Splunk Search

Community Activity

	Show bar chart labels in the bar Currently Splunk puts the bar chart labels off to the left and truncates them which makes things really hard to read:... by chapa Explorer in Splunk Search 08-11-2016 0 4	0	4
	Fire an alert when count of a particular value in one column is greater than something Hello, I have a query like so: source=“some-source.log” MySearchQuery \| stats count by user, host_name which produce... by Vettori Engager in Splunk Search 08-11-2016 0 4	0	4
	Scheduling multiple searches Hi, I am trying to schedule 60 saved searches with summery indexing. There are for 5 different searches, each with 4... by mansel_scheffel Explorer in Splunk Search 08-11-2016 0 5	0	5
	Concatenating stats results and visualizing as a single value Hi there index=someIndex \| stats = sum(fieldA) as one, sum(fieldB) as two I would like to display the result in the ... by karthiknzx Engager in Splunk Search 08-10-2016 0 2	0	2
	How to convert values for a time field to find max and average values with stats? We have a field with data 00 00:01:00.209 00 00:00:59.540 00 00:00:10.528 00 00:00:10.014 00 00:00:10.010 00 00:00:09... by chvnc Explorer in Splunk Search 08-10-2016 0 6	0	6
	How do I sum similarly named fields from nested JSON? I have JSON events with a sub list and want to sum similarly named fields for each event. { "id": "theid", "subdata"... by unclethan Path Finder in Splunk Search 08-10-2016 0 6	0	6
	How do I get my SPLUNK csv excel data to display via a horizontal bar chart? My data displays in splunk and ![I was able to generate a correct table via running the command index=cmadam host=kot... by vstrash New Member in Splunk Search 08-10-2016 0 2	0	2
	How to report on how long a field equaled a specific value, and show the result as a percentage of time? (aka true uptime) Here is the sample set of data, simplified: Aug 8 11:00:00 host=host1 status_code=UP Aug 8 12:20:00 host=host1 sta... by dbray_sd Path Finder in Splunk Search 08-10-2016 0 2	0	2
	Regex match till end of event? Not sure why I cant find this, but the following is not working. \|rex field=_raw "(?i)response=(?<responseXML>.+)$" ... by Cuyose Builder in Splunk Search 08-10-2016 0 12	0	12
	How to edit my search to find if a service is down, then trigger an alert only if the status is still down 1 minute later? Hi , We have search that runs for every minute, and if in case it found any Service is down, it triggers an alert. H... by splunker9999 Path Finder in Splunk Search 08-10-2016 0 6	0	6
	Case insensitive field value results in a count How can I make the results of a count on the user field case insensitive? index=winevents sourcetype="WinEventLog:Se... by sdettling New Member in Splunk Search 08-10-2016 0 1	0	1
	How to write a query where I can show the success and failure of a status? H Form the result of a asearch i get field status- success & failed, i need to show the count of success and failed ... by kiran331 Builder in Splunk Search 08-10-2016 0 4	0	4
	Hunk is not filtering files based on timestamp I have a Hunk installation that is successfully (albeit slowly) pulling data from an s3:// filesystem. However, I'm ... by mik_cox Explorer in Splunk Search 08-10-2016 0 1	0	1
	Assign earliest and latest _time to some other timestamp column I want to take the earliest and latest _time and assign to some other timestamp column. For example, I have a timesta... by splunk_hvijay Explorer in Splunk Search 08-10-2016 0 1	0	1
	Can a result of one query can be used in multiple timechart ? I can use a query that display the result in verbose mode with all fields displayed in interesting field area. I woul... by pradjswl Explorer in Splunk Search 08-10-2016 0 2	0	2
	How to edit my regular expression to extract a field from my sample data? Hey Fellow Splunkers I'm looking to possibly create a regular expression that can be used to extract a field. The da... by asarran Path Finder in Splunk Search 08-10-2016 0 10	0	10
	How to edit my regular expression to extract a field and trim out strings with more than X characters (except space) from the value? I have the following events. event 1) [08-09-2016_08:00:40.567_PDT] [ERROR] - [ePdv0XVRu2] [xxx@yyy.com] [] [auth] ... by pradjswl Explorer in Splunk Search 08-10-2016 0 8	0	8
	Why is my dashboard panel showing different values from the base report? Hi, I wonder if someone can help me on something. I created a report which runs absolutely fine no matter when I run... by robettinger Explorer in Splunk Search 08-10-2016 0 3	0	3
	search adding instead of representing a trend I'm trying to rectify a search where the chart should represent a Trend but is actually just adding the last active u... by Esky73 Builder in Splunk Search 08-09-2016 0 2	0	2
	Calculate percentage from an event field and lookup field I am trying to calculate percentage from a field in my lookup (xyz ) to an event field in splunk (abc). Technically i... by ashishlal82 Explorer in Splunk Search 08-09-2016 0 11	0	11
	How to add or sum values in a timechart? Hi Splunkers, How to add or SUM values in timechart as shown below: Search I used: base search\|transaction....\|ti... by sridharreddy New Member in Splunk Search 08-09-2016 0 1	0	1
	Is using TERM() the same as searching for something in quotes? Is using TERM() the same as searching for something in quotes, in that the search is not checking letter by letter, b... by splunkin11 Path Finder in Splunk Search 08-09-2016 0 1	0	1
	How to append a single value to multiple rows in my table? base search\| mvexpand Name \| stats dc(Name) as totalcve by severity \| appendcols [\|inputlookup lookupname\| stats coun... by ashishlal82 Explorer in Splunk Search 08-09-2016 0 2	0	2
	Chart multiple columns based on time and additional grouping We are trying to chart multiple results with some success. I am able to have everything sorted based off the Device c... by tccooper Explorer in Splunk Search 08-09-2016 0 5	0	5
	get peak values from a timechart I have a chart and would like to get a total of all the peaks values on the chart. This chart calculates idle time a... by chadman Path Finder in Splunk Search 08-09-2016 0 7	0	7