Splunk Search

Community Activity

How to make presets as default in Splunk Cloud Default Time Picker? In Splunk Cloud, when I go to change the time picker it brings up relative options. It used to bring up presets. Ho... by sbgoldberg13 Explorer in Splunk Search 03-03-2022 0 1	0	1
How to sort this multi-value fields based on the latest timestamp and status? Hi Splunkers, I need help on how to sort this multi-value fields based on the latest timestamp and status. Here's my ... by kelz Explorer in Splunk Search 03-03-2022 0 2	0	2
PROPS Configuration with CSV Header- Requesting feedback and if there is a way to change field name Hello, I have CSV (with epoch time) source files (file with a few sample events given below) with header info. I wrot... by SplunkDash Motivator in Splunk Search 03-03-2022 0 1	0	1
Why is aggregating by custom Salesforce fields not working? I'm not sure if I'm missing something simple or not, but I've got event logs from my Salesforce instance fed in, as w... by arist0telis Explorer in Splunk Search 03-03-2022 0 0	0	0
How to count and compare the max amount of used different devices each day by groups for a week? Hello,I try to count and compare the max amount of used different devices each day by groups for a week with the maxi... by lemontree1 Explorer in Splunk Search 03-03-2022 0 4	0	4
Removing certain results from reports I'm attempting to extract statistics of user logins from a custom log format and create a bar chart. I have users A, ... by Sheela Path Finder in Splunk Search 03-03-2022 2 7	2	7
How to use Subsearch to achieve this ? I have 2 Splunk SPLs=====================index=computer_admin source=admin_priv sourcetype=prive:db account_name=admi... by zacksoft_wf Contributor in Splunk Search 03-03-2022 0 5	0	5
Help with temp tables and variables New to splunk and been struggling manipulating search results into a final result that I am looking for. In powershel... by AK89 Explorer in Splunk Search 03-03-2022 0 3	0	3
SPL: How to calculate the average user events per unique user, per day over a 14 day period (exclude weekends)? All, I need some help on a problem I am trying to solve. Problem: I need to calculate the average user events per uni... by mjuestel2 Path Finder in Splunk Search 03-03-2022 0 3	0	3
Compare results from two separat search results I have two separate searches that provides me the same data field in two different fieldds. I want to identify the co... by Tika Explorer in Splunk Search 03-03-2022 0 1	0	1
How to find number of events, size (in GB), and frequencies of ingestion? Hello, are there any queries we can use to find the Total Number of Events, Total Size/Volume (in GB) of Data, Freque... by SplunkDash Motivator in Splunk Search 03-02-2022 0 9	0	9
How to add hyperlinks for column values in table? If col A contains a b c d e f, I want a separate link to be opened for each value. E.g If the user click on "a", it ... by srinivasiyer New Member in Splunk Search 03-02-2022 0 2	0	2
Conditional regex help: How to capture two groups if they have an "exclusion type"? hi everyone, i'm trying to parse json inline. i'm using kv mode= json already but i'm trying to achieve selective gr... by sdee1013 Loves-to-Learn in Splunk Search 03-02-2022 0 5	0	5
How to capture in chart? Hello I have a table FcwfCW76_0-1646241245201.png I want this FcwfCW76_1-1646241459438.png I am not sure which tool (... by FcwfCW76 Explorer in Splunk Search 03-02-2022 0 2	0	2
Why is my alert report only showing the first result of every row? I have this table and I'm trying to send it as a report/alert every morning to our teams chat group sphiwee_0-1646242... by sphiwee Contributor in Splunk Search 03-02-2022 0 0	0	0
help to change the chart label size HiI use this CSS code in order to enlarge the size of the data values in the bars chartNow I also need to enlarge the... by jip31 Motivator in Splunk Search 03-02-2022 0 4	0	4
How to get stats max count of a field by another field? Hi There, I am looking to produce an output where the field with maximum count is display based on another field. for... by bijodev1 Communicator in Splunk Search 03-02-2022 0 3	0	3
How to create a Splunk query to more easily narrow down the exact page where a device ID reset occurred? Here is the SPL: index=name reqHost="host" \| rex field=cookie "care_did=(?<care_did>[a-z0-9-]+)" \| rex field=cookie... by msmith58 Explorer in Splunk Search 03-02-2022 0 5	0	5
help to solve a different syntax field between a lookup and a main search hiI use a lookup with a field corresponding to a site name\| inputlookup site.csv \| search site=paris In this lookup... by jip31 Motivator in Splunk Search 03-02-2022 0 2	0	2
How to access a lookup created in one app in another? Hi All, Splunk Enterprise 8.2.4 Clustered I have an issue where I have an existing app with a lookup listing all devi... by mscomms Path Finder in Splunk Search 03-02-2022 0 12	0	12
Is there anyway to create a file with a list of IP's that i can use in the search field? is there anyway to create a file with a list of IP's that i can use in the search field? i am trying to search for IP... by tazzvon Engager in Splunk Search 03-02-2022 0 3	0	3
Why is my chart that is grouped by values not showing up in visualization? Hi Experts, my SPL query, ...\| eval elapse_range=case(TOTAL_ELAPSE>0 AND TOTAL_ELAPSE<4, "Green",TOTAL_ELAPSE>4 AND T... by saravana22 Explorer in Splunk Search 03-02-2022 0 3	0	3
How to display min and max in a timechart? hello I use this timechart index=tutu sourcetype=titi \| timechart span=15min dc(s) as "Uniq" Now i would like... by jip31 Motivator in Splunk Search 03-02-2022 0 10	0	10
Comparing fields of different events in the same log file Hello all,I'd like to compare events in the same log files, amusing the format of the events are the same. For exampl... by gaishi New Member in Splunk Search 03-02-2022 0 2	0	2
Tranpose the output result Hi There,I have got some results in after running the below commandmy search \| \| bucket _time span=1h\| stats count by... by bijodev1 Communicator in Splunk Search 03-02-2022 0 2	0	2