Splunk Search

Discussions

Thread Info

How to create a new column in my table showing the sum of FieldA by FieldB?

HI My data Quarter Type Amount 2014q1 a 100 2014q1 b 200 2015q2 a 100 2015q2 ...

by Path Finder in

How to rename an index or move everything we have in the main index into another index?

Splunk 6.2.3 on RHEL6. We are growing and I would like to have some consistency in our index naming convention. So, I...

by Path Finder in

How to create a drilldown from my dashboard table to an external URL that has to pick the hostname of the URL from the table?

Hi Experts, I want to drilldown from my table in the dashboard to an external URL for which has to pick the hostna...

by Path Finder in

How to skip events in a search?

Hi splunkers, Problem: We have quite big database with events ( ~3 millions events / month), so search works not...

by Engager in

How to combine multiple stats distinct counts into one search?

I have these 3 stats count searches, but I would like to combine them as one and create a table. host ="web*" sou...

by Communicator in

How do I rank rows based on date if I have Date field values repeating twice?

Hi Could you help me with Ranking rows? I was trying to use streamstats, but the issue here is that I have a Date ...

by Path Finder in

Extract a value from a string?

I'm fairly new to Splunk and I looked at the possible "Questions that may already have your answer?" and didn't find ...

by Explorer in

Is there an easy way to do an "addaverages" instead of the addtotals function?

Is there an easy way to do an addaverages instead of addtotals? I have the following and can't seem to use any provid...

by Builder in

How to only extract fields from Windows Security Event Log 4738 that have actual deltas to display in a table?

Windows Security Event Log eventid 4738 has multiple fields that Splunk extracts values for, which is great, but we'r...

by Engager in

Handling empty fields in format command

I have a search that uses a subsearch to filter out certain kinds of logs. I'm using the format command to create the...

by Explorer in

How to convert Bytes to Mbytes in a search?

Hi everyone I have this field: File_Size="File size (bytes): [byte_size]", where byte_size is nr; e.g File_Size="F...

by Path Finder in

Is it possible to put a Checkbox (YES/NO) in order to let the user choose whether or not to apply drop-down input choices (addinput)?

Hi, I have an addinput drop-down selection which applies to my dashboard (as a token). Is it possible to put a Che...

by Contributor in

How to estimate a project based on events per second (EPS), not GB/day?

Hello I want to estimate a project, but based in EPS (events per second) not GB/day. How can I calculate the max o...

by Explorer in

How to round a decimal up to the nearest whole number?

Hello.. is there anyway to round a decimal UP to the nearest whole number? (e.g.. I would like 0.1 to be 1, 8.00001 t...

by Path Finder in

How do I edit my search to get the distinct count for fields generated with eval?

I have this search and I want only the unique count. I'm getting the unique count for the id field, but not for Permi...

by Communicator in

What are some reasons why a Splunk search would return different results in verbose vs. fast mode?

I have a search where, if I change from fast to verbose mode, I get different results. I'm wondering what are some po...

by Contributor in

How can I write a search to display the average memory utilization over a 4 hour, 7 day, and 30 day period in different time spans?

I am having problems calculating the average memory utilization over different time spans. Not sure if I'm doing t...

by Path Finder in

How can I retrieve a value from local .conf file and use in splunk query

Hi, I have a file in local directory with name myconf.conf . This file is create by setup form filled by user. I w...

by Communicator in

Splunk Regex for Field Extraction

I want to extract fields from the below string(JSON) for: eval time for each javascript (i.e require.min.js) Load ...

by Explorer in

Searching "Caused by: ..." messages from java stack trace

Hi, I'm new to Splunk searches and need help. We currently have searches to filter out log messages with log le...

by New Member in

Merging rows with same values

Hi Guys, Need help on merging data. i have two columns ( first and second) which has the same value but instead of...

by Explorer in

How to display fields that have a common value in a table?

Hi everyone, I have a file with serial numbers and purchase order numbers. In a first table, I display a serial nu...

by Explorer in

Configure Search Head Cluster Peers to search a single indexer vs. an indexer cluster 6.2.5?

I have setup a 6.2.5 SH cluster. The SH cluster consists of 3 SHs and an additional host functioning as a SH deployer...

by Path Finder in

How to send a partial string value to a lookup table and count the occurrences?

I have a field that contains a sentence such as "I love wonderful food!" I want to be able to check each word against...

by Explorer in

compare time format

Hi, A job needs to be completed by 04:45 AM, Can some one help me to extract time from the logs, compare 04:45 AM an...

by Communicator in

Get Updates on the Splunk Community!

Splunk Search

Discussions

How to create a new column in my table showing the sum of FieldA by FieldB?

How to rename an index or move everything we have in the main index into another index?

How to create a drilldown from my dashboard table to an external URL that has to pick the hostname of the URL from the table?

How to skip events in a search?

How to combine multiple stats distinct counts into one search?

How do I rank rows based on date if I have Date field values repeating twice?

Extract a value from a string?

Is there an easy way to do an "addaverages" instead of the addtotals function?

How to only extract fields from Windows Security Event Log 4738 that have actual deltas to display in a table?

Handling empty fields in format command

How to convert Bytes to Mbytes in a search?

Is it possible to put a Checkbox (YES/NO) in order to let the user choose whether or not to apply drop-down input choices (addinput)?

How to estimate a project based on events per second (EPS), not GB/day?

How to round a decimal up to the nearest whole number?

How do I edit my search to get the distinct count for fields generated with eval?

What are some reasons why a Splunk search would return different results in verbose vs. fast mode?

How can I write a search to display the average memory utilization over a 4 hour, 7 day, and 30 day period in different time spans?

How can I retrieve a value from local .conf file and use in splunk query

Splunk Regex for Field Extraction

Searching "Caused by: ..." messages from java stack trace

Merging rows with same values

How to display fields that have a common value in a table?

Configure Search Head Cluster Peers to search a single indexer vs. an indexer cluster 6.2.5?

How to send a partial string value to a lookup table and count the occurrences?

compare time format

Enterprise Security Content Update (ESCU) | New Releases

Index This | Divide 100 by half. What do you get?

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

How to grab a different field in an event, based o...

Regex matching in a Splunk search query that invol...

Using splunk-sdk in user-defined functions in Spar...

Verification of SAML assertion using IDP's cert fa...

ジョブを消しても復活する現象について