Splunk Search

Community Activity

How to merge two field values into one? I'm trying to compare two date values, Valid_Till(ex: Oct 7 12:58:21 2016) and the current_date(ex: 08/01/16). In ord... by jenniferleenyc Engager in Splunk Search 08-01-2016 0 3	0	3
How to write a search using eval to create a new field with values calculated from the difference between two time fields? Hi, We integrated Splunk to ServiceNow and looking to find a late closure incidents. For this we have 2 fields Stop... by splunker9999 Path Finder in Splunk Search 08-01-2016 0 7	0	7
How to write a search to return events for a particular source IP for the last 7 days? Hi, How do I write a search to get particular source IP activities for the last 7 days? Ex :src="122.15.158.173" R... by syed_star357 New Member in Splunk Search 08-01-2016 0 2	0	2
How to search for events with latest time down to the millisecond? Hi, My Splunk indexes event time down to the millisecond (e.g., 01/14/2016 23:59:59.326 AM). I know this can find ev... by vpao Engager in Splunk Search 08-01-2016 0 2	0	2
timechart span in saved search Is there a way to pass a timechart span variable to a saved search being called from a drop down? Is there a way to p... by aaronkorn Splunk Employee in Splunk Search 08-01-2016 0 2	0	2
How to extract a value from a field with spaces? Hello, I'm doing a simple alert, which looks like this: SIP/3102-in-* you=* \| table you, id Which should extract ... by yozhbk Explorer in Splunk Search 08-01-2016 0 11	0	11
Search Syntax Highlighting? Hi, As my search strings get more and more ridiculous, I find myself writing them in sublimetext or notepad++ or vim ... by proletariat99 Communicator in Splunk Search 08-01-2016 2 3	2	3
How to write a search to list all hosts and their count of triggered alerts from a CSV file, even if the alert count is 0? Hello All, I have obtained the list of all alerts via REST API search as: \| rest /servicesNS/-/-/saved/searches sea... by Honey0308 Explorer in Splunk Search 08-01-2016 0 1	0	1
How to add blank rows in a table? Hi friends!!! I am using the delta command to show the difference between two entries/values, but need to have a bla... by dennisaraujo Path Finder in Splunk Search 08-01-2016 0 2	0	2
Events with maximum value of dynamic field I think I'm missing something. I have rex generating a new field for me. I want to return only events with the maximu... by mmclain1 Explorer in Splunk Search 08-01-2016 1 3	1	3
How to display only matching names from a CSV file with 2 fields? Hi, I'd like to have Splunk display only matching names from my .csv data source which has 2 fields. I'd like to di... by infra2sec Path Finder in Splunk Search 08-01-2016 1 5	1	5
header problem in splunk reading the wrong header i am using perl script to pull the data from DB. The data is indexed perfectly and it's using the header that i was m... by lavanyaanne Path Finder in Splunk Search 08-01-2016 0 2	0	2
How to call macros from a Splunk JavaScript SDK search? Hi, In my search, I need to call a macro with the eval command, but I am getting error "bad request". My macros.conf... by ektasiwani Communicator in Splunk Search 07-31-2016 0 3	0	3
Cisco ASA Timechart I'm looking to create a timechart of VPN sessions that shows the number of users logged on over the course of a 24 ho... by jmaple Communicator in Splunk Search 07-30-2016 0 2	0	2
How to add image from URL to a table Pretty simple question, hopefully it is a simple answer. I have data where one field has a URL of an image. I would... by ccsfdave Builder in Splunk Search 07-29-2016 0 3	0	3
Is there a way to find which props.conf and/or transforms.conf file is applied to a specific sourcetype for search-time field extractions? I have certain logs which are indexed correctly. Field extraction using props.conf and transforms.conf works correctl... by ashabc Contributor in Splunk Search 07-29-2016 0 1	0	1
How do we get our summary index search to produce our expected result? Hi, We are planning to implement summary indexing in our dashboards. As part of it, I have created a scheduled searc... by splunker9999 Path Finder in Splunk Search 07-29-2016 0 6	0	6
How to search my Sonicwall logs for multiple values for the same field? Very much a newb looking to get some basic information from my Sonicwall logs. Setting up the search using multiple c... by Rockn New Member in Splunk Search 07-29-2016 0 2	0	2
How to search a specific user's internet activity for a certain time range? (websites visited, search history, timestamps) I am trying to complete a request for a specific employees internet search history. I need to specify a date range, l... by RobertKepner New Member in Splunk Search 07-29-2016 0 7	0	7
Why do search results return nothing on a calculated check? I have a summary index that is holding lead information. One of the data points I created was the numeric day the lea... by jsilverbears Path Finder in Splunk Search 07-29-2016 0 3	0	3
Should you specify or not specify the index in your search? What are everyone's thoughts on whether you should or should not specify the index in your search? Is sourcetype=val... by sjaworski Communicator in Splunk Search 07-29-2016 0 5	0	5
Count Sourcetype by Day In 6.4.2 version, when i try to count the integrated volume by sourcetype last day for example with this search : ea... by laberthelemy Engager in Splunk Search 07-29-2016 0 7	0	7
Getting duplicate rename fields error after upgrade from 6.3.0 to 6.4.2 The following search worked prior to upgrade: \| stats sparkline count dc(sourcetype) as sourcetype last(_raw) as las... by bandit Motivator in Splunk Search 07-29-2016 0 2	0	2
Are there recommendations on teaching users how to get current data from reports without hitting concurrent search limits? A ticket has come across my desk today where a customer is getting different results from different search heads for ... by jamesoconnell Path Finder in Splunk Search 07-29-2016 0 8	0	8
Does lookup command support OR Boolean operation? Hello, I have events in index 1 and I have lookup table 1 created from a CSV file. I want to lookup events from index... by vpao Engager in Splunk Search 07-29-2016 0 1	0	1