Splunk Search

Community Activity

	How to calculate the number of days from a create date to the current date? index=servicenow assignment_group_name="security" status=* \| stats count by number,status,group_name,created_on ... by itsmevic70 Explorer in Splunk Search 01-16-2023 0 2	0	2
	How to search count of multiple logs? How can I write a query like following? index=my_app\| eval userError="Error while fetching User"\| eval addressError =... by vishal_pcap Explorer in Splunk Search 01-16-2023 0 10	0	10
	Matching fields from 3 different sources? Hi all, Could some please help me with this query. I have 3 different sources from which i want to match the fields. ... by pratibha0610 Explorer in Splunk Search 01-16-2023 0 1	0	1
	How can I search to filter? hai All, i have events like below from how can i filter events if for ex: 6th character in CE*M IS M want to filt... by sekhar463 Path Finder in Splunk Search 01-16-2023 0 6	0	6
	Why are we getting different results from "count eval if" and "count eval"? Seeing different results when performing similiar searches and not sure on the reason. base search is the same for b... by charlix Engager in Splunk Search 01-16-2023 0 2	0	2
	How to replace a specific character? Hi,I have the below output :1/16/2023 7:51:43 AM 1EE8 PACKET 000001D9C25E6180 UDP Rcv 10.8.64.132 646b Q [0001 D NOER... by quangtran Explorer in Splunk Search 01-15-2023 0 2	0	2
	Optimizing metrics based searches? Hello, I have the following query in one of the panels in my dashboard. \| mstats p95(prometheus.container_memor... by auzelevski Explorer in Splunk Search 01-15-2023 0 0	0	0
	How to imbed dbxquery in a splunk macro? I have a significant number of dashboards that use dbxquery to pull data from a significant number of servers running... by bwyn Observer in Splunk Search 01-14-2023 0 2	0	2
	Retrieve discarded values from the dedup command or other commands? I want to use the dedup command and see which values it removes from a field. Is this possible? by amorales_splunk Splunk Employee in Splunk Search 01-13-2023 0 2	0	2
	remove all text before certain words in events I have events like below-a3bcd: Info1234x:NullValue-a3bcd: Info1234x:NullValue-b3bcd: Info1234x:NullValue2-c3bcd: Inf... by trilocho Loves-to-Learn in Splunk Search 01-13-2023 0 2	0	2
	How to extract the value from the field using rex sed cmd? Hi, I looking for rex sed cmd to extract the value from the field.eg: input field1 = d:\AppDynamics\machineagent\ve... by Babuduraiswamy Engager in Splunk Search 01-13-2023 0 3	0	3
	How to match an ip address to cidr in lookup table? Hey there Splunk hero's, Story/Background: So, there is this variable called "src_ip" in my correlation search. The "... by commanman Explorer in Splunk Search 01-13-2023 0 8	0	8
	How to concatenate a string with a variable? I want to run this search but i have to concatenate the string with a variable and it doesn't work \| rest splun... by buttsurfer Path Finder in Splunk Search 01-13-2023 0 5	0	5
	How to search between two lines? Hello All, I have following lines in the log file - Server8 runiyal 2023-01-12 09:48:41,880 INFO Plugin.DOCUMENT By... by runiyal Path Finder in Splunk Search 01-12-2023 0 3	0	3
	How to create a pie chart after applying math on column values extracted? Hey people, my requirement is as such I have extracted these columns from my data using the query my query \| rex "fil... by sjs Path Finder in Splunk Search 01-12-2023 0 4	0	4
	How to search user concurrent logins on unique hosts? I'm hoping to get some help or direction. I have seen a few different forum posts where the search pulled how many co... by jayygee3 Engager in Splunk Search 01-12-2023 0 2	0	2
	How to calculate days between 2 dates? Hi, Not sure what the issue is. I got the solution from the other answers, but it's not working for me.I am getting d... by splunkuser320 Path Finder in Splunk Search 01-12-2023 0 1	0	1
	How to create an alert if index have no data in the last 24 hours? I want to create alert to check on all indexes event count and alert the list of all indexes that have no events in t... by Neonbeeflash Explorer in Splunk Search 01-12-2023 0 4	0	4
	How to create new field with values from a search that uses values of current field? I have a search that outputs a table like below user \| host \| app------------------------------------- ... by buttsurfer Path Finder in Splunk Search 01-12-2023 0 3	0	3
	Help with Regex extraction 2023-01-09T16:46:00.780076351Z app_name=default-java environment=e3 ns=one pod_container=default-java pod_name=defaul... by siksaw33 Path Finder in Splunk Search 01-12-2023 0 4	0	4
	How to append the result of a search to values of a multivalued field? I have a SPL search that returns a field with multiple values (names of lookups). I want to concat the lookup name a... by buttsurfer Path Finder in Splunk Search 01-12-2023 0 2	0	2
	How to use fit command together with foreach? I would like to fit an ARIMA model to my data with a search something like this: <base search>\| timechart span=5m avg... by Wonjon Observer in Splunk Search 01-12-2023 0 0	0	0
	Can I resolve this splunk dashboard index auto refresh / resync issue? hi all, we are creating one dashboard having two tables , in that we have set different folder locations for monitor... by pp3295 Explorer in Splunk Search 01-12-2023 0 6	0	6
	Using 'like' to find lookup fields which contain the current day of the week (%A) Hey all, I'm attempting to compare a variable (we'll call it cDOW), which is set to (strftime(now(), "%A")), to a DO... by TBH0 Explorer in Splunk Search 01-11-2023 0 5	0	5
	How to organize search substrings into LookUp tables? HelloI have a Splunk query that looks like following: index=something "abc" OR "def" OR "hig" These substrings... by pm771 Communicator in Splunk Search 01-11-2023 0 2	0	2