Splunk Search

Community Activity

Dedup and 'OR' problem Hi. I'm quite newbie in Splunk, but I'm trying to find solution to my problem. index=zt2 (first_search) OR (second_s... by Reijo86 New Member in Splunk Search 10-22-2020 0 1	0	1
Creating alert when any past hour count is x standard deviations from the average of the past 24 hours I have Splunk logs with data that is roughly like this:TimestampadapterNameresponseCodexxA1xxA2xxB1xxB2 For each com... by jojopup123 Explorer in Splunk Search 10-22-2020 0 2	0	2
Find the value of the last field and use that field as a filter to find matching records Hi,I am trying to build a result in tabular format.timestampprcs_nm outcomedatenormal time stampprcs_nmFail2020-10-19... by darth_mango_97 Explorer in Splunk Search 10-22-2020 0 8	0	8
"bin=2h time" doesn't split the bucket by every 2 hour. Hi team,with below query, I can't get expected result with the bins splitted by every 2 hour which I specified by "\| ... by cheriemilk Path Finder in Splunk Search 10-22-2020 0 3	0	3
Inputlookup - dropdown and multiselect behave weird I use an inputlookup to fill a multiselect/dropdown-input. \|inputlookup Errornumber 12 44 68 If i now use a multise... by light_of_sirius Explorer in Splunk Search 10-22-2020 0 0	0	0
valid sourcetype not in "data summary" When a valid sourcetype is not showing up in "Data Summary" under "sourcetypes", what does it mean, and how do I get ... by mitag Contributor in Splunk Search 10-21-2020 0 0	0	0
How to compare output of two splunk queries where nothing is common Hi EveryoneI have 2 queries 1) mysearchquery \| table xyz 2) mysearchquery\| table abcAnd these two queries does not h... by Emily12 Explorer in Splunk Search 10-21-2020 0 5	0	5
Extracting the values from addtotals/addcoltotals from timechart. Hi All,I would like to extract the values from addtotals.My current result from my search is as follows;_timefieldafi... by ronaldtanhj Path Finder in Splunk Search 10-21-2020 0 1	0	1
Cloud Provisioning Activity from Unusual Country - SPL search not working Hi Can anyone help me why the below search is not working. index=aws sourcetype=aws:cloudtrail eventName=Create* OR e... by jaibalaraman Path Finder in Splunk Search 10-21-2020 0 1	0	1
DBXQuery where not in index data Hi Splunkers,Need your help, i have DBXQuery like this :\| dbxquery connection="myconn" query="sdbxquery connection=mo... by rahmatn Path Finder in Splunk Search 10-21-2020 0 1	0	1
Splunk Subquery Basically, I have a problem in which I want to run two queries the first query will return me the total number of req... by haiderzada New Member in Splunk Search 10-21-2020 0 3	0	3
Smartstore, How long do data stay in local storage after being fetched from a remote storage? in Smartstore, How long do data stay in local storage after being fetched from a remote storage? by mufthmu Path Finder in Splunk Search 10-21-2020 0 1	0	1
Get conditional value from logs Hi Team,I have two conditions as below and I need to find out the operation="OVERRIDE" and other should be block1> [n... by sgulhane5 Explorer in Splunk Search 10-21-2020 0 9	0	9
Best approach for comparing multiple search results with same fields I'm trying to find an elegant solution to compare the results of multiple searches - all of which have identical fie... by turbocharger Explorer in Splunk Search 10-21-2020 1 4	1	4
Number of unique days a given IP address was used Hey All, This may be something very basic, but I can't seem to find exactly what I'm looking to do on the forums.For ... by LeBarcode Engager in Splunk Search 10-21-2020 0 2	0	2
How to use Foreach for multiple columns and multiple rows? Hello, I'm having trouble figuring out how to use foreach + eval getting the difference of the fields.I have somethin... by ChioNeng Explorer in Splunk Search 10-21-2020 0 2	0	2
Change height of bar/row in bar chart? How can I adjust the height of a bar in a bar chart? I've been unable to find examples of this. Thanks by sc0tt Builder in Splunk Search 10-21-2020 0 7	0	7
How to adjust chart column width? Hi, I have the below panel. What I'm looking to do is to make the columns in this graph "skinny" (5 pixels or less)... by dbcase Motivator in Splunk Search 10-21-2020 2 5	2	5
Convert earliest_time latest_time notation to epoch Hello there!Is there a known method (a function, a command, built-in or custom, a search trick) to convert the earlie... by D2SI Communicator in Splunk Search 10-21-2020 0 2	0	2
Trendline over longer historical period I'm generating a timechart, with a 5 period simple moving average. I'm only searching over a week, with the span set ... by BernardEAI Communicator in Splunk Search 10-21-2020 0 0	0	0
Error - In handler 'savedsearch': Expecting different token When I create an action or try to change the variables in any of alert actions for an alert, I end up with a message ... by dantembe Loves-to-Learn in Splunk Search 10-21-2020 0 2	0	2
To remove few details using rex Hi Team,I have three below conditions to create a logic according to it.Case 1: operation="OVERRIDE" should print but... by sgulhane5 Explorer in Splunk Search 10-21-2020 0 3	0	3
Count occurrence of message in table I have a message feild having below data message=Successfully created customer id XXXXmessage =Duplicate create cu... by Nilesh067 Explorer in Splunk Search 10-21-2020 0 1	0	1
Search Sourcetype by Port ingested Hi there,Does anyone have a search that can show me what data was forwarded and ingested by which port?We have multip... by mwdbhyat Builder in Splunk Search 10-21-2020 0 0	0	0
CPU utilization There are some liberty services and in some host we have many microservice , I want to monitor CPU / memory usage in ... by ARaman77 Explorer in Splunk Search 10-21-2020 1 2	1	2