Splunk Search

Community Activity

	how to add calculated fields into a chart I am trying to add 2 new fields into a chart, which is calculated by the exisiting columns in the following chart. Ba... by chongdong Explorer in Splunk Search 01-23-2022 0 6	0	6
	Splunk alert base on return code My file contains a line at the last where it mentions the return code. The format look like below mentioned. If the j... by LolabhattuA Loves-to-Learn in Splunk Search 01-23-2022 0 4	0	4
	How to combine two searches into one table?? Hello,everyone!At first, sorry for my bad English.I have a problem to join two result.The raw data is a reg file, lik... by feelcool Explorer in Splunk Search 01-22-2022 0 7	0	7
	How do you use a calculated "_time" field for a timechart query I have a Splunk query that does a lot of computation and eventually returns only two calculated fields: _time and ST... by jbrenner Path Finder in Splunk Search 01-22-2022 0 3	0	3
	result in single row Hi Guys I have a query like this <query>\| stats avg(CurrentConnections) as CC by host And the output is as below wit... by roopeshetty Path Finder in Splunk Search 01-22-2022 0 3	0	3
	fields.conf TOKENIZER breaks my event completely I'm trying to get a new sourcetype (NetApp user-level audit logs, exported as XML) to work, and I think my fields.con... by dsmith Path Finder in Splunk Search 01-22-2022 0 12	0	12
	display all values of JSON field in a table if you don't know the structure of the json I have a JSON with a field containing another object, but this object varies depending on type. For example, you may ... by dasaed Explorer in Splunk Search 01-22-2022 0 3	0	3
	Which timestamp is used when piping a transaction result into timechart command I have a transaction command which correlates two log entries. If I pipe this result into a timechart command, which ... by jbrenner Path Finder in Splunk Search 01-21-2022 0 2	0	2
	Eval If Multiple Date Values Match or Do Not Match Hello,I have a script gathering the last updated timestamp of three different files and I'm ingesting that data into ... by Razziq Explorer in Splunk Search 01-21-2022 0 1	0	1
	[Version 8.2.4] No longer able to use timestamps from return command in subsearch Hi,In the past (Splunk Enterprise v 7.x.x) I used the below search to run a report every few min. There were so many ... by steen Explorer in Splunk Search 01-21-2022 0 5	0	5
	case match command I am trying to use the case match command with more than one option. I keep getting an error message regarding the pa... by parkertctr Path Finder in Splunk Search 01-21-2022 0 2	0	2
	Create a table with different fields depending if their values match a condition I have a raw where each event looks like this (simplified for this exampel):{"time": "2022-01-20 16:40:02.325216", "n... by andres Loves-to-Learn Lots in Splunk Search 01-21-2022 0 2	0	2
	Hi Experts, I would like to count the multifield in the table where it has similar values I would like to count the multifield in the table where it has similar values. For Ex: I need output like below for ... by Ashwini_5 Explorer in Splunk Search 01-21-2022 0 2	0	2
	Date and time conversion Hi, in my index I have a couple time fields that are returned via a simple search_time = 1/20/2022 1:38:55.000 PM (th... by nate_washburn Engager in Splunk Search 01-21-2022 0 2	0	2
	How should we handle DB audit trails? We would like to ingest the Oracle's UNIFIED_AUDIT_TRAIL table and the SQL server's MSSQL\SQLAudit\*.sqlaudit files.H... by danielbb Motivator in Splunk Search 01-21-2022 0 2	0	2
	Extract and cleanse data into field for table Hi,In the following log entries, I wanted to extract uri in a specific format:log: a_level="INFO", a_time="null", a_t... by nbhat Explorer in Splunk Search 01-21-2022 0 1	0	1
	Date field comparison I need help regarding comparise a ISO 8601 date field with a specific date.Below is a simple example:index=devices \| ... by alexandrebas Explorer in Splunk Search 01-21-2022 0 1	0	1
	How to show data from TWO different sourcetypes ? I have,sourcetype_A (fields : ID, age, city, state)sourcetype_B (fields : ID, job, salary, gender)The fields "ID" i... by zacksoft_wf Contributor in Splunk Search 01-21-2022 0 2	0	2
	Extract raw data for URL into field Hi,In the following log, I wanted to extract Url, Method, ResponseTimeMs, StatusCode as a table:log: a_level="INFO", ... by nbhat Explorer in Splunk Search 01-21-2022 0 2	0	2
	Splunk Join is Left the same as outer in Splunk? Is Type=Left the same as type=outer in Splunk? If so why do they list it as three options?https://docs.splunk.com/Doc... by robertlynch2020 Influencer in Splunk Search 01-20-2022 0 2	0	2
	Is it possible to query IIS logs for a monthly web application hit count for multiple web applications on a domain? Hello,I was wondering if it is possible to use Splunk to query IIS logs for a monthly application hit count for multi... by jasonmhamilton New Member in Splunk Search 01-20-2022 0 3	0	3
	Count and chart two different queries Hey all,Newbie here learning Splunk. I'm starting to get into dashboards and want to create either a pie chart or jus... by zebulajams Explorer in Splunk Search 01-20-2022 0 5	0	5
	Did my search work or not? I've been trying to resolve this since October and not getting traction. Turning to the community for help:I have se... by awmorris Path Finder in Splunk Search 01-20-2022 0 0	0	0
	json Field value extraction I would like to get the list of those items in the properties field, like appName, levelId, etc. by EvansB Path Finder in Splunk Search 01-20-2022 0 4	0	4
	action field is not returning any results from all indexes Hello,Looks like the action field is not returning results for almost all of the indexes. This is only impacting one ... by majid87 Engager in Splunk Search 01-20-2022 0 4	0	4