Splunk Search

Community Activity

	Can we convert the _time(which is chicago time) to London time during search time Hi , I have a scenario. where my _time is chicago time(CST/CDT) . But I need to convert it to London time and do stat... by ankithreddy777 Contributor in Splunk Search 06-03-2017 0 3	0	3
	EVAL with field extracted from props.conf Hello Everyone, I'm having an issue where I cannot use EVAL in search or in the props.conf for a field that has been... by johnmvang Path Finder in Splunk Search 06-03-2017 0 12	0	12
	How to lookup? I have a lookup table of IDs like this: (id)uuid - (myid)numeric id (id)uuid - (myid)email (id)email - (myid)numeric ... by rvencu Path Finder in Splunk Search 06-03-2017 0 1	0	1
	I need to compare two values which are generated dynamically in every hour and get the diffrence . Basically my search looks like this index=something \| rex "(?), " \| rex "(?\d+)" \| eval _time=strftime(_time, "%d ... by sandyIscream Communicator in Splunk Search 06-03-2017 0 2	0	2
	How to fetch events based on below condition Hi, We have a requirement where client wants to see only events which satisfied the below condition. Any events whi... by surajgupta New Member in Splunk Search 06-02-2017 0 4	0	4
	runshellscript search command does not return the results file ($8 argument) This docs (https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Runshellscript) says $8 argument i... by testadrianbelen New Member in Splunk Search 06-02-2017 0 5	0	5
	Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? Hello! As the title states, my dashboard fails to load a panel that performs a search. If I click "Open in search... by kylbarne New Member in Splunk Search 06-02-2017 0 16	0	16
	What are these undocumented settings in user-prefs.conf? The documentation on user-prefs.conf is incomplete. I cannot find an explanation for the following settings: appOrde... by matthijsk Explorer in Splunk Search 06-02-2017 0 2	0	2
	Is there a makemv to mvexpand command issue in my search? When running this search (the return value is hard coded, it is coming from an external command). I just pasted the r... by rdownie Communicator in Splunk Search 06-02-2017 0 2	0	2
	stats count(eval) always returns zero I'm having problems with what should be a very simple query. I'm trying to get a count of events in an "unavailable"... by richgalloway SplunkTrust in Splunk Search 06-02-2017 0 5	0	5
	Splunk stops logging windows events after temporarily loosing network connection I'm monitoring Sysmon events from my laptop, but if I temporarily lose network connection Splunk stops logging comple... by stefan1988 Path Finder in Splunk Search 06-02-2017 0 2	0	2
	moving average query Hello - I m collecting some user metrics in below format. customer's trVol ( transactionvolume) 2017-05-29 04:50:01... by vw5qb73 Explorer in Splunk Search 06-01-2017 0 3	0	3
	Eval Ranges combined with specific values Hi, I'm looking to grab numbers of http responses (status) as "Good" or "Bad" and am successful with the following q... by bfong Engager in Splunk Search 06-01-2017 0 1	0	1
	How can I determine if a field is an integer (whole number) I want to use an if statement determine if a number is a integer or decimal. Is that possible? example if(field1/fie... by jedatt01 Builder in Splunk Search 06-01-2017 0 3	0	3
	Complex subsearch comparing time periods Hello I have a rather complex search/subsearch I am trying to figure out. I need to acquire a list of values from a ... by EricLloyd79 Builder in Splunk Search 06-01-2017 0 3	0	3
	How to convert a string to date from my log file? My log file contains data in the below format. I need to sort the date by the latest one first. Please help as I am u... by AyanC New Member in Splunk Search 06-01-2017 0 2	0	2
	Formatting my date Below is my report but my date output is blank, i am searching for powershell events on my network and need to know w... by rickettw New Member in Splunk Search 06-01-2017 0 4	0	4
	Allow colon in field names? I have input data that looks like: time=2017-05-29 calendar:num_1day_active_users=10437 gplus:num_1day_active_users=... by wegscd Contributor in Splunk Search 06-01-2017 0 6	0	6
	Can Splunk handle indexing a CSV file containing more than 6000 fields/columns? I have a heavily nested structured/dynamic XML event. I converted it to CSV and it generated more than 6000 unique fi... by splunknewbie05 Explorer in Splunk Search 06-01-2017 0 4	0	4
	Rounding in chart with by clause I've just encountered a strange thing that doesn't seem to be covered by an Answer or the docs. If I have a chart com... by cmeo Contributor in Splunk Search 06-01-2017 0 2	0	2
	2 number in a radial gauge Hi Is it possible to see 2 numbers (2 gauges) in a radial gauge chart? Thanks by matansocher Contributor in Splunk Search 06-01-2017 0 3	0	3
	avoid latest timestamp Hi Team, There is a scenario where I need to calculate time range. I have to ignore latest timestamp and need to ca... by arjitgoswami Explorer in Splunk Search 06-01-2017 0 2	0	2
	combine 3 search queries in which 2 of them are the result of the last one What i am trying to accomplish is the following; I have 3 search queries. The first one displays a single value that... by robertspeckmann Explorer in Splunk Search 06-01-2017 0 4	0	4
	How to edit my search to display the status of my saved searches? Hi, I am currently using the search below to get the status of my saved searches. index=_internal sourcetype=schedul... by ramstolentino Explorer in Splunk Search 06-01-2017 0 3	0	3
	Number of seconds that have events by host Hello experts! My system is potentially producing several events per second and sometimes even several events at the ... by AssafLowenstein Explorer in Splunk Search 06-01-2017 0 14	0	14