Splunk Search

Community Activity

Datamodel stats search keeps failing Hi,I created a data model and the searches were working previously but now it keeps failing and I don't know why. Is ... by ebs Communicator in Splunk Search 05-11-2021 0 2	0	2
how to get the case function to have multiple status, when multiple fields are true The case function seems to finding the first true statement and displays that value. Is there another function or dif... by spicy Path Finder in Splunk Search 05-11-2021 0 2	0	2
Time-charting Several Series I have a set of data with X categories and each category is getting measured (measurements are positive or negative d... by gamecocks20 Loves-to-Learn in Splunk Search 05-11-2021 0 0	0	0
How to assign a field value to other events using streamstats Hello,I am trying to assign a value from one field to all earlier instances of a field until a non-null value is met.... by Traer001 Path Finder in Splunk Search 05-11-2021 0 2	0	2
User agent string using lookup table Hi Team I am trying to extract the OS details from the user agent using the below eval command, however I am not able... by jaibalaraman Path Finder in Splunk Search 05-11-2021 0 3	0	3
Why am I getting "Error in 'summarize' command: This search does not support summarization" trying to use KV store lookup with Datamodel Acceleration? Hi. I'd like to use KV Store lookup in an accelerated Data Model. When I set data model this messages occurs: 01-10... by pedromvieira Communicator in Splunk Search 05-11-2021 2 5	2	5
How to get duration for the product A (only for start and end status)? So what I have now from my search so farProduct Status TimeA Start 8.00 AMA ... by moinyuso96 Path Finder in Splunk Search 05-11-2021 0 2	0	2
regex help Hi,I need some help with the regex,Currently we have below two paths, note the naming format is different for the log... by SS1 Path Finder in Splunk Search 05-10-2021 0 4	0	4
Eval Expression in Data Model Hi,I'm trying to create an eval expression in my data model which is based on _time. Can you please advise on what I'... by ebs Communicator in Splunk Search 05-10-2021 0 3	0	3
How to check a table for multiple mac addresses with the same IP Currently my splunk search to get a list of macs of the security cameras with their respective IP is index = dhcp 00:... by jhick Observer in Splunk Search 05-10-2021 0 1	0	1
How to count how many time a key word appear in one event log and list it's detail Hello I have some event logs that show batch purchase like this: Event 1: <BankID>Bank A</BankID> <value>5</value> <s... by phamxuantung Communicator in Splunk Search 05-10-2021 0 1	0	1
Regex: Error using where/match and backslash character The following example \| makeresults \| eval FilePath="\\Temp.exe" \| where match(FilePath, "(?i)\\Temp\.exe$") Creates ... by abowesman Explorer in Splunk Search 05-10-2021 0 0	0	0
Field extraction regex breaks due to date change and space The date field sometimes has 2 spaces and sometimes 1 space, depending on whether the date is a single digit or doubl... by ershad_c Engager in Splunk Search 05-10-2021 0 2	0	2
How to split/extract substring before the first - from the right side of the string SpoilerHow to split/extract substring before the first - from the right side of the field on splunk searchHow to spli... by keshavgupta Engager in Splunk Search 05-10-2021 0 1	0	1
how to use horseshoe meter with stats how to use horseshoe meter for below queryindex = * \| table podname cluster status \| dedup podname cluster status \|... by kirrusk Communicator in Splunk Search 05-10-2021 0 1	0	1
Subsearch Hi,I've been trying for hours and nothing works, so I figure you might help me out.I have the following very long que... by yifatcy Path Finder in Splunk Search 05-10-2021 0 2	0	2
How to use metadata/header for all the following events Dear all,I'm trying to retrieve some log metadata and associate them to all my events.Exemple: When my application st... by Flobzh Explorer in Splunk Search 05-10-2021 0 1	0	1
account was created and deleted Hi,My query:index=ph_windows_sec sourcetype=XmlWinEventLog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR Event... by or1515 Loves-to-Learn Everything in Splunk Search 05-10-2021 0 2	0	2
Split trellis over two variables Hi,Can I separate Trellis visualization by two variables as keys? In other words, I would like a timechart for each c... by yifatcy Path Finder in Splunk Search 05-10-2021 0 0	0	0
Splunk searching Syntax Resolved by keyu921 Explorer in Splunk Search 05-10-2021 0 1	0	1
How to concatenate strings with unicode character? I want to concatenate strings with special characters like "\t" and Unicode char "\u0006"I tried \| makeresults \| ev... by junlozhang Explorer in Splunk Search 05-09-2021 0 2	0	2
How to split up a string into multiple fields? I have a field that consists of data separated from a json data field using this search.index="test-99" sourcetype="... by robayers Explorer in Splunk Search 05-09-2021 0 8	0	8
Group events into a single event I am relatively new to this wonderful tool called SPLUNK. Please excuse me if this question has already been answered... by schou87 Path Finder in Splunk Search 05-09-2021 0 4	0	4
I want to insert a value into a subsearch using the search result as a variable. Dear ALL,I want to insert a value into a subsearch using the search result as a variable.Do the following search to g... by Msugiyama Path Finder in Splunk Search 05-09-2021 0 2	0	2
superimposed timeline chart comparing the latest and last week data For the below query, searching for the values of 2nd occurence of earliest and latest events so that the timechart wo... by prajwal_94 Explorer in Splunk Search 05-09-2021 0 2	0	2