Splunk Search

Community Activity

Retrieve all latest rows that share the same _time value? I have an application that sends logs to Splunk every few seconds. These logs are "snapshots" which provide a static ... by HappyFeet Engager in Splunk Search 09-28-2022 0 2	0	2
Filter JSON search results based on another log message in the same search? I have the below search results that will consist of 2 different types of log formats or strings. Log 1: "MESSAGE "(... by ghostrider Path Finder in Splunk Search 09-28-2022 0 2	0	2
How to show the total size of events from a source? Hi, I need to show a customer that Splunk is processing their entire file, and thought a good way of doing it was to ... by a212830 Champion in Splunk Search 09-28-2022 1 10	1	10
Can I use macro but complete search if macro is broken or missing? I am using two macros in a search however, I want to use them in a way that IF they are broken or not available the s... by coreyCLI Communicator in Splunk Search 09-28-2022 0 1	0	1
How to compare two fields data from appendcols Hi Community,I need support to know how I can get the non-existent values from the two fields obtained from the "appe... by joomla Engager in Splunk Search 09-28-2022 0 2	0	2
Can splunk index same data into one index but different sourcetypes?? Hello,I have to index a log file in linux server in to one index but need to have two different sourcetype. Is it pos... by sivaranjiniG Communicator in Splunk Search 09-28-2022 1 1	1	1
Need help on regex Hai all,Need help on to extract as new filed for user named after CORP\Message=Task Scheduler started "{<!-- -->B9F5A32A-A340... by sekhar463 Path Finder in Splunk Search 09-28-2022 0 7	0	7
Intermittent log data ingestion- Why aren't logs ingested regularly? I have an issue where the logs aren't ingested regularly. The log file updates every 5 minutes with the same line ent... by drikusc New Member in Splunk Search 09-28-2022 0 2	0	2
Is it possible to specify Event Sampling in a query for use in a Dashboard? For the type of data I am trying to extract, Event Sampling really speeds up the query. This works fine when executin... by dmoberg Path Finder in Splunk Search 09-28-2022 0 5	0	5
How to define time period? For example, the "SUBMIT_DATE" is split by date and time. Then define some period of time as a value(A/B/C). Can this... by simon1524 Explorer in Splunk Search 09-27-2022 0 8	0	8
How to filter results based on property inside JSON string? I want to filter the search results based on tx_id that I extract in the 2nd rex. Meaning only those results that hav... by ghostrider Path Finder in Splunk Search 09-27-2022 0 2	0	2
How to convert check-ins index into date then calculate desync for each day? Hello, I have data like below. {"property":"XYZ", "period":{ "start":"2022-09-16", "end":"2022-10-02" }, "nb-day":17... by Sanjana Explorer in Splunk Search 09-27-2022 0 7	0	7
Help with Splunk json dymanic field extraction Hey all, I am trying to extract dynamic field from json . {"period":{"start":"2023-04-17","end":"2023-05-14"},"check-... by Sanjana Explorer in Splunk Search 09-27-2022 0 5	0	5
Show changed events- What is the right approach to find the block events? Say, we have events like this: _timefwsrc_ipdest_ipdest_portfw_rule_action8/1/22 1:30:00.000 AMfw1192.168.50.518.8.8.... by dennis_u Observer in Splunk Search 09-27-2022 0 2	0	2
How to use a list of allowable IP addresses? Good morning, Curious to see if anyone has used a similar dataset in Splunk and/or any suggestions on the best way to... by kevinb0011 Explorer in Splunk Search 09-27-2022 0 5	0	5
Is there an option to add Time Token function on Dashboard? Hi Team,I have several Dashboards that contain base searches data from reports for example: <search id="baseSearch"... by cbiraris Path Finder in Splunk Search 09-27-2022 0 3	0	3
Help with regex to remove first part of string? I have 2 fields: the values of fieldA are present in fieldB and I need to remove the first part of fieldB up to the v... by tomapatan Contributor in Splunk Search 09-27-2022 0 3	0	3
How to frame a table from stats data? I want to create a Bar chart with the logs where the key would be the stats count field name and value would be the s... by ninja_panda Engager in Splunk Search 09-27-2022 0 4	0	4
How to achieve multiple time ranges in a single report/view? Here is my query. In final line chart when I hover, I am not getting different dates. Rather only 26th Sept (Today's... by angadbagga Explorer in Splunk Search 09-27-2022 0 9	0	9
How to create a dashboard : timechart with base search and events limit? Hi, I have multiple panels that need to run timecharts like these: something \| table _time,A,B</query> \| search A="1"... by asafd Explorer in Splunk Search 09-27-2022 0 1	0	1
How to plot a timechart for calculated value? Hi all,I am calculating a value from data and i want to plot it in a timechart. \| where status!="ABORTED" \| streamsta... by anooshac Communicator in Splunk Search 09-27-2022 0 7	0	7
Stats with different bins (full time period AND 5 min intervals)- How to compare average time? I have a need to compare the average time for certain events with the 5 min bucket/bins of the same events. The idea ... by dmoberg Path Finder in Splunk Search 09-27-2022 0 4	0	4
Checking TA usage-How do I know if a TA is used by any user? How do I know if a TA is used by any user.I have a TA laying around, and I doubt is is been used. But before removing... by zacksoft_wf Contributor in Splunk Search 09-27-2022 0 4	0	4
Why did Splunk 9.0.1 "Fail to parse templatized search for field 'i'"? I'm trying to use the Splunk 9 addition in foreach iteration with ITEM, but it always returns "Failed to parse templa... by yuanliu SplunkTrust in Splunk Search 09-26-2022 0 3	0	3
How to sort values(_time)? Hello everyone!i have the following search: index="xyz" "restart" \| eval _time = strftime(_time,"%F %H:%M:%S") \| ... by klischatb Path Finder in Splunk Search 09-26-2022 0 4	0	4