Splunk Search

Community Activity

Comparing field with weekly average Hi,I am trying to compare a field (Job duration) with its weekly average. Something is wrong with my join. It is retu... by sk Explorer in Splunk Search 03-05-2021 0 4	0	4
How can i calculate the time difference with 1 key value and 1 col of data? Hi there Splunkers,Maybe the title is a little bit weird but the point is, We have an entity who travel between 2 loc... by Felipe_Barahona Engager in Splunk Search 03-05-2021 0 4	0	4
How do I extract a substring beginning by some characters and ending by : Hi,I have this in my message string:Errors in file /u02/app/oracle/diag/rdbms/pwein1a/pwein1a1/trace/pwein1a1_cjq0_28... by proussinbnc Engager in Splunk Search 03-05-2021 0 2	0	2
List indexes that are being used Hello, I am trying to bring up a search that will tell me how much each index is being used, but the search_index fie... by robnewman666 Path Finder in Splunk Search 03-05-2021 0 2	0	2
Need help in append Hello all, I am facing an issue in appending an query. Here my objective is to update the kv store with the list of s... by srinivasgowda Explorer in Splunk Search 03-05-2021 0 9	0	9
JSON formatting I have the below JSON feed that I can see from a straight search. I'm trying to get some stats especially for pools-a... by ThyAbode Loves-to-Learn in Splunk Search 03-05-2021 0 3	0	3
Index specific columns from CSV file. Hello Experts,The CSV file is located on file share and file is having columns Hostname, type, IP. From these three c... by email2vamsi Explorer in Splunk Search 03-05-2021 0 1	0	1
Error using lookup command I am running the below query,sourcetype="email" \| rename SenderAddress as indicator \|lookup tci indicator output type... by Janani_Krish Path Finder in Splunk Search 03-05-2021 0 8	0	8
Configure HTTP Event collector to log client source-IP Hi Team,I am looking to Configure HTTP Event collector to log client source-IP instead of the source host. Is there a... by rakeshkp Loves-to-Learn Everything in Splunk Search 03-04-2021 0 0	0	0
Field extraction for multiple types of values Hello all,I am trying to extract the data from the field evtComponent from the below event, and this has a multiple t... by srinivasgowda Explorer in Splunk Search 03-04-2021 0 2	0	2
Need output value Hi, Output of the below query has been attached, I need only the total value to be displayed in the dashboard. Here t... by VijaySrrie Builder in Splunk Search 03-04-2021 0 1	0	1
Comparision of hourly Log count by average log count of last 7 days. I have a Query need to compare hourly log count of today with the average value of last 7 days, if the count is great... by phanirohith97 Observer in Splunk Search 03-04-2021 0 4	0	4
join search with condition I have two searches:search-A gives values like typestatushostnameidportSizebasecachehttpOFFhost-117NANANANAhttpONhost... by arandy01 Explorer in Splunk Search 03-04-2021 0 4	0	4
Why isn't transaction working for me? I have a process where I load data into database tables. My log file has the following entries for each :TableLoad=... by VictorCrunch Loves-to-Learn in Splunk Search 03-04-2021 0 0	0	0
How to pull latest scan data with full EST date/time? Currently we are having issues with our scan data comming in to out indexer, so we have to use CSV's for scan data .... by UMDTERPS Communicator in Splunk Search 03-04-2021 0 7	0	7
Unique users by application over time periods in a timechart table As a example, I have a search that calculates "Unique Users per Application" and this can be constrained to a particu... by nickstone Path Finder in Splunk Search 03-04-2021 0 5	0	5
How to Add time in the Dashboard Hello,I have a query (e.g. "....... " \| stats count, avg(...)) and after that I get as resultOwnColumn Count AVGXYZ ... by exchanger Path Finder in Splunk Search 03-04-2021 0 1	0	1
How to write VPN DHCP pool stats by AnonymousPerson New Member in Splunk Search 03-04-2021 0 1	0	1
Using sub search result to add to main search Hi, I have a main search that look like this index=main RESPONSE_CODE="0" earliest =-4mon@mon latest=mon@mon \|stats c... by phamxuantung Communicator in Splunk Search 03-04-2021 0 6	0	6
how to excluse a result from a search hiin the search below I need to excluse the results when instance=_total index="perfmon-fr" \| fields %_User_Time hos... by jip31 Motivator in Splunk Search 03-04-2021 0 1	0	1
ML Users hitting Limits Our ML team use the API to export large numbers of events for model training.They are hitting limits: [searchresults]... by jonaclough Path Finder in Splunk Search 03-04-2021 0 0	0	0
How to convert tabular data to distinct count How to convert tabular data to distinct countHi,I have a splunk query\| stats count by operation (under field operatio... by VijaySrrie Builder in Splunk Search 03-04-2021 0 5	0	5
Nested stats and json keys grouping Hi ,I have a json structure like this : { "zip": 67452, "location": "NY", "author": { "book1": { "pr... by mkiran18 Loves-to-Learn in Splunk Search 03-04-2021 0 4	0	4
how to read comment line Hi ,I have data where i want to read comment line and store value in field.for example , I have log where first 4... by pragycho Loves-to-Learn in Splunk Search 03-04-2021 0 2	0	2
How to round stats average to 2 decimal places? Hello, I have this: stats count by opentime \| stats avg(count) and I want the average to be in 2dp. Anyone have an... by markthompson Builder in Splunk Search 03-03-2021 5 11	5	11