Splunk Search

Community Activity

How to edit my search to remove .000 from the end of a time field (HH:MM.000)? I have a search that creates a time in HH:MM and looks like 04:34.000. How can I drop the .000 at the end of this? ... by chadman Path Finder in Splunk Search 08-11-2016 0 7	0	7
Splunk JavaScript API getting stats in a search I am using the Splunk JavaScript API to create a dashboard to aggregate data. One of my searches that I want literall... by najarvis Engager in Splunk Search 08-11-2016 0 1	0	1
Show the time range of a search in HH:MM in a table I would like to show the HH:MM of my search as a field in a table. How can I set that up as a field? by chadman Path Finder in Splunk Search 08-11-2016 1 6	1	6
Help creating backfill script Hi there, Can someone help me create my backfill script? I am creating a new summary index that runs every 10min wit... by mwdbhyat Builder in Splunk Search 08-11-2016 0 4	0	4
Get sources configured under all apps in deployment server splunk Hi, We have 100 's of in our splunk system, what i need is, what are configured Forwarder Inputs in splunk system fo... by SrinivasaC Path Finder in Splunk Search 08-11-2016 0 4	0	4
Show bar chart labels in the bar Currently Splunk puts the bar chart labels off to the left and truncates them which makes things really hard to read:... by chapa Explorer in Splunk Search 08-11-2016 0 4	0	4
Fire an alert when count of a particular value in one column is greater than something Hello, I have a query like so: source=“some-source.log” MySearchQuery \| stats count by user, host_name which produce... by Vettori Engager in Splunk Search 08-11-2016 0 4	0	4
Scheduling multiple searches Hi, I am trying to schedule 60 saved searches with summery indexing. There are for 5 different searches, each with 4... by mansel_scheffel Explorer in Splunk Search 08-11-2016 0 5	0	5
Concatenating stats results and visualizing as a single value Hi there index=someIndex \| stats = sum(fieldA) as one, sum(fieldB) as two I would like to display the result in the ... by karthiknzx Engager in Splunk Search 08-10-2016 0 2	0	2
How to convert values for a time field to find max and average values with stats? We have a field with data 00 00:01:00.209 00 00:00:59.540 00 00:00:10.528 00 00:00:10.014 00 00:00:10.010 00 00:00:09... by chvnc Explorer in Splunk Search 08-10-2016 0 6	0	6
How do I sum similarly named fields from nested JSON? I have JSON events with a sub list and want to sum similarly named fields for each event. { "id": "theid", "subdata"... by unclethan Path Finder in Splunk Search 08-10-2016 0 6	0	6
How do I get my SPLUNK csv excel data to display via a horizontal bar chart? My data displays in splunk and ![I was able to generate a correct table via running the command index=cmadam host=kot... by vstrash New Member in Splunk Search 08-10-2016 0 2	0	2
How to report on how long a field equaled a specific value, and show the result as a percentage of time? (aka true uptime) Here is the sample set of data, simplified: Aug 8 11:00:00 host=host1 status_code=UP Aug 8 12:20:00 host=host1 sta... by dbray_sd Path Finder in Splunk Search 08-10-2016 0 2	0	2
Regex match till end of event? Not sure why I cant find this, but the following is not working. \|rex field=_raw "(?i)response=(?<responseXML>.+)$" ... by Cuyose Builder in Splunk Search 08-10-2016 0 12	0	12
How to edit my search to find if a service is down, then trigger an alert only if the status is still down 1 minute later? Hi , We have search that runs for every minute, and if in case it found any Service is down, it triggers an alert. H... by splunker9999 Path Finder in Splunk Search 08-10-2016 0 6	0	6
Case insensitive field value results in a count How can I make the results of a count on the user field case insensitive? index=winevents sourcetype="WinEventLog:Se... by sdettling New Member in Splunk Search 08-10-2016 0 1	0	1
How to write a query where I can show the success and failure of a status? H Form the result of a asearch i get field status- success & failed, i need to show the count of success and failed ... by kiran331 Builder in Splunk Search 08-10-2016 0 4	0	4
Hunk is not filtering files based on timestamp I have a Hunk installation that is successfully (albeit slowly) pulling data from an s3:// filesystem. However, I'm ... by mik_cox Explorer in Splunk Search 08-10-2016 0 1	0	1
Assign earliest and latest _time to some other timestamp column I want to take the earliest and latest _time and assign to some other timestamp column. For example, I have a timesta... by splunk_hvijay Explorer in Splunk Search 08-10-2016 0 1	0	1
Can a result of one query can be used in multiple timechart ? I can use a query that display the result in verbose mode with all fields displayed in interesting field area. I woul... by pradjswl Explorer in Splunk Search 08-10-2016 0 2	0	2
How to edit my regular expression to extract a field from my sample data? Hey Fellow Splunkers I'm looking to possibly create a regular expression that can be used to extract a field. The da... by asarran Path Finder in Splunk Search 08-10-2016 0 10	0	10
How to edit my regular expression to extract a field and trim out strings with more than X characters (except space) from the value? I have the following events. event 1) [08-09-2016_08:00:40.567_PDT] [ERROR] - [ePdv0XVRu2] [xxx@yyy.com] [] [auth] ... by pradjswl Explorer in Splunk Search 08-10-2016 0 8	0	8
Why is my dashboard panel showing different values from the base report? Hi, I wonder if someone can help me on something. I created a report which runs absolutely fine no matter when I run... by robettinger Explorer in Splunk Search 08-10-2016 0 3	0	3
search adding instead of representing a trend I'm trying to rectify a search where the chart should represent a Trend but is actually just adding the last active u... by Esky73 Builder in Splunk Search 08-09-2016 0 2	0	2
Calculate percentage from an event field and lookup field I am trying to calculate percentage from a field in my lookup (xyz ) to an event field in splunk (abc). Technically i... by ashishlal82 Explorer in Splunk Search 08-09-2016 0 11	0	11