Splunk Search

Community Activity

	How to break down multiple values into new columns dynamically? I have column with Multiple Values separated by new line character Type is the column ID Type Type_A 01... by vijay_k Engager in Splunk Search 05-03-2022 0 1	0	1
	How to mvfilter() the results of mvappend()? I have several fields I want to lump into 1 multivalue field and remove blanks. At the start of an event, there are u... by woodams Explorer in Splunk Search 05-03-2022 0 1	0	1
	How to reference same field name from 2 different indexes when correlating ? Hi All,I need to correlate data from 2 different Indexes wherein the field name is common. Index=idx1 ( This index ... by neerajs_81 Builder in Splunk Search 05-02-2022 0 7	0	7
	How to dynamically subtract two last column values? Hi, have SPL that generates months of data. I want subtract just the last two columns. The fields will change month ... by chrisboy68 Contributor in Splunk Search 05-02-2022 0 2	0	2
	How to change the order of display of column in stats which is grouped by "count by"? Hi all, My query has, .... \| stats latest(time) as recent_event,latest(key) as recent_key, count by field1,field2 and... by manimuthu Loves-to-Learn Everything in Splunk Search 05-02-2022 0 5	0	5
	Group events happened at the exact same time and search in the results Hello Everyone,I'm trying to analyze data from a jboss server, http request and respons dumps. An "event" in the Jbo... by miberecz Loves-to-Learn in Splunk Search 05-02-2022 0 2	0	2
	New to splunk, need help finding search. Can not find main app search by gilbert3 Engager in Splunk Search 05-02-2022 0 4	0	4
	With 10 blocks of lines, what is the Splunk command to get only 3 line where line starts from keyword ERROR? Block: 2022-02-14 02:30:00,046 [Worker-3] DEBUG User job started2022-02-14 02:30:00,063 [Worker-3] DEBUG Calling impo... by anitha123gnana Loves-to-Learn Lots in Splunk Search 05-02-2022 0 12	0	12
	I have a problem completing training Hi this is what appears to me when I try to complete the training:Denied PersonDue to U.S. export compliance requirem... by AHAD_ABDULLAH Observer in Splunk Search 05-02-2022 0 2	0	2
	How to compare the values with the time and host? Team,I am having a query which would result as below. _timeHostNameversion3/2/2022 15:22:04 PM3car2483/1/2022 15:21... by Anud Path Finder in Splunk Search 05-01-2022 0 6	0	6
	Could someone help on transpose command? hello I transpose events like this \| eval time=strftime(_time,"%H:%M") \| sort time \| fields - _time _span _orig... by jip31 Motivator in Splunk Search 05-01-2022 0 12	0	12
	Why the field is shown by extraction of another field but not found by search? Hi, as I create an extraction field with regex, the field match is shown correct. I can check the regex on https://re... by alval New Member in Splunk Search 05-01-2022 0 1	0	1
	How to match a sequence of events in Splunk? Hello,My SPL expertise are limited. I'm trying to write a search which matches a sequence of events.I'm working with ... by BlueTeam77 New Member in Splunk Search 05-01-2022 0 1	0	1
	How can I find values present in one table but not in other without subsearch? I have to prepare reporting dashboards in Splunk for which I used this query until now: field1=GTIN_RECEIVED field2... by bhavyajain Engager in Splunk Search 04-30-2022 0 2	0	2
	How to add + or - before a percentage? hello I use the search below in order to calculate a percentage But I need to add + if s > s2 and - if s2 < s How to ... by jip31 Motivator in Splunk Search 04-30-2022 0 4	0	4
	How can I rename items with SPL query? Hello Splunkers, How can i rename all the OrderNumber1, OrderNumber2, OrderNumber3 as OrderNumber. And Country1, Coun... by uagraw01 Motivator in Splunk Search 04-30-2022 0 6	0	6
	Is it possible to round the current time in a quarter of hour ( quarter superior)? Hi Is it possible to round the current time in a quarter of hour ( quarter superior) For exemple if its 9h56 i would ... by jip31 Motivator in Splunk Search 04-30-2022 0 9	0	9
	How to filter search result using a multi field lookup table? So, I am trying to use a lookup table spammer.cvs to filter out results from my search but can't get the filtering lo... by edhealea Path Finder in Splunk Search 04-29-2022 0 4	0	4
	How to create a chart of the error rate over time? Hi, I would like to create a chart of the error rate over time. I have data that shows status= DOWNLOAD_COMPLETE an... by tmtcollins Explorer in Splunk Search 04-29-2022 0 2	0	2
	Could someone aid with this Regex Regex for From: FA.south dam.australia-mb.ccjbhneed to get only: ccjbh by shreyasamin64 Explorer in Splunk Search 04-29-2022 0 4	0	4
	Is there a way to search for a comma in Splunk query? is there away we can search for a , to find multi locale or multi country basically instead of the underlined index=... by siksaw33 Path Finder in Splunk Search 04-29-2022 0 2	0	2
	How to get subset of lines from log Hi,We have requirement where we have to get the start till end log of one process and when we get the log we can see ... by Splunklearning2 New Member in Splunk Search 04-29-2022 0 5	0	5
	How to extract events from logs Hi All, I have number of events with error srtring in event.I need to fetch al the events with error string except... by vineela Path Finder in Splunk Search 04-29-2022 0 1	0	1
	Correlate events from different indexes with different field names & values Hi, how can i correlate events from different indexes when both( field names and values) are different ?For example:... by neerajs_81 Builder in Splunk Search 04-29-2022 0 11	0	11
	Why is my Splunk query not working for certain time range? i have a query to pull out stats and counts based on incoming applictiond and request path it gave me stats when i t... by ram_splunk New Member in Splunk Search 04-28-2022 0 1	0	1