Splunk Search

Discussions

Thread Info

Where is Splunk creating my summary index?

Hi, I have a customer who is scheduling a search that uses db query. He then wants to send the output of that search ...

by Champion in

How can I extract all fields and values from a json result?

Here's an example of the result that I have and I want to extract all fields. I know spath, but I don't want to name ...

by Path Finder in

Why does the fields command in my search only display the field names, but no values?

Hello, Need help with this search. I would like to use timechart to aggregate the results hourly. My search is: ...

by New Member in

Ranking rows in a Table based on count using Transpose & Timechart

I want something like below in the table. Channel Name 25-Mar-15 26-Mar-15 27-Mar-15 28-Mar-15 29-Mar-15 30-Mar-1...

by Path Finder in

Can one scheduled saved search trigger another saved search?

Is is possible to setup an alerting condition on a scheduled saved search what would turn around and launch another s...

by Super Champion in

Report hourly max count events per day over a month

Hello, I m trying to get the hour per day which gets the most hits on my application over a month but having some ...

by Explorer in

How do I maintain multivalue fields in a steaming custom command?

I'm working on a streaming custom command that converts a field containing binary to a multivalue field of the binary...

by Path Finder in

I have a table created for a report, but how do I delete the first two rows of the chart since they contain no data?

Hello, I have a table I created for a report. However, I'm trying to find a way to get rid of the first two rows o...

by Explorer in

How to do search for medium-sized events in splunk?

I would like some help from you to do a search for medium-sized events in splunk? Please help me. Tks.

by Path Finder in

Why am I getting "no results found" trying to display a pie chart with my current code?

Hi I am trying to display a pie chart in a Splunk app using the below code, but I received the message: no results...

by Builder in

How do I search specified fields with the same keyword list without searching the entire index?

Assume Splunk is indexing a bunch of structured JSON data and a keyword search such as "foo" OR "bar". Now I want ...

by Explorer in

eval case like only populates first row of evaluated field

I have the following query: city=* store=* | stats values(store) by city | eval Role=case(store LIKE "%frt%", "FT...

by Communicator in

Alter query based on value of a field within the query itself

So I have a query that needs to change based on the value of a field witihin that query. This is the "original" qu...

by Communicator in

How to place a heatmap or highlight the table cell with the highest value in the search result?

My search output contains following table data - Name of the Region, % tickets resolved by L1, and % tickets resolved...

by Builder in

How to search which monitored log files caused me to exceed my Splunk Light 500MB license limit?

I am using Splunk light and have a <500 MB indexed file license limit. I am using 5 universal forwarders which are al...

by Explorer in

How to search string in a field ?

Hello, i have a 2 lists of clients, the 1st one is "All_Client.csv" which is in a saved like an index and the 2nd is...

by Engager in

Is there a streamstats function that will show a running result of each value in a row being multiplied by the result above?

I have a search that returns the survival rate over time. For instance: Time SurvivalRate 1 ...

by Communicator in

How to combine multiple rex expressions and rename the field for an eval expression?

Hi, I wonder if someone could help me please. I'm currently using the following to extract certain fields containe...

by Motivator in

Why is a string value being truncated in my search results?

When I enter a search for my field errorMsg. My results show: errorMsg="Operation failed due to an unknown error"....

by New Member in

How to edit my regex to extract a variable string that may have either dashes or spaces?

Hello, I am trying to put together a regex to extract a string. The issue I have is that the string sometimes cont...

by Communicator in

How to compare two log files

Hello everybody, I'm working on two log files. The first one 'Collab.csv' seems to be like: user_name com...

by Engager in

Is it possible to overlap 2 search results and combine them without common fields?

index=main "string" | timechart count by field_1 index=main sourcetype=certain_logs action=certain_action | timechart...

by Builder in

A user uploaded a CSV file and is able to search it with the lookup command, but why is he unable to view the lookup file in Splunk Web?

Hi. I have a user here who has uploaded a lookup CSV file into $SPLUNK_HOME/etc/apps/<APP>/lookups. What's odd is...

by Builder in

Need to use top-like useother functionality with chart command.

I have some json data that was indexed with sourcetype=_json. There is one field in the json that is an array. I need...

by Contributor in

Color in a table based on values

Hello I try to modify text color in a table based on a field value. Here's the table i display. ScanName ...

by Communicator in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Where is Splunk creating my summary index?

How can I extract all fields and values from a json result?

Why does the fields command in my search only display the field names, but no values?

Ranking rows in a Table based on count using Transpose & Timechart

Can one scheduled saved search trigger another saved search?

Report hourly max count events per day over a month

How do I maintain multivalue fields in a steaming custom command?

I have a table created for a report, but how do I delete the first two rows of the chart since they contain no data?

How to do search for medium-sized events in splunk?

Why am I getting "no results found" trying to display a pie chart with my current code?

How do I search specified fields with the same keyword list without searching the entire index?

eval case like only populates first row of evaluated field

Alter query based on value of a field within the query itself

How to place a heatmap or highlight the table cell with the highest value in the search result?

How to search which monitored log files caused me to exceed my Splunk Light 500MB license limit?

How to search string in a field ?

Is there a streamstats function that will show a running result of each value in a row being multiplied by the result above?

How to combine multiple rex expressions and rename the field for an eval expression?

Why is a string value being truncated in my search results?

How to edit my regex to extract a variable string that may have either dashes or spaces?

How to compare two log files

Is it possible to overlap 2 search results and combine them without common fields?

A user uploaded a CSV file and is able to search it with the lookup command, but why is he unable to view the lookup file in Splunk Web?

Need to use top-like useother functionality with chart command.

Color in a table based on values

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

SignalFlow: What? Why? How?

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Proactively stream data to different index after C...

Write Splunk log with Laminas

Issues in multiselect input dropdown

Using splunk-sdk in user-defined functions in Spar...

Verification of SAML assertion using IDP's cert fa...