Splunk Search

Community Activity

count how many records was opened by open date field Hi, I have a table of incidents and I want to count the number of incidents opened per month. Each record updates af... by matansocher Contributor in Splunk Search 08-10-2017 0 2	0	2
How to keep all most recent events for a specific field and remove all others? My question is similar to this: https://answers.splunk.com/answers/35759/keping-only-most-recent-events-for-a-fixed-f... by mew1033 Explorer in Splunk Search 08-10-2017 0 4	0	4
Grouping the events My requirement is to group events (list of jobs) based on their status. The status value starts with RUNNING and ma... by Kwip Contributor in Splunk Search 08-10-2017 0 3	0	3
where clause over row I have the below query which gives me the count of alerts over period of an hour, I wanted to make it as an alert by ... by bic Explorer in Splunk Search 08-10-2017 0 1	0	1
can we use field name for comparison in case statement? Hi Splunkers! I am try to evaluate few things by using query below- index=* sourcetype=* \| stats values(OPEN_INT... by shivi_tcs Engager in Splunk Search 08-10-2017 0 3	0	3
Scheduled reports working inconsistently. What could be the reasons why scheduled reports are not getting executed all the time ? We get log messages like:- 0... by sajeeshpn New Member in Splunk Search 08-09-2017 0 3	0	3
Sorting stats 'list' results in a certain order? Hi All, Im working with some vulnerability data and I'm wondering if I can sort the list I have of different vulnerab... by mrgibbon Contributor in Splunk Search 08-09-2017 0 2	0	2
How to customize the search app search dashboard? We would like to remind Splunk users to always include an index in their queries. With over 200 indexes it is taxing... by paulathome Path Finder in Splunk Search 08-09-2017 0 9	0	9
Appending/Adding count of results in the column header Hi All, I have a search - index=ABC sourcetype=XYZ \| stats values(user), dc(user) by region \| transpose header_field... by pushpender07 Explorer in Splunk Search 08-09-2017 0 11	0	11
Find out if count at a specific time is below the average UPDATE: I have created a search/alert that should notify me if: Index data is 0 for a particular hourIndex data cou... by mkarimi17 Path Finder in Splunk Search 08-09-2017 0 5	0	5
How to start span at midnight I have a search: \| tstats count AS ThreeHourCount WHERE earliest=-2d@d latest=now index=* by index, _time span=3h ... by mkarimi17 Path Finder in Splunk Search 08-09-2017 0 7	0	7
Compare two columns in two lookup files Hello. I have two lookup files: Firecall.csvPrivileged.csv Both files contain a column with the same name; Account... by timyong80 Explorer in Splunk Search 08-09-2017 0 2	0	2
Compare two values from extracted fields - if match increment counter Hi all, Having read a few similar threads I realised they do not quite ask what I need so decided to post a new thre... by splunk_95 Explorer in Splunk Search 08-09-2017 1 14	1	14
How to convert string date format to other date format? I have string like this 08Aug2017 10:12:55 CDT" I want date format like = 08-Aug-2017 10:12:55 CDT by prabu116 Engager in Splunk Search 08-09-2017 0 6	0	6
Not able to get all results to show stats when all field and value events are present with search. What am i missing? Using the tutorialdata.zip tutorial dataset but cant seem to get the results I want using index=main ("categoryId=*"... by bab4684 New Member in Splunk Search 08-09-2017 0 8	0	8
Showing the latest time per single unique value in multiple fields Hello, my question is linked to the below answer. https://answers.splunk.com/answers/222406/search-to-group-by-countr... by davidworsnop Explorer in Splunk Search 08-09-2017 0 4	0	4
Can you search a lookup table without specifying a particular field? Is something like this possible? Basically a freetext search of a lookup table to return the associated rows? \|inpu... by Cuyose Builder in Splunk Search 08-09-2017 0 6	0	6
Dashboard single value sentence including time Hi all, I'm currently working on a dashboard in Splunk that I am trying to take a count value and include it in a se... by bcarr12 Path Finder in Splunk Search 08-09-2017 0 5	0	5
What is strptime format for 2017-08-01T11:48:15.000+0000 I want to load a json into splunk. The time stamp of each event is in the format 2017-08-01T11:48:15.000+0000. I used... by balamurali_dece New Member in Splunk Search 08-09-2017 0 2	0	2
How do I use the reverse command to change the order of my table? Hello, I currently have a table that is ordered by time, ascending. It looks like this: Date \| Action 9pm \| Order ... by ckunath Communicator in Splunk Search 08-09-2017 0 2	0	2
Query including multiple CSV and Rex Hello everyone, it's been a long long time that I've not used splunk. I would need some help to do a query or two ple... by metalshad05 New Member in Splunk Search 08-09-2017 0 8	0	8
Filter by URL How do we filter by URL? I use the search criteria below, however, I'm trying to figure out how will I filter the res... by roseb New Member in Splunk Search 08-09-2017 0 3	0	3
Floating column chart using simple xml Hi Experts I am trying to build floating bars in a column chart. The y axis is fixed from 0-24. I want to start the b... by vaibhavagg2006 Communicator in Splunk Search 08-08-2017 0 3	0	3
Expanded stacked column chart Is it possible to create a column chart that is stacked, but where each part of the stack still occupies its own colu... by tmortiboy New Member in Splunk Search 08-08-2017 0 5	0	5
Splunk ES detecting changes to OS auth files Hi All We have a request to generate a notable event in Splunk ES for any changes made in the linux OS to /etc/passwd... by proylea Contributor in Splunk Search 08-08-2017 0 2	0	2