Splunk Search

Community Activity

How to subtract dates from two events to find the duration? Hello Everyone, I have two events which I have uploaded in CSV format and the events will be consistent as below: ... by aamirs291 Path Finder in Splunk Search 10-27-2016 0 7	0	7
Multi-user thresholding with compared time ranges I have a group of users to monitor. They create actions on a fairly regular basis, but they do not all follow the sam... by joshualarkins Explorer in Splunk Search 10-26-2016 0 4	0	4
How to pass fields as tokens from one panel to other panels on the same dashboard? Not finding any examples so far, but not sure if it's possible. Wanting to have one dashboard panel that has a resu... by clintla Contributor in Splunk Search 10-26-2016 2 4	2	4
How to write a regular expression to match all patterns of these dynamic URLs? I have front-end events with several dynamic uri patterns. I am trying to generate a report to summarize the average,... by jagadeeshm Contributor in Splunk Search 10-26-2016 0 2	0	2
How to add a horizontal threshold line overlay in column chart? I have created a savedsearch which displays the Current license usage indexer wise. ("\|rest" query) x- axis : Indexe... by splunker12er Motivator in Splunk Search 10-26-2016 0 7	0	7
How do I extract this field from my sample data? I want to extract the PHP Message as a field so I can have all the various php error messages: 2016/10/20 21:23:18 [... by splgeek Explorer in Splunk Search 10-26-2016 0 3	0	3
How to modify my search to add the count of a particular field next to its field? I have a search as follows My search \| bin span=1h _time \| stats values(field_1) as Field_1 by _time Field_2 Which... by pavanae Builder in Splunk Search 10-26-2016 0 1	0	1
How to loop through results of a main inputlookup and combine with a child inputlookup? hi, i have a main search- \|inputlookup wlaa_hosts.csv \| eval Host=split(HostList,",") \| stats count by Host that ... by erwin_pader_1dc New Member in Splunk Search 10-26-2016 0 2	0	2
What privileges are needed to use tstats summariesonly=t? We have accelerations turned on and at 100% for a number of our datamodels. I like the speed obtained by using \|tstat... by reed_kelly Contributor in Splunk Search 10-26-2016 1 3	1	3
dbinspect fields names and format changed in 6.* I was using dbinpect to calculates the first and last events in my buckets. In splunk 4.* and 5.*, it was returning 2... by mataharry Communicator in Splunk Search 10-26-2016 1 3	1	3
Why is the metadata command showing the wrong firstTime? \| metadata type=sourcetypes index=* My time range picker is set to today (Today is July 30, 2015). I analyzed my da... by david_halbeisen New Member in Splunk Search 10-26-2016 0 2	0	2
how to write _time function to take the data for all 7 days ( i mean in between days too ) Hi, I have scenario like having timechart to show spikes for different dates(ex for 7 days).But now it shows same va... by umsundar2015 Path Finder in Splunk Search 10-26-2016 0 5	0	5
How to edit my regular expression to extract the last IP from my sample string using rex? Hey Guys, I have the following output: Server: abc-ij-qwerty88.asdf.xyz.com Address: 10.10.254.97 DNS request timed... by bakalon Explorer in Splunk Search 10-26-2016 0 9	0	9
Few parts of JSON logs as separate fields and remaining as events Hi All, I have JSON Logs like below: SAMPLE EVENT: { [-] line: 2016-10-21 19:16:00 INFO [CollectorAccess] Updat... by sarnagar Contributor in Splunk Search 10-26-2016 0 3	0	3
the function sum(count) by xx field is not working For me the below stats sum(count) by Asset_status provies no results . eval Asset_status= if(Asset_Class=Server OR A... by umsundar2015 Path Finder in Splunk Search 10-26-2016 0 3	0	3
How to remove real-time searches from Search and Home Page UI? I would like to remove real time searches from the Home Page and Search Panel on Splunk UI. I came across someone's o... by OMohi Path Finder in Splunk Search 10-26-2016 1 3	1	3
multivalued OUTPUT field for my automatic lookup Is it possible to configure an automatic lookup to use a multivalued OUTPUT field? I should add that the lookups mat... by carmackd Communicator in Splunk Search 10-26-2016 2 7	2	7
field fillnull with values from correlated events by fedyshynyuriy New Member in Splunk Search 10-25-2016 0 3	0	3
Is sparkline adding any new information to my search results? Is sparkline adding any new information to the results of this search, or is it just presenting the same information ... by Justin1224 Communicator in Splunk Search 10-25-2016 0 3	0	3
transforms with SOURCE_KEY using FIELDS Dataset 10.24.11.102 - user1 [10/Sep/2016:02:46:12 -0400] "GET http://www.foo.org:80/lib/stone/csrf/token.json HTTP/... by willamwar Path Finder in Splunk Search 10-25-2016 0 1	0	1
How to edit my search to combine multiple rows into one output row in my results? I am taking numerous log entries and trying to produce an output report that shows the earliest logon time and the la... by szimmer661 Explorer in Splunk Search 10-25-2016 0 6	0	6
Regex Source and Destination files with path, filename, extension I need some help with this one since it is beyond my regex skills which are not the best. I would have used the fiel... by kent_farries Path Finder in Splunk Search 10-25-2016 0 6	0	6
How to count numbers of records per category from a table? Hi. I have a search result returned as the following: name type col_1 col_2 col3 ==== ==== ===== ====... by splunkrocks2014 Communicator in Splunk Search 10-25-2016 0 2	0	2
How to calculate concurrency using value in event? Hi all, I have the following type of data with session information: starttime=1477419810 endtime=1477419818 count=5... by pasito Explorer in Splunk Search 10-25-2016 0 1	0	1
How to edit my search to append a total average column for a chart? I can't seem to find a solution for this. I've created a chart over a given time span. I've been able to add a column... by splunkin11 Path Finder in Splunk Search 10-25-2016 0 14	0	14