Splunk Search

Community Activity

How to count range of dates? hello team please i need solution to these question i have three column fields, startDate,endDate, ARTstartDate. i wa... by ositaumeozulu Explorer in Splunk Search 06-09-2022 0 4	0	4
How too Add exception in "case"? Hi, I have several model id: 12310, 12320, 12330. If the suffixes = "10", "20", "30", I define the typemachine accor... by Julia1231 Communicator in Splunk Search 06-09-2022 0 2	0	2
How to create a group for totals "greater than"? Hi all, I've been working on this query for the last few days and still can't seem to crack it. (Appreciate the perso... by KyleMcDougall Path Finder in Splunk Search 06-09-2022 0 1	0	1
How to calculate IIS Events In Progress over Time? Our IIS logs contain a "time_taken" field which indicates the number of milliseconds each event took. I'd like to use... by rstankus Explorer in Splunk Search 06-09-2022 0 12	0	12
How to create and alert that pops up from search? I want to create an alert that pops up when the events match at least 500 times the same source IP address, same dest... by bolopez Explorer in Splunk Search 06-09-2022 0 2	0	2
How to create a wildcard search of a field which is a jobname and getall values starting with A through M anycase? I need a list of only those jobName which start with letter a though m - anycase. The below does not work index=log... by mihir_hardas Explorer in Splunk Search 06-09-2022 0 2	0	2
How to count events in a time frame based on a time elapsed field What is the is the best approach to creating a field that shows the number of incomplete requests in a given period o... by CarbonCriterium Path Finder in Splunk Search 06-09-2022 0 3	0	3
How to search from custom time field? Hi All, I have logs which is from db_inputs/custom_script where owner not indexing custom time field as _time and the... by kpavan Path Finder in Splunk Search 06-09-2022 0 2	0	2
Inconsistent result between events and statistics- is this a limitation of custom scripts or configuration issue? Hi, I have a custom Python script developed in Splunk where it will translate Chinese characters to English. The cust... by johanhakim Explorer in Splunk Search 06-09-2022 0 3	0	3
How to find all manual searches performed on a single index for a period of 1 month? Hi Team, I would like to retrieve following info through Splunk search 1. List of all splunk searches performed ... by splunkfriend123 Engager in Splunk Search 06-08-2022 0 6	0	6
Can I create a search parameter that maps to multiple field values? For context, I'm creating a dashboard where a user can search activity of all hosts in an environment or one host in ... by griffins Explorer in Splunk Search 06-08-2022 0 3	0	3
Why are the kvstore lookups uncharacteristically case-sensitive in field values? Has anyone figured a way to make kv-store lookups NOT case sensitive on field values? If so, how? We're about to mig... by dstaulcu Builder in Splunk Search 06-08-2022 0 14	0	14
Can you create this query please? Can you create a query that search for all the logs that got entered in an index for the last 24hours and group it by... by test2001 Observer in Splunk Search 06-08-2022 0 4	0	4
Which permission do I need to share sourcetype with users? Hey everyone and I hope your having a great day!I have configured a custom field extraction in the Splunk search app ... by test2001 Observer in Splunk Search 06-08-2022 0 0	0	0
How to remove closing bracket "]" from my data? Data looks like src:10.124.4.151] and i want to remove this bracket and data should look like 10.124.4.151 I am try ... by R_M Loves-to-Learn in Splunk Search 06-08-2022 0 2	0	2
How to count the number of sessions with more than one intent? I'm trying to count the number of sessions (known as sessionId) that have more than 2 intents. (An intent is a field ... by KyleMcDougall Path Finder in Splunk Search 06-08-2022 0 9	0	9
How to specify the time frame in a search? Hello,How would I specify the time frame in a search to provide me the events between 7am - 5pm weekdays and all resu... by troy44112 Explorer in Splunk Search 06-07-2022 0 2	0	2
How to measure by-host "imbalance"? Gurus I have an infoblox query that simply measures total amount of queries over a certain period by host for a given... by stucky101 Engager in Splunk Search 06-07-2022 0 10	0	10
How to exclude events if results from entire day returns zero? I need to exclude events from a timechart only if they fulfill 2 conditions:the field returns 0 for ALL events in the... by dzyfer Path Finder in Splunk Search 06-07-2022 0 1	0	1
Why are historical events not showing up in searches? I needed to restart my Splunk instance on our heavy forwarder the other day. After restarting, I am unable to search ... by amoore12 Explorer in Splunk Search 06-07-2022 1 20	1	20
Throttling resetting suppresions I'm getting a bit annoyed at throttling for each, as although it works - it has a habit of resetting itself if I need... by donelliot Path Finder in Splunk Search 06-07-2022 0 0	0	0
How to extract 50A720 or 816851using \| rex field=name mode=sed "s/816851/"? The data i have is 816851-567-7554080981706881 50A720 -123-8150015922249983 816851-567-1135131573613120816851-567-006... by ashidhingra Path Finder in Splunk Search 06-07-2022 0 4	0	4
How to get aggregate information from lookup table and return to outer dbxquery? Hi, I have a table as the main search using dbxquery below:\| dbxquery connection=my_connection query="SELECT id, star... by grantmeng Loves-to-Learn Lots in Splunk Search 06-07-2022 0 6	0	6
How to calculate dates in splunk? again i wanted to list difference in dates between two periods and i have this code \| eval LPD = strptime(LastPickupD... by ositaumeozulu Explorer in Splunk Search 06-07-2022 0 4	0	4
How to measure the server down time based on host and server status? Sample Event: sent=1 received=0 packet_loss=100 min_ping=NA avg_ping=NA max_ping=NA jitter=NA return_code=1 dest=SHTC... by ShamGowda Loves-to-Learn Lots in Splunk Search 06-07-2022 0 6	0	6