Splunk Search

Community Activity

How to get a timechart for two values, but not sort by the split-by field alphabetically? I'm trying to plot to two separate values against another value like this timechart avg(x) avg(y) by z And I want ... by Skamensky Engager in Splunk Search 07-06-2016 0 3	0	3
Is it possible to extract a multivalue field from an already extracted field using fields.conf? I was wondering if it's possible to extract an mv field, from an already extracted field, using fields.conf? For exa... by tmarlette Motivator in Splunk Search 07-06-2016 0 1	0	1
Too many search jobs found in the dispatch directory + Keep on extending the job expiry time + Search artifacts not removed as per ttl I see too many search jobs present in the dispatch directory. Even after completing the jobs the expiry date keep on ... by splunker12er Motivator in Splunk Search 07-06-2016 1 3	1	3
Using dedup with multiple fields I can do the following separately, and I get the results I want. index="wineventlog" EventIdentifier="4624" \| dedup ... by tmontney Builder in Splunk Search 07-06-2016 0 12	0	12
My weekly timespan shows bins that are more than week boundaries I have set up an accelerated summary for a report with summary range of 1 month. I want to report summary by week. Wh... by tambepc New Member in Splunk Search 07-06-2016 0 3	0	3
How to extract and report on field values from a large CSV file in a directory on my Splunk server that is updated daily? I have a bit of a non-traditional application, but one which Splunk is pretty good at 95% of: There's a big file (ca... by apnetmedic Explorer in Splunk Search 07-06-2016 0 2	0	2
How can I track employees' website usage? Hello My firm currently has the dashboard below that shows top employees utilization and top sites visited. I am lo... by jVolpi New Member in Splunk Search 07-06-2016 0 2	0	2
Calculate percentage Hello, I have this query: index=dm counter="Short Equity Loop Duration" \| timechart span=1h max(Value),median(Value) ... by Rotema Path Finder in Splunk Search 07-06-2016 0 5	0	5
Why am I getting error "The events associated with this job have no sourcetype information" trying to extract a field in Hunk? I am trying to extract a field in Hunk, and I get the following error: The events associated with this job have no ... by jwalzerpitt Influencer in Splunk Search 07-06-2016 0 7	0	7
How to extract each key=value as a new field from a multikv field at search-time? At search-time, I've been able to massage my data into a multikv field like so: Is it possible to extract each key=... by zeophlite New Member in Splunk Search 07-06-2016 0 5	0	5
Is there any thing similar to active list or reference set in Splunk Hi, I want to push the internal IP address (or host name) in a reference set, whenever I see any communication with... by rishabhey2016 Explorer in Splunk Search 07-06-2016 0 2	0	2
Splunk last 7 days within current month? Hello, I'm using dd/mm/yyyy date format and results are not correctly sorted if we are dealing with data across mont... by splunkreal Influencer in Splunk Search 07-06-2016 0 3	0	3
Trying to create a search that will use the results to feed another search and output the results in a table. So I have a search that tells me is someones account is locked. I have been asked to create an alert or search that ... by bworrellZP Communicator in Splunk Search 07-05-2016 1 10	1	10
Json Multi array extraction with changing/missing field name Hi, I am trying to extract the json fields where one of the fields name can change between "stringValue" or "doubleVa... by psable Explorer in Splunk Search 07-05-2016 0 2	0	2
multisite replication factor I have another site I want to add with 2 indexers and 1 search, same setup as site1. I want to have copies across bot... by tvernick Engager in Splunk Search 07-05-2016 0 1	0	1
fields not showing up from csv source with header in first line. Hi, I have a csv file which grows every five min. it's proper header fields. But I'm not getting the headers as fie... by anasar New Member in Splunk Search 07-05-2016 0 2	0	2
Help grouping eval results by City Hi, My current query is \| stats earliest(_time) as first_login latest(_time) as last_login by IP_address User \| ... by zsizemore Path Finder in Splunk Search 07-05-2016 0 7	0	7
How do I only show certain values in a field? I'm trying to group ldap log values. I have already listed them out from a comma separated value but, I'm having a ha... by Dallastek Explorer in Splunk Search 07-05-2016 0 2	0	2
find all events of type X that do not have an event of type Y within 1 minute on either side I'm new to Splunk and trying to figure out how to find all events of type X that do NOT have an event of type Y withi... by noah10 Explorer in Splunk Search 07-05-2016 2 30	2	30
What is the easiest way to format column headers for raw data that is in a list format? What is the easiest way to get headers on columns for raw data that is in list format? Here is what the raw data loo... by helenwall New Member in Splunk Search 07-04-2016 0 1	0	1
How I can create a search with more than one field from specific logs format? Hello, I have logs in this format: 2016-06-27 21:35:50 (123456789467056149): string11 creating to String12: a1 3 a... by mstachul New Member in Splunk Search 07-04-2016 0 3	0	3
I have 2 fields i.e. Currency and Amount. I want to convert amount with its associated currency into INR format so that I can sum it up and calculate revenue. Currency Amount USD 2 INR ... by mayurr98 Super Champion in Splunk Search 07-04-2016 0 3	0	3
date modifier Hey guys. I want to find hosts for all time which haven't any messages last 7 days, trying this: index=main source=... by Shark2112 Communicator in Splunk Search 07-04-2016 0 6	0	6
How to find the timechart of difference value . I have one field abc which contain values of different parameter and it goes on increasing gradually. I have to add t... by Padma12345 Explorer in Splunk Search 07-04-2016 0 5	0	5
How to search for users who haven't signed in to an app over the last 30 days. Hello, I'm trying to figure out the search that would be needed to find any users who haven't logged in to an appli... by stegray93 Explorer in Splunk Search 07-04-2016 0 4	0	4

Get Updates on the Splunk Community!

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...

Splunk Search

How to get a timechart for two values, but not sort by the split-by field alphabetically?

Is it possible to extract a multivalue field from an already extracted field using fields.conf?

Too many search jobs found in the dispatch directory + Keep on extending the job expiry time + Search artifacts not removed as per ttl

Using dedup with multiple fields

My weekly timespan shows bins that are more than week boundaries

How to extract and report on field values from a large CSV file in a directory on my Splunk server that is updated daily?

How can I track employees' website usage?

Calculate percentage

Why am I getting error "The events associated with this job have no sourcetype information" trying to extract a field in Hunk?

How to extract each key=value as a new field from a multikv field at search-time?

Is there any thing similar to active list or reference set in Splunk

Splunk last 7 days within current month?

Trying to create a search that will use the results to feed another search and output the results in a table.

Json Multi array extraction with changing/missing field name

multisite replication factor

fields not showing up from csv source with header in first line.

Help grouping eval results by City

How do I only show certain values in a field?

find all events of type X that do not have an event of type Y within 1 minute on either side

What is the easiest way to format column headers for raw data that is in a list format?

How I can create a search with more than one field from specific logs format?

I have 2 fields i.e. Currency and Amount. I want to convert amount with its associated currency into INR format so that I can sum it up and calculate revenue.

date modifier

How to find the timechart of difference value .

How to search for users who haven't signed in to an app over the last 30 days.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation