compare search results with a lookup table and identify unobserved matches I have a query that shows observed category of domains (search engines, social media, streaming, etc.). I'd like to ... by DEAD_BEEF Builder in Splunk Search 08-14-2017 0 4	0	4
	How do I parse a key value field in Splunk and search based on values of that field? I have a log as follows 14AUG2017_12:54:44.903 3418:13 INFO filename.cpp:200 ID:abc123 contextInfo: [ peer_service... by gb0143 New Member in Splunk Search 08-14-2017 0 1	0	1
	Why does the table command in Splunk cause performance degradation? When I use this command ( table ) it runs at a slow speed .... please help me. Thank you for your answer. by splunk_anoosheh New Member in Splunk Search 08-14-2017 0 2	0	2
	How to put working hours from each user by day in a time chart My search so far: index=notimportant EventID=4624 [ inputlookup users.csv \| fields TargetUserName ] \| chart eval(la... by rens78 New Member in Splunk Search 08-14-2017 0 2	0	2
	Displaying either value or fixed string based on if statement Hello everyone, So what I'm trying to do with this is print out a value into a Single Value Panel (42). Depending on... by ejeny Explorer in Splunk Search 08-14-2017 0 9	0	9
	Can I use modulus in Splunk to extract the decimal portion (only) of a result? how to extract only decimal values in splunk ? ..example (7 divided by 2 ) = 3.5 , I need to get only 0.5 here ...wi... by nittalasub Explorer in Splunk Search 08-13-2017 0 9	0	9
	How to use lookup file to set earliest and latest time I have a lookup file with dates. how do i use it to set earliest and latest inorder to search for events, For exampl... by sangs8788 Communicator in Splunk Search 08-13-2017 0 3	0	3
	Regex to insert ":" after every second character Hello I have a string of all uppercase letters (no digits) I need a regex to insert a ":" after every second charact... by coenvandijk Observer in Splunk Search 08-13-2017 0 8	0	8
	How can I make visualizations with time format hh:mm:ss? Hi, I have the below statement with the correct statistics output. However my visualization is empty. But when I use... by auaave Communicator in Splunk Search 08-13-2017 0 2	0	2
	From a list of column values can we print one final, single message? Hi All, I want to compare result column Names which is displaying 3 kind of messages. Normal, Elevated, C... by prashanthberam Explorer in Splunk Search 08-12-2017 0 6	0	6
	Can I have the difference of two values as the output using appendcols? How? index=main (sourcetype=bb OR sourcetype=cc) type=DELETE \| transaction info.agentId startswith=COMPLETED endswith=DE... by jsuryaprakash Path Finder in Splunk Search 08-12-2017 0 1	0	1
	Can I deploy a new app that only changes one of my two universal forwarders if they have the same inputs.conf? Hi, For example, we have 2 universal forwarders UF1 = web01abc23 UF2 = web01cde21 Both are having same inputs.con... by kteng2024 Path Finder in Splunk Search 08-11-2017 0 1	0	1
	How do I migrate my configuration (dahsboard, alerts, fields, etc) to a new Splunk instance? I migrated the database "splunk/var/lib/splunk" but when I copy my configuration files, the fields and alerts disapp... by medveleyenet New Member in Splunk Search 08-11-2017 0 1	0	1
	How can I write a search that returns _time in 1-second intervals even when _time stamp doesn't match a value? Hello Guys, I have a column _time Ex Values (Suppose the search has 4 events here): 2017-08-11 12:06:51 2017-08-11... by patilsh Explorer in Splunk Search 08-11-2017 0 2	0	2