Splunk Search

Community Activity

When I use eval command to assign search to variable, why does it return "Error in 'eval' command: Fields cannot be assigned a boolean result"? I have a simple search of a CSV file pulling back the latest timestamp: source=/opt/apps/splunk/var/run/splunk/csv/C... by New2Splunk Explorer in Splunk Search 05-22-2017 1 5	1	5
Trouble displaying multiple stats I am doing a search on our firewall. I am looking to see who is making the most requests on different ports, and also... by stakor Path Finder in Splunk Search 05-22-2017 0 2	0	2
Similarity "score" of similar values of fields> Howdy Folks, I have data in a chart similar to this, with particular scored values per attribute (may attributes...... by oclumbertruck Explorer in Splunk Search 05-22-2017 0 4	0	4
How to edit my search to transpose data field (in column) to header field? Hello, I'm trying to get this table : Device ----- Interface ----- March ... by rflouquet Explorer in Splunk Search 05-22-2017 0 4	0	4
want to compare fields on different event and display only not matching fields Hi Team, I have two events 1) 2017-05-18 14:24:58,798 [http-abcd] INFO Backend.Pure.gen.id - 108; Return 200 ids... by mahson1 New Member in Splunk Search 05-22-2017 0 4	0	4
Compare one field against itself (Chart) I have a chart that gives me serial numbers, some of the spots for serial numbers are empty. I want to compare how ma... by JoshuaJohn Contributor in Splunk Search 05-22-2017 0 8	0	8
When multiplying 3 fields to get a new field, why does Splunk round the result when the fields are decimals? Hi. I have one issue with my search. I need to multiply three fields to get another new field. When I do the multipl... by nsanchezfernand Path Finder in Splunk Search 05-22-2017 0 2	0	2
How to edit my search so that no results should be replaced with a zero (0)? I have a scenario where one column needs to be indicated with Zero in the instance of no result. However, it's showin... by karthik4455 Explorer in Splunk Search 05-22-2017 0 4	0	4
How to search if data contain value from the other fields? Hi I'm very new in Splunk, I'd like to find the event where the short description contain the "Category" or "Subcate... by urapaveerapan Explorer in Splunk Search 05-22-2017 0 3	0	3
To add multiple criteria to determine drop in traffic index=circuit basequery1 earliest=-10m@m latest=@m\|fields count \| stats count AS currentMinuteCount \| appendcols [sea... by arunsubram Explorer in Splunk Search 05-21-2017 0 1	0	1
How to edit a transaction search with multiple "endswith" option? hi, i have a search to get duration of the job, let's say startswith=started endswith=success But in some case the j... by srinivasup Explorer in Splunk Search 05-21-2017 0 3	0	3
table lookup issues I have a lookup table named lookupfile.csv My file looks like this: col1,col2,col3,col4 100,300,500,yes 200,400,600,y... by loveforsplunk Explorer in Splunk Search 05-20-2017 0 6	0	6
Find average count per minute by a specific field over the whole time period Hi, I have a web service's http access log and I want to find out the average request per minute for each url_path ... by flls New Member in Splunk Search 05-20-2017 0 3	0	3
How to edit my search to select the newest event based on LastModTime field? So I'm taking in data from a source that has some duplicate records for the same ID. The only differentiator between ... by joesrepsol Path Finder in Splunk Search 05-19-2017 0 2	0	2
Use eval statement with and, if, then Example: I'm trying to count how many books we have in our database based on subject: children's, romance, travel, et... by mistydennis Communicator in Splunk Search 05-19-2017 0 3	0	3
How to remove a prefix on a field during search? Hello, I'm trying to normalize a field during search. I have the field "user" and some of the fields are "NAU\abc123"... by aba83 Explorer in Splunk Search 05-19-2017 0 6	0	6
Alert when a host exceeds a certain number of messages per minute I'm running a somewhat large splunk installation that monitors syslog for >40k hosts. Every once in a while, a host ... by rgisrael Explorer in Splunk Search 05-19-2017 4 8	4	8
How do I create a time chart that predicts based on the values inside the search field? I am trying to create a search that looks through some logs and creates a time chart based on the search field which ... by aflick2486 Explorer in Splunk Search 05-19-2017 0 6	0	6
How to get the 6 month ago column from field in lookup? Hi, I have a column named Month in lookup file For example, Month 2017/02 2017/01 2017/01 2017/01 2016/12 2016/12 ... by urapaveerapan Explorer in Splunk Search 05-19-2017 0 3	0	3
rex over 2 lines with 2 combined search phrases I'm facing a problem with rex and working through many many threads which didn't help me to solve this issue. I have... by Stonecore New Member in Splunk Search 05-19-2017 0 6	0	6
How to color columns based on a variable? I am charting a Product ID v/s count in a column chart I want to color the columns in red and green. Red if the PID i... by anakelka New Member in Splunk Search 05-19-2017 0 6	0	6
How to create a multivaluefield from fieldnames with a specific pattern? Hi, let's say we have events with fields like: Event A: payload.productName1: payload.productName2: Event B: pay... by HeinzWaescher Motivator in Splunk Search 05-19-2017 0 12	0	12
How to edit my search to show the count of a field per country? I have a search below that shows the number of events by Country. I want to show the count of each dest_port per cou... by bayman Path Finder in Splunk Search 05-19-2017 0 7	0	7
How do I iterate and match values within a column of my search result? So, to start with, I have a table like this. Person role Time abc ... by snipedown21 Path Finder in Splunk Search 05-19-2017 0 5	0	5
Help me with search query command help me with JOIN query for my usecase i have index=abc sourcetype=abc index=abc sourcetype=pqr In sourcetype=abc ... by sravankaripe Communicator in Splunk Search 05-19-2017 0 8	0	8