Splunk Search

Community Activity

How to use Wildcards with eval, stats, and count? Hello! I have a field called "Customers Email" and I wanted to get a count of all the emails that end in .gov, .edu, ... by cdson Explorer in Splunk Search 11-09-2022 0 2	0	2
Way to exclude results from Values() based on # returned? I'm trying to do a search to find IPs trying to login in using multiple usernames (using Duo). I have it working ver... by JR_Akaviri Engager in Splunk Search 11-09-2022 0 2	0	2
Align all values of a table to the left (for PDF export) Hello, I am currently trying to create a table on which every value, whether number or string, is aligned to the lef... by ckunath Communicator in Splunk Search 11-09-2022 0 8	0	8
How to dedup in a search with a Lookup table? I have a working search that uses a look up, that is like this: index=MyIndex [\| inputlookup MyCSVFile \| stat... by earriaga Path Finder in Splunk Search 11-09-2022 0 1	0	1
How to combine two field values into one field from a .csv file? Hello! I have a csv file where there are two fields called "Customers First Name" and "Customers Last Name". I was ... by cdson Explorer in Splunk Search 11-09-2022 0 2	0	2
Why do transforming commands not work after upgrade to Splunk 8? Hello, I have recently upgraded from Splunk 7 to Splunk 8.2.4. After the upgrade, I noticed that some transform co... by sistemistiposta Path Finder in Splunk Search 11-09-2022 0 23	0	23
How to search duration of job? Hi, I am trying to build a query where I need Job duration. Each job could run multiple time and its start/end time ... by AKG11 Path Finder in Splunk Search 11-09-2022 0 3	0	3
How to change timestamp value on old data in an index? Hi there, I have a requirement where I have a large number of events which was uploaded on the 4th November but that ... by vishalduttauk Communicator in Splunk Search 11-09-2022 0 7	0	7
Is there a way to sort eval-ed field by one of its parent fields? Hi all, I need some help sorting an eval field by one of it's components per below. ... \| eventstats count(ID) AS c... by Dworsnop Path Finder in Splunk Search 11-09-2022 0 8	0	8
How to refine search to pull the hosts that has 100+ results? So based off my original query that shows 100+ hosts, I would like to generate a list of the hosts in statistics but ... by wrongquery Explorer in Splunk Search 11-09-2022 0 6	0	6
How to compare GeoLocation values of login events for each user to previous logins? I am trying to create an alert that triggers when the location field of a login event from a user changes. so if a us... by olawalePS Path Finder in Splunk Search 11-09-2022 0 1	0	1
Unable to get fields with rex? Hello, I have this search results: Error for user flow: AAAAA - user: BBBB - Msg: {\"_errorCode\":Z, \"_messa... by frnSpLrnr11 Engager in Splunk Search 11-08-2022 0 2	0	2
How to exclude top N values or percent from percentile calculations? I'm trying to get an accurate percentile representation from a dataset of hourly metrics, excluding outliers. The da... by JM_dataguy New Member in Splunk Search 11-08-2022 0 2	0	2
How to compare two multi value fields and return true when at least one of the values matches? Hello Splunkers, I am trying to compare two multi value ID columns, and return true when at least of the values ma... by RexPei New Member in Splunk Search 11-08-2022 0 3	0	3
How can I build a report using my query of IP addresses with the location information off of the lookup file? Hi Team. I have a splunk query with a list of IP addressses(Client_IP). I also have a lookup file with the IP ranges(... by dionrivera Communicator in Splunk Search 11-08-2022 0 1	0	1
Why is my Splunk License daily volume usage count 0 MB? My doubt is that I can see,My Volume used today = 0 MB ( 0% of quota ). Why It's showing as 0 MB, I tried many queri... by imranshs Engager in Splunk Search 11-08-2022 0 3	0	3
Release Management with Splunk? All, We're looking to open Splunk up some and let developers submit TAs and apps and what not without admin involve... by daniel333 Builder in Splunk Search 11-08-2022 0 1	0	1
Refining the search query using dynamic values Hi Community, I have a search query where I am trying to get values for the search from the results of another query.... by _pravin Contributor in Splunk Search 11-08-2022 0 2	0	2
Search factor vs Replication factor-If I change my SF=2 , does this mean 2 copies are changed to primary? i know that setting RF=2 ensures 2 copies of buckets on available indexers. so this consume 2X times of space/disk.no... by jiaqya Builder in Splunk Search 11-08-2022 2 10	2	10
How to set a report hourly for time frame between 26th to 5th of each month? How to set a report hourly for time frame between 26th to 5th of each month? by wanda619 Path Finder in Splunk Search 11-08-2022 0 7	0	7
How to find more than 3 heartbeat failure with failure reason from same host in a day and put in a table? Hi All, How to find more than 3 heartbeat failure with failure reason from same host in a day and put in a table?I a... by navan1 Explorer in Splunk Search 11-08-2022 0 2	0	2
savedsearch vs outputlookup- Which one is more efficient to use and should be used as default? I run large searches at the start of each month. Generally I use the saved search commands to retrieve the results on... by MaxJ New Member in Splunk Search 11-08-2022 0 2	0	2
Create a new field based on existing filelds Hello,My requirement is if the field "fields.summary" contains events that contain ".DT", then I want to create a new... by sidtalup27 Explorer in Splunk Search 11-08-2022 0 1	0	1
Log messages counts are getting overlapped in splunk dashboard? Index=dev log-severity=INFO app name=abcd \| rex “tv counts for indicator S = (?<Count>\d+)” \| stats count by _t... by Aryc090908 Explorer in Splunk Search 11-08-2022 0 4	0	4
Can you change the base search depending on a drop down value? I have a dashboard that uses a dbxquery in the base search. I would like to make the dashboard "bilingual".Is it pos... by replicant Engager in Splunk Search 11-08-2022 0 3	0	3