Splunk Search

Community Activity

spath vs xpath parse xml Hii have xml file like this, how can i table it with xpath or spath? <?xml version="1.0" encoding="UTF-8" standalone=... by indeed_2000 Motivator in Splunk Search 10-03-2021 0 6	0	6
How to replace field value by string if certain condition matched How do I replace a value for a field if the value is lesser than 0.02 by "Good"?ValueKeydate0.0211/1/20170.0211/2/201... by sndpgiri Engager in Splunk Search 10-03-2021 0 3	0	3
How to rename columns in a chart that cam from nested json? I have a nested json element that gives back up to 8 field names. I table them like: \| table "Config.DiskBrandSize.*"... by thisissplunk Builder in Splunk Search 10-02-2021 0 2	0	2
Detect server response time outliner HiI have field in my log that call ServerRespTime. I want to detect outliner of ServerRespTime.Here is the conditions... by indeed_2000 Motivator in Splunk Search 10-02-2021 0 0	0	0
rex extraction xsd tag Hi what is the rex for "No is invalid. Please ask to a admin"Here is the log:21:32:26.729 customer modules: type="xsd... by indeed_2000 Motivator in Splunk Search 10-02-2021 0 2	0	2
Table from two separate searches and sourcetypes So, to preface this, I am very new to Splunk. The end game is to make a chart overlay, but that's not my main questio... by Brainstorms Explorer in Splunk Search 10-02-2021 0 2	0	2
Transform data measured in hour interval to day with some conditions. I have data in the following format, measured in an interval of an hour.DateRestaurant idFood CodeAverage Order1/1/20... by sndpgiri Engager in Splunk Search 10-02-2021 0 9	0	9
stats unique value by latest time Hi,I have ticketing system values in my siem, where different support people working on the ticket. I am trying to cr... by neophyte Engager in Splunk Search 10-02-2021 0 2	0	2
Eliminate the refund failure transactions using backup processor HiIn my app there are 2 payment processor, netconnect(backup) and sourcejet(primary), where is netconnect is the back... by iqbalintouch Path Finder in Splunk Search 10-01-2021 0 5	0	5
SPL to identify UFs needed to increase pipeline sets Hi All,We are planning to configure some of our universal forwarders to use multiple pipeline sets. Do you have some ... by jaracan Communicator in Splunk Search 10-01-2021 0 1	0	1
Unable to rename _time as Time Hi, I'm trying to rename _time as Time so that it will display the timestamp in YYYY-MM-DD HH:MM:SS. But when I do r... by wuming79 Path Finder in Splunk Search 10-01-2021 0 8	0	8
Timechart - Same time range and span but different timeline Hello,i've put two timecharts on top of each other to compare their events by time. Both timecharts are using the sam... by n0cturne Loves-to-Learn in Splunk Search 10-01-2021 0 5	0	5
How to remove few IP's from a query that exists in lookup table ? Newbie here...!I have a list of IP's in a CSV from which I need to exclude few IP's (IP1, IP2, IP3, etc.,) from the r... by innoce Path Finder in Splunk Search 10-01-2021 0 1	0	1
Extracting a field in quotes with regex Hi, I'm having trouble with a regex field extraction. I'm looking to extract the numeric ID after the "x-client-id" k... by mkulicke Explorer in Splunk Search 10-01-2021 0 2	0	2
Search through only failing logs - Jenkins I am trying to speed up a search on Splunk. The search looks through millions of logs for matches to around 100 event... by ddaly Engager in Splunk Search 10-01-2021 0 2	0	2
Lookup csv missing in definitions Hi, Hopefully a quick one  I have a user that can upload lookup table files, but when a lookup definition is creat... by cdstealer Contributor in Splunk Search 10-01-2021 0 8	0	8
Combine results of two searches I have error messages in the following formats { "level":"error", "message":"Log: \"error in action {\\\"status\\\":... by alwinaugustin Engager in Splunk Search 10-01-2021 0 1	0	1
Using results from one search as a filter for another Hi,I'm trying to filter the results from one search based on the results from another search.Example:Consider the fol... by dmacl Explorer in Splunk Search 10-01-2021 0 6	0	6
Change hour interval to days and replace the value with average I have a column that has events recorded in an interval of 1 hour.Example:Date ... by sndpgiri Engager in Splunk Search 10-01-2021 0 3	0	3
Rename fields based on Token value Hi,I have some data which spans multiple systems example below:"system" "app" "fld1" "fld2" "fld3"sys1 appA ... by mcaulsc Path Finder in Splunk Search 10-01-2021 0 7	0	7
Multiple key value pairs in a timechart based on the counts of 2 fields Here's an example of some error logs that simply show which app reported an error and which country:_time(s)sourcetyp... by datatan Engager in Splunk Search 09-30-2021 0 1	0	1
how to show table pagination with start and end instead of << previous & Next >> Hi All.. I need help with table pagination by default splunk provides pagination option as << prev & next >> instead... by mvishal Explorer in Splunk Search 09-30-2021 1 2	1	2
Show a part of message for dasboard stats table I have the following query and I am using it in a dashboard to show the errors categorized. index=myindex sourcetype=... by alwinaugustin Engager in Splunk Search 09-30-2021 0 3	0	3
Change _Time to another field on a Single Query Hello,I need to find a way to use another field for _Time on a single query (I don't want to change props just for 1 ... by erog Engager in Splunk Search 09-30-2021 0 1	0	1
LINE_BREAKER Help Needed I need help breaking the following data into segments. The data is currently lumped together. I have been working wit... by babcolee Path Finder in Splunk Search 09-30-2021 0 2	0	2