Splunk Search

Discussions

Thread Info

Splunk query working fine in search but not working in dashboard which has single display

I have the below query which works fine in the 'Search' but when I take the same query to a dashboard which has panel...

by Engager in

help on rex command

hello My field sounds like this 03/01/2019 07:10 0 MBAM CLIENT (2.5_64b) EN.$w$ And I need t...

by Motivator in

help on join command which truncate events

Hello The join comamnd below truncate events because I have results if I execute the ode before the join command bu...

by Motivator in

Compare two different values from two different periods

I saw a few examples https://community.splunk.com/t5/Splunk-Search/How-do-I-compare-search-results-from-two-differe...

by Path Finder in

Sort Column Value in Table from Rex Field

Hi, I'm trying to sort a value on a table from a rex field in Splunk Search. For instance, I have below value: D...

by New Member in

Post-tstats manipulation

I'm working to transition a traditional search to utilize accelerated datamodels my environment has available. My ori...

by Explorer in

Splunk script to update VA report weekly using lookup file

I am running a search job to view Vulnerability results/data. The search runs every week Saturday evening. I want...

by Engager in

Use the value of my first search in my second search (append)

Hello, With Appendcols I now have both values in one line. However, I would like to compare the values with eac...

by Path Finder in

How do I get a complete list of users logging into Splunk Enterprise & ES

How do I get a complete list of users logging into Splunk Enterprise & ES. Please share SPL strings used. How to prep...

by Builder in

Time taken for a lookup vs Time taken for a KVstore

Hi, I have a lookup file which takes some time to load (Look up has 19Lakhs data) - This lookup is used in a dashbo...

by Builder in

resolving username from uid in a splunk query

Greetings- I'm putting together a dashboard query that shows uid's and systems as a result. I would like to resolve...

by Engager in

trigger an alert if a process is taking more than the expected time

Hi Splunkers, I have the below logs and trying to create an alert if a process run is taking more than the expected...

by Path Finder in

Search for more than 1 url hit on a src_ip

Hi I have this search here where I want to limit the results to only events that have more than 1 url hit on an src_i...

by Path Finder in

pass time filters from lookup to saved search or macro or search

Hi team, I am trying to send earliest and latest time values from lookup to saved search but i am not able to get r...

by Path Finder in

How to create a new lookup from my local machine to clustered environment using curl command?

i have to upload the .csv file that gets generated on my local machine through a script to SH clustered environment u...

by Path Finder in

Append color values to field value

I have a query result . i want to append the three colors based on values and the table is dynamic based on the tim...

by Path Finder in

Join two events and publish the fields

Hi Everyone, I have two events like below on the same index though. I captured all fields through rex command but ...

by Explorer in

Consolidating data from different indexes into one table

I have 4 applications integrated with each other - their names let's say A, B, C, D respectively. All these applicat...

by Explorer in

Statistics data in GB, MB values

Hi Ninjas, I'm trying to make a table that should list date, domains, action_types, action_type_usage_in_MB, Domain_u...

by Engager in

Difference between outputs of same query as search and subsearch

Noob here. Can anyone tell me why the following search: search sourcetype=srt | table serialNumber will give me ...

by Engager in

Creating a correlation search between two different indexes (DHCP and Firewall Data)

Hi all- we want to get a bit more elegant with correlation searching between two different indexes. There seems to b...

by Path Finder in

Subtracting from multiple columns

Hi all, I have a table like this _timefile1.txtfile2.txtfile3.txt*.txt1472160022147216002214721600001472160099...14...

by Explorer in

Read a lookup and for each field send a email.

Hello everyone, I have a situation, I would like to read a lookup and for each field that match with a search crit...

by Path Finder in

how to track if a transaction is taking more time with non real time alert

Hi Splunkers, we have a transaction which runs for every 4hours and usually take 5mins to complete.Im trying to set...

by Path Finder in

Populating a new field with data based on existing field value

I have a field with similar values:myFieldJCH CornJCH CarrotJCH AppleME/OrangeI would like to populate a new field de...

by Communicator in

Get Updates on the Splunk Community!

Splunk Search

Discussions

Splunk query working fine in search but not working in dashboard which has single display

help on rex command

help on join command which truncate events

Compare two different values from two different periods

Sort Column Value in Table from Rex Field

Post-tstats manipulation

Splunk script to update VA report weekly using lookup file

Use the value of my first search in my second search (append)

How do I get a complete list of users logging into Splunk Enterprise & ES

Time taken for a lookup vs Time taken for a KVstore

resolving username from uid in a splunk query

trigger an alert if a process is taking more than the expected time

Search for more than 1 url hit on a src_ip

pass time filters from lookup to saved search or macro or search

How to create a new lookup from my local machine to clustered environment using curl command?

Append color values to field value

Join two events and publish the fields

Consolidating data from different indexes into one table

Statistics data in GB, MB values

Difference between outputs of same query as search and subsearch

Creating a correlation search between two different indexes (DHCP and Firewall Data)

Subtracting from multiple columns

Read a lookup and for each field send a email.

how to track if a transaction is taking more time with non real time alert

Populating a new field with data based on existing field value

Splunk Smartness with Brandon Sternfield | Episode 3

Monitoring Postgres with OpenTelemetry

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

Notepad++ SPL syntax highlighting

Is there a way to add 3rd party python modules to ...

How to splunk api to get statistics in python

Some cloudwatch log collection errors

Is it possible to export entire dashboard panel co...