Splunk Search

Community Activity

Why am I getting different results based on the time modifiers used to control the dates within a search? Has anyone had any experience, getting different results depending on the date modifiers used to control the dates? ... by HattrickNZ Motivator in Splunk Search 03-07-2016 0 2	0	2
How to count the number of opened and closed incidents using opened_at and closed_at date/time fields in each event? Hi, I've searched throughout Answers for some time now and didn't find any, unfortunately. Got in my Splunk environ... by romaindelmotte Explorer in Splunk Search 03-07-2016 0 6	0	6
Compare indexed file with lookup table where lookup table field is substring of indexed file field I want to compare an indexed file with lookup table, where lookup table field is substring of indexed file field Sam... by rajchi Explorer in Splunk Search 03-07-2016 0 6	0	6
Sum of count conditionally within a query I have incoming calls and I'm trying to get total number of calls followed by sum of calls where the field "result" e... by dcavag001c New Member in Splunk Search 03-07-2016 0 4	0	4
How to write a search for a dashboard to display all the users (based on uid) who entered the invalid credentials? I need some help writing a search for a dashboard to display all the users (based on uid) who entered the invalid cre... by krishnacasso Path Finder in Splunk Search 03-07-2016 0 3	0	3
Is there a way to add results to dbquery search when none are returned? Similar to 'fillnull' but for 'no results'. I am using DBquery to access a DB that has our monitoring configuration. I am trying to determine ratio of monitors m... by ericrobinson Path Finder in Splunk Search 03-07-2016 0 4	0	4
Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK? I have a large number of reports to produce according to a data hierarchy. These are to be provided to the client as... by Redman11 Explorer in Splunk Search 03-07-2016 2 4	2	4
How to find the length of the string using len(string) function Hi, I am trying to extract a corId from the log and find the length of the corId. when searching am able to successf... by splunk_jerome Engager in Splunk Search 03-07-2016 1 3	1	3
SPlunk Query-Logins and failure Hi, Can someone please suggest us a query we can build to find successful login and failed attempts in a separate qu... by splunker9999 Path Finder in Splunk Search 03-07-2016 0 5	0	5
How can i do Subtraction cycle? Hi, I have calculate avg values, but i want do subtraction cycle like values=1,2,5,7,10;sum=25;avg=5 show: 5-1=4 5... by chengyu Path Finder in Splunk Search 03-07-2016 0 3	0	3
Weird behavior with the pow()-function Basically what goes wrong is that the pow() function seems to act weird when exceeding anything above the power 23. T... by dkoops Path Finder in Splunk Search 03-07-2016 0 6	0	6
How to create a "sliding" maxspan on transaction? Hello all, I want to make a kind of sliding maxspan on transaction. What maxspan usually does in transaction is con... by collier31200 Explorer in Splunk Search 03-07-2016 0 2	0	2
Can we name the addcoltotals field in a bar chart? I ran this search: .....\| chart count by TYPE \| addcoltotals labelfield=total and got these results: type co... by vrmandadi Builder in Splunk Search 03-07-2016 0 10	0	10
What is the correct syntax to get the 90 percentile for Response Time in a Splunk search? I want to plot the 90 percentile response time in Splunk. Is the below correct? \| timechart p90(ResponseTime) or ... by vivekshankar82 New Member in Splunk Search 03-07-2016 0 2	0	2
How do I edit my rex statement to extract fields from a raw string of repeated text into a table? Used the following command rex "(?\d+)\[(?\-?\d+\.?\d+)\]"\| table ..., but the entire string gets extracted into a s... by arunsubram Explorer in Splunk Search 03-06-2016 0 9	0	9
How to search and compare virus alert data to see if a client had an infection that was not removed, but was successfully removed later? Hi all We have virus alerts in Splunk. What I would like to do is to create on overview to check if a certain client... by zimmermann_0 Engager in Splunk Search 03-06-2016 1 3	1	3
Regex to extract varying string Hello.. I am attempting to extract a string of varying format using regex. I have successfully extracted part of the... by ahogbin Communicator in Splunk Search 03-06-2016 0 16	0	16
How to join data from a database to an event with multiple values for a field in the same event? So the basic idea of this is I have an event that has multiple entries within the same Data field. I need to join inf... by Bstylee303 New Member in Splunk Search 03-06-2016 0 2	0	2
How do I edit my transforms.conf to properly extract these fields from my sample data? Hi All. I want to extract fields from the following log data. headerName=Host, Connection, Accept, headerValue=splu... by akanno Communicator in Splunk Search 03-06-2016 0 1	0	1
Getting errors for every search I run Hi All, I am getting below error for every search I am rinning for Summary indexing. Search process did not exit cl... by usha_nittala New Member in Splunk Search 03-06-2016 0 2	0	2
How do I use lookup to list all records on a specific field I have a sourcetype that contains application (SYS_ID) information. I also have a table that contains the responsible... by cbrownlee New Member in Splunk Search 03-05-2016 0 2	0	2
why fields should be extracted from raw data in splunk? why we need to extract fields from machine data? by saibhaskarammu New Member in Splunk Search 03-05-2016 0 3	0	3
How to search DHCP lease times for specific hosts and how long a host had a specific IP address? Hi All, I'm currently working on a Splunk search that will show me DHCP leases for specific hosts and how long a hos... by seriouscat Explorer in Splunk Search 03-05-2016 0 1	0	1
Field manipulation using SED I am testing using Splunk to index a minecraft server, but have some problem with user name. Lines look like this: F... by lakromani Builder in Splunk Search 03-05-2016 0 3	0	3
How can I do a stable sort? I am trying to create a view that merges log records from various files, ordered by their timestamps. This works nic... by jdjdjdjd Engager in Splunk Search 03-04-2016 0 8	0	8

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Search

Why am I getting different results based on the time modifiers used to control the dates within a search?

How to count the number of opened and closed incidents using opened_at and closed_at date/time fields in each event?

Compare indexed file with lookup table where lookup table field is substring of indexed file field

Sum of count conditionally within a query

How to write a search for a dashboard to display all the users (based on uid) who entered the invalid credentials?

Is there a way to add results to dbquery search when none are returned? Similar to 'fillnull' but for 'no results'.

Is it possible to automate the export of dashboards as PDFs when these dashboards require parameters to be passed to their searches, or is this something I'd only be able to do with the SDK?

How to find the length of the string using len(string) function

SPlunk Query-Logins and failure

How can i do Subtraction cycle?

Weird behavior with the pow()-function

How to create a "sliding" maxspan on transaction?

Can we name the addcoltotals field in a bar chart?

What is the correct syntax to get the 90 percentile for Response Time in a Splunk search?

How do I edit my rex statement to extract fields from a raw string of repeated text into a table?

How to search and compare virus alert data to see if a client had an infection that was not removed, but was successfully removed later?

Regex to extract varying string

How to join data from a database to an event with multiple values for a field in the same event?

How do I edit my transforms.conf to properly extract these fields from my sample data?

Getting errors for every search I run

How do I use lookup to list all records on a specific field

why fields should be extracted from raw data in splunk?

How to search DHCP lease times for specific hosts and how long a host had a specific IP address?

Field manipulation using SED

How can I do a stable sort?

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation