Splunk Search

Community Activity

Comparing Chart Results to field This is my first time posting to the community, I hope this answer is not listed somewhere else.. if it is I have bee... by jamie_leclair Engager in Splunk Search 03-31-2017 0 3	0	3
How to get position of a not constant char/substring in another string? Hi all! As I understand, Splunk doesn't have any special functions for normal work with string. I need to get index ... by Nikita_Danilov Path Finder in Splunk Search 03-31-2017 0 10	0	10
Timechart of max(variable) - get actual time of peak, instead of bin time When I do a timechart - I get the max of my variable in the chart. However, if I hover over the value - the time ass... by sperl New Member in Splunk Search 03-31-2017 0 1	0	1
How to dynamically change the span parameter for a timechart? I have a dashboard panel that will display all events (for a given search) The result set may contain 100 or 10,000 e... by vdevarayan Path Finder in Splunk Search 03-31-2017 3 6	3	6
Field Extraction from existing field Although this works with no issue in SPL: \| rex field=fieldName "(?i)^(?P<test>.*)$" This EXTRACT-test = (?i)^(... by sloshburch Ultra Champion in Splunk Search 03-31-2017 0 5	0	5
dispatch reaper metrics In 6.5 it looks like there is a new metric event that tracks the dispatch reaper. You can view it with index=_intern... by jplumsdaine22 Influencer in Splunk Search 03-31-2017 0 1	0	1
How to write the search to get the user logon and logoff details on Splunk search head? Hi Folks, Could you please help me to get the search for Ldap user logon and logoff activity on Splunk search head? ... by lksridhar Explorer in Splunk Search 03-31-2017 0 2	0	2
How to append two different tables with different time intervals into a single table? Hi all. Apologies for asking such an unclear and hazy question. I have a situation to show transactions in 2 differen... by sundarrajan Path Finder in Splunk Search 03-31-2017 0 5	0	5
First & Last Occurrence of a Field Hi, Is there a way of discovering when an a field (e.g. like an IP address or MAC address) was first seen in the ind... by colinmchugo Explorer in Splunk Search 03-31-2017 0 1	0	1
Using the predict command on disk usage, how do I return the date as a single value when the field prediction(Used Space) = 1 or less? Hi. I'm using the predict command to determine when my machine will run out of disk based on the historical usage, ... by Norling80 Path Finder in Splunk Search 03-31-2017 1 5	1	5
Getting time differences between sub events in a transaction Hi all, I am have data about bus routes with arrival times at stops and I am trying to find the ride time between th... by srichansen Path Finder in Splunk Search 03-31-2017 0 8	0	8
Regex to cut the numerical portion of my search results Query : error SourceName=PaymentProcessingService Example of a common search result for under the field Exception... by jward6004 Explorer in Splunk Search 03-30-2017 0 11	0	11
How to combine separate events with a unique identifier? Hi, I get send-mail logs in separated events\lines (5 events). With a unique identifier that appears in any event. ... by bugnet Path Finder in Splunk Search 03-30-2017 0 6	0	6
Why is the predict command projecting past dates in the future? What I thought was going to be a simple search: lucy \| eval UsedT=UsedMB/1024/1024 \| eval UsedTB=round(UsedT,1) \| ... by ajtalbot1 Engager in Splunk Search 03-30-2017 0 3	0	3
Is there a way to access data in Solarwinds IPAM via Splunk? Hello, Is there a way to access data in Solarwinds IPAM via Splunk? For example, if I was wondering where an ip add... by yagbootz48 New Member in Splunk Search 03-30-2017 0 1	0	1
What considerations should I make when rewriting metadata for best efficiency? I am in a situation where I need to rewrite metadata for each and every event. I need to rewrite index and sourcetype... by brent_weaver Builder in Splunk Search 03-30-2017 0 3	0	3
Is there a way for a query to take a value from lookup table and if it has a match it record down the value and continue the next search? Hi, Is there a way for a query to take a value from lookup table and if it has a match it record down the value and c... by bilchen New Member in Splunk Search 03-30-2017 0 3	0	3
How to compare the row count of CSV or XLS files day over day and generate an alert if the threshold is greater than 10%? How to compare the row count of CSV or XLS files day over day and generate an alert if the threshold is greater than ... by meghnak New Member in Splunk Search 03-30-2017 0 4	0	4
Manipulating SNMP Data: how to correlate fields Hello Splunkers. I'm indexing some SNMP data from a server. Here is one event indexed: HOST-RESOURCES-MIB::hrStorag... by guimilare Communicator in Splunk Search 03-30-2017 0 7	0	7
How to search a lookup file of IP ranges without changing the format into CIDR? Hello, I have several lookup files in txt and it's in form like "blacksite1:123.123.123.1-123.123.123.17blacksite2:4... by vj1226 New Member in Splunk Search 03-30-2017 0 3	0	3
How to receive an alert when a field value is missed? index="main" \| stats count by sourcetype \| search count>40000, I will get 10 sourcetypes, If any source type does... by nagarjuna280 Communicator in Splunk Search 03-30-2017 0 1	0	1
Display peak value on radial gauge Currently we have a radial gauge with current stats, and a single value with the peak. Is there a way of marking the ... by wh_ols New Member in Splunk Search 03-30-2017 0 1	0	1
Help me with search query for my usecase i want to list out the success count by time Example: index="ABC" sourcetype="XYZ" responsecode="200"\| Time ... by sravankaripe Communicator in Splunk Search 03-30-2017 0 5	0	5
Compare field values with field values from events before Hello, I am currently trying to set up an alert in Splunk by checking my eventdata after events that contain a list o... by ckunath Communicator in Splunk Search 03-30-2017 0 3	0	3
chaining events together I am trying to figure out the query that would allow me to chain a series of events together. The issue here is that ... by gregbujak Path Finder in Splunk Search 03-30-2017 0 7	0	7