Splunk Search

Discussions

Thread Info

How to extract the date (yymmddHH) from the file name and time (MM:SS) from events in the file as the event _time?

Hi everyone! I have a log with a strange format. In the filename, it is a full date and an hour of event and the m...

by New Member in

How to combine multiple independent search results in a single table row with multiple columns?

I have 5 different searches (each search itself contains commands join, multisearch etc...),From each search, I get 3...

by Path Finder in

How to edit my search to have stats sum() function to work correctly on summary index?

Hi Team, I am using following Spunk search, which will fetch the requests having status >=500 and sum the total er...

by Path Finder in

インデックスの設定について

現行、勤怠管理をしているDBから排出されるデータを受信し、分析する用途で本ツールを使用したいと考えています。この受信するデータは、月初から現在までの累積データが毎日作成・修正が行われます。そのため、昨日以前のデータを破棄または検索...

by Engager in

How to substract values from two different fields in a search?

Hi all. I have a FIELDX with values like: VALUE1 200 VALUE2 120 VALUE3 156 Also, I have another field FIELD...

by Builder in

How to edit my search to show a row for each hour in my results, even if the count is zero or null?

I have a search that looks like this: LoginAudit message.name="LoginAudit Event" | eval HourAndMin=strftime(_time,...

by Explorer in

How to map certain extracted interesting fields to a name to use these fields in a data model?

Hello, I have a couple of sources that Splunk is nicely automatically pulling the fields I need into the "Interest...

by Path Finder in

Find X largest values of field by another field

I have a set of events that are racing results. One result/month for 10 months of the year. Points are awarded to run...

by SplunkTrust in

How to extract errorCode and errorDescription from my events?

Hi , We need to extract few fields from below log events, these may look like JSON format. Looking to extract Erro...

by Path Finder in

How to edit my search to calculate failure percentage through Splunk logs?

I have logs like: "The request failed" "The request succeeded" "The request failed" "The request failed" "The request...

by New Member in

How to generate a regular expression on a URL to capture a resource path and end on a optional parameter?

Hi all, I am looking for some help for the following use case. I have a series of endpoints represented by full U...

by Path Finder in

How to generate a search to count the number of rows present and if it is less that a certain value to send an alert?

Need a search to count number of rows present and if it is less that a certain value to send alert. Also, i want the ...

by New Member in

Why are my search results differing between two index-time fields?

I have two index-time fields in my app - barcodeKey and trackId. trackId is derived from barcodeKey as a suffix. The ...

by Builder in

How to edit my visualization to display a chart overlay representing the percentage of failed logins for Windows?

Came across a Splunk blog post that talked about percentage of failed logins for Box (http://blogs.splunk.com/2015/08...

by Influencer in

How to create a table that will identify student IDs that visit pages outside of what they regularly access?

Hi I have a Splunk search as below : My Search| where date_hour>=19 OR date_hour<7| bin span=1h _time | convert ct...

by Builder in

Query fails from Dashboard, but succeeds from Search. Is this a licensing or permissions issue?

I'm using a Splunk application I developed myself 2 years ago. At the time, I had an Enterprise trial license. I save...

by Explorer in

Given two sourcetypes, how to do you extract data from one sourcetype to another?

Newbie here, would appreciate if anyone can help to answer this little question. I have two sourcetypes, A and B. ...

by New Member in

How to edit my eval case statement to exclude certain text from a field's value?

My field has following value summary="java running in chrome" I need a search such that summary should have th...

by Explorer in

How can I calculate a relative value?

Hi there. I'm trying to do something like this: Relative Conversion = Event Conversion / Total Conversion Wh...

by Communicator in

How to edit my current search to find the difference between yesterday's count and today's count?

I need to add a column stating the difference in count (today - yesterday). How can I write this search? Existing ...

by Explorer in

How to search newest events with a specific "time" field?

Hi, We have a script that runs every day. The script adds a field called "export_time" which i use to determine th...

by Path Finder in

Transaction command returning 'no results found'

I'm trying to manipulate some data from our incident management software to calculate the amount of time an incident ...

by New Member in

Why is my scheduled search producing a count of zero, but get results when I run the search manually?

Hi All, Currently I am facing an issue with scheduled reports. The scheduled job is getting executed as per the c...

by Motivator in

Automatic lookups and rangemap

I think I am going mad... I set up a lookup table (points.csv) containing range,Place,Points 2013,1,20 2013,2,1...

by SplunkTrust in

multiple searches in multiple sourcetypes resulting in a single chart

Below are the few patterns that I wanted to search from multiple sourcetypes and get the count. I have around 50 patt...

by New Member in

Get Updates on the Splunk Community!

Splunk Search

Discussions

How to extract the date (yymmddHH) from the file name and time (MM:SS) from events in the file as the event _time?

How to combine multiple independent search results in a single table row with multiple columns?

How to edit my search to have stats sum() function to work correctly on summary index?

インデックスの設定について

How to substract values from two different fields in a search?

How to edit my search to show a row for each hour in my results, even if the count is zero or null?

How to map certain extracted interesting fields to a name to use these fields in a data model?

Find X largest values of field by another field

How to extract errorCode and errorDescription from my events?

How to edit my search to calculate failure percentage through Splunk logs?

How to generate a regular expression on a URL to capture a resource path and end on a optional parameter?

How to generate a search to count the number of rows present and if it is less that a certain value to send an alert?

Why are my search results differing between two index-time fields?

How to edit my visualization to display a chart overlay representing the percentage of failed logins for Windows?

How to create a table that will identify student IDs that visit pages outside of what they regularly access?

Query fails from Dashboard, but succeeds from Search. Is this a licensing or permissions issue?

Given two sourcetypes, how to do you extract data from one sourcetype to another?

How to edit my eval case statement to exclude certain text from a field's value?

How can I calculate a relative value?

How to edit my current search to find the difference between yesterday's count and today's count?

How to search newest events with a specific "time" field?

Transaction command returning 'no results found'

Why is my scheduled search producing a count of zero, but get results when I run the search manually?

Automatic lookups and rangemap

multiple searches in multiple sourcetypes resulting in a single chart

Improve Data Pipelines Using Splunk Data Management

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Thank You for Celebrating CX Day with Splunk!

Need Help with spl query and Streamstats

How to Modify Multiselect Dropdown Menus for Index...

Issue with StateSpaceForecast from the MLTK app

Notepad++ SPL syntax highlighting

How to splunk api to get statistics in python