Splunk Search

Community Activity

	How to search and report based on presence or lack of string? Have following data in the logfile {xxxx},{"GUID":"5561859B8D624FFC8FF0B87219060DC5"} {xxxx},{"GUID":"5561859B8D62... by runiyal Path Finder in Splunk Search 10-04-2023 0 5	0	5
	How to create search for SVC's by index? I have found a search in the charge back application that might fit for seeing the SVC's by index. Unfortunately tha... by NanSplk01 Communicator in Splunk Search 10-04-2023 0 2	0	2
	How to create a timeline table? Hi,we are logging api requests in Splunk. I would like to create a sort of health check table where every column repr... by faustf Communicator in Splunk Search 10-04-2023 0 3	0	3
	Plot graph for previous 2 weekday average Hi, I'm trying to plot graph for previous 2 weekday average. Below is the query usedindex="xyz" sourcetype="abc" app... by Tester237 Explorer in Splunk Search 10-04-2023 0 2	0	2
	Finding the number of null cells in a table Lets say I have a table of two fields. and some of the cells are empty.How do I find the number of empty cells using ... by P3G4SUS New Member in Splunk Search 10-04-2023 0 2	0	2
	Get latest events of json and visualize it to table. Hello friends!I get JSON like this{"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338}and so on...{ [-] ke... by alexeysharkov Path Finder in Splunk Search 10-04-2023 0 4	0	4
	Plot graph using lookup file Hi Team, I have a got a request to plot graph of previous 30 days. But the org has a retention period of 7days set on... by shreyasbsharma Engager in Splunk Search 10-04-2023 0 7	0	7
	How to run a chart command grouped by 2 fields? HelloIm trying to run a chart command grouped by 2 fields but im getting an error:this is my query : \| chart value... by sarit_s Communicator in Splunk Search 10-03-2023 0 8	0	8
	Possible to find different of two amounts from different events but already within a sort by time span? Hi,Is it somehow possible to find difference between two or more amounts from different events when the events are so... by FGAnders Explorer in Splunk Search 10-03-2023 0 3	0	3
	Extract field Log like.message: [22/09/23 10:31:47:935 GMT] [ThreadPoolExecutor-thread-15759] INFO failed.", suspenseAccountNumber=... by Sekhar Explorer in Splunk Search 10-03-2023 0 5	0	5
	search help, token system_id = AA-1, AA-1-a, AA-1-b, AA-10, AA-10-a, AA-10-b, AA-12, AA-12-a, AA-12-b,,, and so on. Notice all the syste... by yohhpark Path Finder in Splunk Search 10-03-2023 0 2	0	2
	How to extract OS using Regex? Hi, i have lookup which list out all red hat linux. for example, in my lookup have red hat 7, red hat 8 and so on.i n... by Akmal57 Path Finder in Splunk Search 10-03-2023 0 5	0	5
	Can fromjson be used in props.conf or transforms.conf I'm working with these events Oct 3 17:11:23 hostname Tetration Alert[1485]: [ERR] {"keyId":"keyId","eventTime":"169... by jwhughes58 Contributor in Splunk Search 10-03-2023 0 4	0	4
	Splunk search showing ingest by source method Looking to create a search / report showing the ingest by source ingestion method in the last 24hours. I am looking f... by scout29 Path Finder in Splunk Search 10-03-2023 0 2	0	2
	splunk search, token issue trying to set a token where system_id shows ABC1, ABC1-a, ABC10, ABC10-a and so on. when I set the token for that sys... by yohhpark Path Finder in Splunk Search 10-03-2023 0 2	0	2
	How to return data based on search of one Source and lookup to a second Hopefully this will set the issue out clearly. I have two sources, Transaction and Request.The Transaction holds the ... by El_Franco Explorer in Splunk Search 10-03-2023 0 1	0	1
	How to modify a dashboard input token before passing to a search Is it possible to modify the value of a token obtained from a dashboard input prior to it being used in a panel? In t... by Geep Engager in Splunk Search 10-03-2023 0 2	0	2
	Calculating difference between time of 2 events I am trying to extract the difference of time(duration) of 2 events in days. I have 2 saperate event for the same ID.... by TheMorf New Member in Splunk Search 10-03-2023 0 1	0	1
	parsing _internal logs Hi Fellow Splunkers,Have a hopefully quick question:Want to pull out the source and host from the Windows _internal s... by JohnEGones Communicator in Splunk Search 10-03-2023 0 2	0	2
	Exclude unwanted apps from web-logs Hi,Can anyone pls figure out from these list of apps which of these apps from web logs are not required for investig... by Raj Builder in Splunk Search 10-03-2023 0 1	0	1
	How to Add Datamodel Fields in Search and Reporting App via Clicking Hello Splunk Community,I hope this message finds you well. I'm currently working on enhancing my workflow in the Sear... by Whiteboardsarer New Member in Splunk Search 10-03-2023 0 0	0	0
	search event even in achive data (cold etc.) Hi Actualy I trying to search data even the archived ones but as you can see in printscreen below I get only the 3 la... by darphboubou Explorer in Splunk Search 10-03-2023 0 1	0	1
	Eval case statement Hello, I hope everything is okay. I need your help. I am using this spl request : "index="bloc1rg" AND libelle ... by anissabnk Path Finder in Splunk Search 10-03-2023 0 2	0	2
	Facing issues with Reports Hello All,I am calculating burnrate in splunk, and using addinfo for enrichment to display it on the dashboard.Burn... by Amit79 Loves-to-Learn Everything in Splunk Search 10-02-2023 0 1	0	1
	Eval function as result of IF statement Is it possible to have the true and false parts of an if statement contain eval statements. \| eval pwdExpire=if(type... by balcv Contributor in Splunk Search 10-02-2023 0 3	0	3