Splunk Search

Community Activity

Display "stats" Search as a Single Value from Summary Index Hello, Normally, I would use the following search to find my single value: \| tstats latest(_time) as latest where ... by curry59 New Member in Splunk Search 06-20-2017 0 1	0	1
last time of user login needs to evaluate need to evaluate the duration of last time user logged in and time now. problem I am facing is in lastTime I am getti... by deepak_dhankhar Explorer in Splunk Search 06-20-2017 0 8	0	8
reuse real time searches Hi at all, I have a situation where there are around 10 users that need to use for their job two o three dashboards c... by gcusello SplunkTrust in Splunk Search 06-20-2017 0 2	0	2
How to use inner search in tstats? Hello Team, I'd like to know about How to use inner search in tstats? I use that \| tstats count from datamodel=IT... by ugy Explorer in Splunk Search 06-20-2017 0 2	0	2
Is the usage of multiple eval calculations in one pipe a feature or an unsupported hack? Hi, I did not know that it is possible: \| makeresults \| eval fieldA=123, fieldB=456, fieldC=789 I assume that thi... by HeinzWaescher Motivator in Splunk Search 06-20-2017 0 5	0	5
i want to match the word "Modify" but it should skip the first match. i want the second match "Modify" till the semi colon delimiter Modify:extended value attribut -"to be processed";Action:"will not be processed";Modify:attributs to be processed-"he... by DataOrg Builder in Splunk Search 06-20-2017 0 1	0	1
Spath and Rename Hi, I wonder whether someone may be able to help me please. I'm trying to create a query which extracts given values... by IRHM73 Motivator in Splunk Search 06-20-2017 0 1	0	1
how to replace using SED command ? Hi Splunker, I would like to know and learn how to replace ^ns4: with < Please find below dummy data. ^ns4:Channel... by m7787580 Explorer in Splunk Search 06-20-2017 1 7	1	7
How to Extract exact result from rex command? rex field=_raw "MemoryUsage %(?<MemoryUtilization>[^']+)"MY result is------------ 41.4 expected result41.4 by karthi2809 Builder in Splunk Search 06-20-2017 0 3	0	3
Search output in tabular format I am looking for help to extract the values from my log files my log file has a sequence of data as follows 1.){xxx... by 4myexperiment Explorer in Splunk Search 06-19-2017 0 2	0	2
Removing 1st line from the event Hi, I have a event with the column names like Type Category Count CPU in my event 1st line. I don... by prathapkcsc Explorer in Splunk Search 06-19-2017 0 14	0	14
Multiple graphs in line chart Hello All, I have a data as below : Where for every callId there are list of values in next column. So I have some 1... by patilsh Explorer in Splunk Search 06-19-2017 0 5	0	5
How to send an alert when a Job does not finish within expected time? Hi Everyone, I am a newbie to Splunk and need little help with the alerting system. I want to setup a real time aler... by snehasal Explorer in Splunk Search 06-19-2017 0 2	0	2
If I want to remove an IP address and do a wildcard search, are there any search filter priorities? if I want to remove one IP address and then do a wildcard search, would that wildcard host IP search override the rem... by dxw350 Path Finder in Splunk Search 06-19-2017 0 3	0	3
How to add custom time range to my xyseries search? I have this search: index="tticket_contact_request" \|eval date=strftime(_time, "%Y-%m") \|stats count by des... by cvalenti Explorer in Splunk Search 06-19-2017 0 4	0	4
How to create a search based on a conditional dashboard token value? Psuedocode: If dashboard token is empty, run X search. If token is not empty, run Y search. if($field$ is omitted)... by rubyboomslang New Member in Splunk Search 06-19-2017 0 1	0	1
Record value from a lookuptable at indextime I would like to record a user's department at the time of the event rather than search time. I have username => depar... by fooflington New Member in Splunk Search 06-19-2017 0 3	0	3
Comparison of two date fields gives bad result I use the following query in an attempt to view a subset of the file test10UniqueActiveUsers.csv \|inputlookup test1... by niamurph Explorer in Splunk Search 06-19-2017 0 7	0	7
extract field for below mentioned log From the log mentioned below I need to extract the field 'Response Time' and then frame a query for response time < 1... by vikram_m Path Finder in Splunk Search 06-19-2017 0 4	0	4
i want to match the text "followed the escaped error:" and remove the following text till the delimiter dot. it should cut other fields followed the escaped error: "An error has happened executing a dash statement. hello good morning followed the escape... by DataOrg Builder in Splunk Search 06-19-2017 0 3	0	3
How do I reuse multiple eval statements in multiple dashboards without recoding in every one? I have a series of eval statements that I'd like to call from multiple dashboards, but have it coded in only one plac... by pxs0514 Explorer in Splunk Search 06-19-2017 1 3	1	3
Grouping by a substring Hello, I'm having trouble grouping errors in our Splunk logs. The date and time is appended to the error messages, m... by R0ss Engager in Splunk Search 06-19-2017 0 2	0	2
Is there any way to overlay vertical lines for event marking in Splunk timecharts? Tools such as graphite allow for the concept of "infinity" in charts in order to display vertical lines to be overlay... by aramirez_evolut Engager in Splunk Search 06-19-2017 13 6	13	6
Regex to remove optional trailing text from field with transforms/props I have a field called Title, where it may sometimes end with the text Ends 9 P.M. or varying case related variant... by bowesmana SplunkTrust in Splunk Search 06-19-2017 0 8	0	8
how to get the average time for latest event and previous event I am looking for a solution to show for every latest event time and previous event time average duration (and the tim... by remoharish Engager in Splunk Search 06-19-2017 0 1	0	1