Splunk Search

Community Activity

For Xml data join 2 tables with different fields Table A:<Type LineNo="589123363" > <Type> <OrderLine Line="6" PrimeNo="3" S="2"> Code="75602005" /> </OrderLine> <O... by Annna Explorer in Splunk Search 03-02-2021 0 15	0	15
Concurrent logons from different workstations I have a requirement to see which users have logged into multiple servers before logging out of the previous server. ... by pstephens93 Explorer in Splunk Search 03-02-2021 0 0	0	0
Extract a field from a search and remove trailing character I have 2 splunk indexes from which I need to gather data from, so I have a simple splunk search (that queries for dif... by thenormalone Path Finder in Splunk Search 03-02-2021 0 4	0	4
sort columns that with the highest Total to the left Hello, I have the following search: index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_... by damucka Builder in Splunk Search 03-02-2021 0 3	0	3
Create an Own column in my query Hello,I have a query (e.g. "....... " \| stats count, avg(...)) and after that I get as resultCount avg20 40Wha... by exchanger Path Finder in Splunk Search 03-02-2021 0 2	0	2
Split 2 fields into each rows Annna_0-1614493032347.pngHow to have split, i tired many ways but its coming out.Output:ABC28813695716687181228813754... by Annna Explorer in Splunk Search 03-02-2021 0 4	0	4
Help understanding appendpipe Hi,I didn't find anything about this while searching so here's my question.I'm working on the proving a negative prob... by chirsf Explorer in Splunk Search 03-02-2021 0 5	0	5
Can we check App permission via Splunk logs Here is the requirement:I wanted to create a form with list of Apps in my Search head Dropdown. If the Developer choo... by Naga Engager in Splunk Search 03-02-2021 0 2	0	2
Why does Splunk include null columns in data by default? This is something I've always wondered, and I can't understand the reasoning behind it or how to fix it. This is my ... by rbechtold Communicator in Splunk Search 03-02-2021 0 3	0	3
Display CPU Utilization per host per time using +Add Inputs from Edit Dashboard Hi,below is the timechart for my search to display CPU utilization of my forwarders and indexerScreenshot 2021-03-02 ... by hishamjan Explorer in Splunk Search 03-02-2021 0 1	0	1
Add field to timechart Hi,I got a timechart that shows the number of critical package losses per day. Additionally I calculate the average o... by schufi01 Path Finder in Splunk Search 03-02-2021 0 1	0	1
left join not working hi Splunk community, Somehow my left join is not working if I select all EntityIDs.zarrukh2010_2-1614011218252.png Al... by zarrukh2010 Observer in Splunk Search 03-02-2021 0 8	0	8
pie chart Hi,I got a splunk search that monitors, how many different hosts there were in the chosen timespan. \| stats dc(host) ... by schufi01 Path Finder in Splunk Search 03-02-2021 0 3	0	3
Splunk query to find locations in Missile Map I want missile map showing details from one to other location with title.Please help me. Below is my query.index=grap... by alexspunkshell Contributor in Splunk Search 03-02-2021 0 0	0	0
Converting the result from my search Hello, i think its not that difficult, but i dont know how to do it. The result is in milliseconds. Is there an easy ... by exchanger Path Finder in Splunk Search 03-02-2021 0 4	0	4
Set an alert for 3 hosts when their CPU Utilization exceeds 80% Hi,I have Splunk Add-on for Unix and Linux installed on my 3 hosts sending data to an Indexer. I have created a dashb... by hishamjan Explorer in Splunk Search 03-02-2021 0 9	0	9
How to show all message from certain log via rex? Hi dear Splunkers,i have log like this :2021-02-11 14:47:51.167 [Error] ** Dummy User with dummyNumb:1111 Plate:AAAAA... by ivana27 Path Finder in Splunk Search 03-02-2021 0 7	0	7
Average on a value over time Hi, I have this data.. Jul 31 23:17:54 83.231.181.65 Jul 31 23:17:54.861457 host1 INFO switch=switch0 [DATA] switch... by matthewparry Path Finder in Splunk Search 03-01-2021 1 14	1	14
How do I extract a long string with double quotes and back slashes? Example 1: time="2021-02-26T04:20:27Z" level=error msg="[xx] failed processing case" caseNumber=1234 error="Received ... by szheng6699 Engager in Splunk Search 03-01-2021 0 1	0	1
Displaying concurrent users over time Hello, i have data with VPN connectivity. Format is quite simple: 1378764018782;1378764018781;OK First is Start Ti... by Matthias_BY Communicator in Splunk Search 03-01-2021 0 9	0	9
chart by 2 fields Hi,is there a possibility to create a chart by these two fields? If possible I would like to create a heatmap out of ... by schufi01 Path Finder in Splunk Search 03-01-2021 0 1	0	1
Get instance name from source Hi all,I am completely new to Splunk so I apologize if this has been asked/answered. I did review the past discussion... by bcalder New Member in Splunk Search 03-01-2021 0 3	0	3
Split a field Hi,I have 4 different correlation ID's in same row, I want to split them and place it in single row1aaaaa-2bbbb-3cccc... by VijaySrrie Builder in Splunk Search 03-01-2021 0 1	0	1
Join/Subsearch - unsure which to use and why My dataset is in a rather strange format. For a given 'event', I have numerous splunk entries all linked by a 'sessio... by jb123213123 Loves-to-Learn in Splunk Search 03-01-2021 0 7	0	7
Help in setting up token based on User Value Hello,I am trying to display couple of Dashboard Panels only to a specific user. For that i am trying to get the user... by shivamagrawa Explorer in Splunk Search 03-01-2021 0 3	0	3