Splunk Search

Community Activity

How to make a loop in one event? My log is like this:TimeEvent3/23/22 11:00:00.000 AMApplication 'AAA' is runningApplication 'BBB' is stoppedDatabase ... by sabinayang Observer in Splunk Search 03-23-2022 0 1	0	1
How to retrieve after field extraction, if it's classified as 'no search is performed after field extraction'? Cannot be retrieved after field extraction- If field extraction is classified as ` no search is performed after field... by noott211 Path Finder in Splunk Search 03-23-2022 0 2	0	2
Is there a limit to the number of digits for a number field in a kvstore? I have a kvstore that I am writing results of a search to. I have a field in the kvstore called ASC_IDX, and this is ... by BernardEAI Communicator in Splunk Search 03-23-2022 0 1	0	1
How to create a table on windowed count of api response time? I have some api response logs separated by pipe. However there is already field extraction on api response time. the ... by anonym3421 Engager in Splunk Search 03-23-2022 0 1	0	1
Need help on appendcols _time issue hello When I run the search below, its gives me "4" in results at the _time span = 11h `index` earliest=@d+7h late... by jip31 Motivator in Splunk Search 03-23-2022 0 1	0	1
Why is splunk crashing on lookup command? We have simple csv lookup like: network,descr 192.168.0.0/24,network_name Lookup description in transforms.conf: [ne... by gots Path Finder in Splunk Search 03-23-2022 1 13	1	13
How do I check supplier creation date in Buying Inspector? Hello - How do I check supplier creation date in Buying Inspector. by Vinaymkaggal New Member in Splunk Search 03-23-2022 0 2	0	2
How to extract time from the below message? Hi Folks,Can someone help me on the below. I have the below message in the log and need to extract the time portion a... by peterfox1992 Explorer in Splunk Search 03-23-2022 0 5	0	5
How to create a search that will trigger an alert when the count is zero? I want to trigger an alert when the count is zero. please help me with the alert search? by sravankaripe Communicator in Splunk Search 03-23-2022 0 7	0	7
How do I show search value with timechart? Dear professionals,I have a search string like this index="hcg_oapi_prod" relatedPersons NOT (firstName OR middleName... by lamnguyentt1 Explorer in Splunk Search 03-23-2022 0 3	0	3
How to list with events time difference greater than 0.5 secs? How do I list those events within a set of events(say expand the below query) wherein say 2 consecutive's event time ... by msg4sunil Path Finder in Splunk Search 03-22-2022 0 2	0	2
How to create Splunk search for getting average of max per 10mins? Hi team I am trying to create a query in order to get average of all max values in a period of 10 mins for any select... by ayushig New Member in Splunk Search 03-22-2022 0 1	0	1
How can I filter results for type 2 only? Dear Professional, I have a Search string like below index="hcg_oapi_prod" relatedPersons\| regex "\"relatedPersons\":... by lamnguyentt1 Explorer in Splunk Search 03-22-2022 0 3	0	3
How to add a field that sums cash value by device_id? Currently my search query is: sourcetype="transactions" AND (additionalMessage.requestUrl="*/cashIn/initialize" OR ad... by Rapidz Explorer in Splunk Search 03-22-2022 0 1	0	1
How to create a table of availabilities of a given service for a set of hosts? I'm trying to create a table of availabilities (percent uptime) for a given service for a set of hosts. My desired o... by bsg273 Path Finder in Splunk Search 03-22-2022 0 5	0	5
How to compare CutoffTime with current time? I have created a lookup table with filename and cutofftime within which we have to receive the file. I have to compa... by pradeepkm Explorer in Splunk Search 03-22-2022 0 2	0	2
How to partially join two lookups? Hello, Looking for a way to partially join 2 inputlookups. Lookup 1: username, name jsmith, Johnjdoe, Joe Lookup 2:us... by olegr Engager in Splunk Search 03-22-2022 0 2	0	2
Why does my AND clause not work? hi I have 2 pb with my eval clause below 1) when I have a look to the events collected, they dont correspond to the... by jip31 Motivator in Splunk Search 03-22-2022 0 14	0	14
How to extract a field from an escaped string inside a nested JSON I'm looking for help in extracting "allowedSourceAddressPrefix" field/value from a JSON. This field is an escaped JSO... by z0r0 Engager in Splunk Search 03-22-2022 0 6	0	6
How to create a search for stats count eval? hi I need to use eval count in a search like this \| chart count(eval(web > 12)) But this count is right ... by jip31 Motivator in Splunk Search 03-22-2022 0 5	0	5
How to combine two timechart query that extract the difference ? Query 1: (index=iks) "Procces started" \| timechart count span=1d Query 2: (index=iks) "Procces finished" \| timechart... by Maickeen Engager in Splunk Search 03-22-2022 0 1	0	1
How to calculate difference between field values in two events? Hi, i have 2 events with 3 fields: timestamp , servername, cpu_usage: 22-Mar-2022 00:00:00, server1 ,18 23-Mar-2022, ... by vikas_sood Explorer in Splunk Search 03-22-2022 0 3	0	3
How to turn CSV into a graph? Hey hey, I'm trying to turn telemetry to a graph. I have a CSV containing: PID,runtime,invoked,usecs,5sec,1min,5min,t... by Lither1423 Observer in Splunk Search 03-22-2022 0 3	0	3
How to extract JSON with key name specified as a key? Hi all, I have a JSON payload that contains as 'custom_fields' section that is made up of a set of title:keyname and... by sddunne Explorer in Splunk Search 03-22-2022 0 4	0	4
Is there a better way to search than appendcols ? Hi Guys, I am looking search thru, splunk index for presence of multiple conditions as below. index = "ind_name" ... by chsuresh09 Explorer in Splunk Search 03-22-2022 0 11	0	11