Splunk Search

Community Activity

Is there a way I could combine the results from the above query with the first query to refine the search command? Hi Community, I have the below search query index=_internal [ `set_local_host`] source=license_usage.log... by _pravin Contributor in Splunk Search 11-08-2022 0 4	0	4
Can we convert to tstats? Hello,Is there a way to convert this query to run with tstats? It is _slow_ when running it for two weeks of data...i... by danielbb Motivator in Splunk Search 11-08-2022 0 2	0	2
How to perform the below condition in Splunk search? I have 3 date columns.I have already calculated the difference between current day and the diff is in days are the va... by dtccsundar Path Finder in Splunk Search 11-08-2022 0 4	0	4
Can I have a dedicated search head that only runs scheduled reports? I have a search head cluster and I will have scheduled reports that send data to a summary index. I don't want other ... by klim Path Finder in Splunk Search 11-07-2022 0 2	0	2
How to change index based on MetaData:Source. Hello, can anyone tell me why this configuration isn’t working?I would like to change index name from main to hue, I’... by mskrzynski Explorer in Splunk Search 11-07-2022 0 10	0	10
How to get multiple distinct counts for subset of logs in single query? Hello, I am currently using the \|append method for some queries, but was curious if there is a better way for me to b... by Damek Engager in Splunk Search 11-07-2022 0 2	0	2
How can I overlay the 7 day, 30 day or 90 day average line over the timechart? Dumb question I cannot find a simple answer to. 藍 If I run a simple timechart search for 7 days, 30 days or 90 days -... by dmbrcx Explorer in Splunk Search 11-07-2022 0 3	0	3
What's the difference between nomv and mvcombine? Could someone please show the difference between nomv and mvcombine with some examples? What I have seen is that both... by nabeel652 Builder in Splunk Search 11-07-2022 0 2	0	2
Help with Eval from Multivalue field? I have a dataset with a multiline field called Logs. The field typically has values like the below, "mId": "Nul... by ff170a Explorer in Splunk Search 11-07-2022 0 3	0	3
How to display a table based on a clicked value of another table? I have a table with 1 column and 6 rows which I'll be changing to 1 row and 6 columns using transpose and eventually ... by sh254087 Communicator in Splunk Search 11-07-2022 0 6	0	6
tstats with where condition \| StatsFileWriterLz4 file open failed file=C:\Splunk\var\run\splunk\srtemp\910252184_17768_a I have a SPL, when first running the result is appearing but once the query is finished the error have shown below: \|... by iamtheclient20 Explorer in Splunk Search 11-07-2022 1 8	1	8
Getting Rex sub pattern error when using counts Index=dev log-severity=INFO app name=abcd \| rex “tv counts for indicator S = (?<Count>\d+)” \| stats count by _... by Aryc090908 Explorer in Splunk Search 11-07-2022 0 3	0	3
Lookup for a value in two lookup table columns? Hi, I have generated a search which return list of hosts and the count of events for these host. sometime the host va... by Hisham Engager in Splunk Search 11-07-2022 0 1	0	1
Annotation based on Existing Value (to avoid duplicate search) On an existing dashboard I have a rather complex query that generates a timechart on which I am looking to use annota... by lennys26 Communicator in Splunk Search 11-07-2022 0 2	0	2
Why is my rex command extracting other text strings I am using the following rex command to extract an id number, which is in the following format: 1e4gd5g7-4fy6-fg567-3... by jhilton90 Path Finder in Splunk Search 11-07-2022 0 7	0	7
Is there a way to be notified(alerted) if any saved searches are modified? I am looking for an alert when any search in (rest /services/saved/searches splunk_server=local) is being modified. by nihvk Explorer in Splunk Search 11-07-2022 0 1	0	1
How to best approach timeseries graph based on multiple fields? Hi, I am looking to create timeseries graph based on multiple fields.we could have multiple hosts and each host have ... by AKG11 Path Finder in Splunk Search 11-07-2022 0 5	0	5
How to visualize ongoing actions based on start/stop time? Hi,I have events which are received when action is finished on my system. Event contains start and stop time for acti... by karjsim Loves-to-Learn Lots in Splunk Search 11-07-2022 0 9	0	9
Why am I unable to search from "MAIN" index? Hello, I have installed an App, and the data in APP is written to "MAIN" index. When I am search for DATA from the AP... by sidtalup27 Explorer in Splunk Search 11-07-2022 0 3	0	3
How to split different field values into separate fields Hello Everyone, I have a field in this format and this information is fetched from a json array.Label apple 1apple 2a... by anuhya_b Observer in Splunk Search 11-07-2022 0 1	0	1
How to display palo threat over a month with severity again allowed & blocked actions? Hi ,how to do i display number of blocked and allowed threats with different severities in a timeframe(e.g monthly).S... by mkshah New Member in Splunk Search 11-06-2022 0 1	0	1
How to Split Group by Values? Hello, I am very new to Splunk. I am wondering how to split these two values into separate rows. The "API_Name" value... by user33 Path Finder in Splunk Search 11-06-2022 0 7	0	7
What rex command can separate hostname from the field? NONPROD:abcd123456_DBSERVERNeed to extract abcd123456 from the string... by priya1926 Path Finder in Splunk Search 11-06-2022 0 1	0	1
Why does this eval case not work? The following is my ideal final query to be used in a dashboard. index=cdn_app httpMessage.host=taxes* \| eval _env=... by jaycetan New Member in Splunk Search 11-05-2022 0 4	0	4
find Exact string contains double comma How can I find an exact string which has double code in it. I want to find exact string HTTP/1.1" 500 by talktulika Observer in Splunk Search 11-04-2022 0 2	0	2