Splunk Search

Community Activity

How to get Success, In Progress and Failure Count from this data I have this kind of data, Event IDEvent StepStatus 1001SUCCESS 1002SUCCESS 1003FAILURE 1004FAILURE 1005SUCCESS 1006FA... by agar1122 New Member in Splunk Search 08-28-2020 0 1	0	1
Chart My boss has asked me to create a chart that shows the number of fired alerts (y-axis) by day of the month (x-axis). I... by mvasquez21 Path Finder in Splunk Search 08-28-2020 0 6	0	6
create stacked chart showing # alerts over time My boss has asked me to create a chart that shows the number of fired alerts (y-axis) by day of the month (x-axis). I... by mvasquez21 Path Finder in Splunk Search 08-28-2020 0 3	0	3
Extracting multiple values from single unstructured event Hi,In a single event, we have a field named username which is occurring multiple time in the events in raw data and u... by dkgs Communicator in Splunk Search 08-28-2020 0 3	0	3
How to group search results? Hi all,I searching web server's centralized logs and getting results from multiple servers. But those servers belongs... by Petri-X Explorer in Splunk Search 08-28-2020 0 4	0	4
search time an hour plus Hello when i make a search i got an hour plus by adcom26 Explorer in Splunk Search 08-28-2020 0 6	0	6
How to round a number to hundreds or thousands? HI, I want to create tables that are easier to read and round the numbers to hundreds or thousands. Like 22113 -> 221... by HeinzWaescher Motivator in Splunk Search 08-28-2020 0 6	0	6
How to exclude writing existing result to Splunk lookup table. I want to keep updating new records to Splunk lookup table and not writing records again for existing users, even if ... by Vicky84 Explorer in Splunk Search 08-28-2020 0 6	0	6
Assistance with Lookup / Search Query I am trying to run a query where it compares a search result field against a field in the lookup table. I was able to... by CyberCyberSec Loves-to-Learn in Splunk Search 08-27-2020 0 4	0	4
Running scheduled searches in other timezones Hi all,My team is embarking on the Summary Indexing journey as our environment is getting larger. We have various ten... by kaeleyt Path Finder in Splunk Search 08-27-2020 0 1	0	1
Accumulate values for a multi value field by key Hi,Let's say I can get this table using some Splunk query.idstages1key1,100key2,200key3,300 2key1,50key2,150key3,2503... by unbelievable_ma Explorer in Splunk Search 08-27-2020 0 4	0	4
Use rex to extract a field "https://api.internal.t-mobile.com/customer-credit/v3/pre-screen-credit-offer/personal": Read timed out; nested excep... by irvindominguezs Explorer in Splunk Search 08-27-2020 0 1	0	1
Users loging into workstations with local admin or domain admin privs First off, I am very new to Splunk and that may be my downfall. Our latest Splunk guru has left and this fell to me r... by ldefoor New Member in Splunk Search 08-27-2020 0 5	0	5
metadata command returns duplicate sourcetypes - "WinEventLog" HelloI have this command:\| metadata type=sourcetypes index=wineventlogThe problem is that there are returned multiple... by net1993 Path Finder in Splunk Search 08-27-2020 0 2	0	2
Windows Server - High CPU for process - Splunk Cloud Hello,We need to find the highest CPU consumed Process in the windows machine, not the total highest cpu.Please help ... by dkgs Communicator in Splunk Search 08-27-2020 0 4	0	4
How to add an additional dummy row to a table? I have a search that outputs a table with two columns, one for log source one for total count (using stats count). I'... by tromero3 Path Finder in Splunk Search 08-27-2020 0 2	0	2
Reading error while waiting for peer XXX. Search results might be incomplete! [...] Hi everybody,I've attached an error that occurs recently on the splunk infrastructure based on a SHC of 3 members and... by lauraG85 Engager in Splunk Search 08-27-2020 0 1	0	1
how do I chart with 3 or more fields HiWe have multiple automated tests running with different IDs and jenkins build number. One testid, build can have mu... by uptoNoGood Explorer in Splunk Search 08-27-2020 0 0	0	0
If Statment or Nested If This statement works: \| eval Reason = if (Failure_Code = "0x12", "Account disabled, expired, locked out, logon hours... by hartfoml Motivator in Splunk Search 08-27-2020 4 14	4	14
stats values(*) missing columns / truncated columns (fie I'm trying to get list of all fields in a index and oddly enough there's missing fields through the two methods below... by aa70627 Communicator in Splunk Search 08-27-2020 0 2	0	2
How to add the splunk search results to an existing lookup table? Hello,I would need to add the splunk search results to an existing lookup table. Example.I have a splunk lookup tabl... by gowtham08091 Explorer in Splunk Search 08-27-2020 0 2	0	2
Sort not working when change the time format Hi all, got the problem with sort,When I change the time format from default e.g. 2020-05-08 19:46:20 to this :08/05/... by Pajkow Engager in Splunk Search 08-27-2020 0 1	0	1
Showing table despite no result Hi, I have base search which has appname field which lists all apps I have on splunk instance. I would like to output... by k31453 Explorer in Splunk Search 08-27-2020 0 3	0	3
Consolidating results on to one line Hi,The search I have returns two events.One event has the following field:patches{}.name - This is patches that are t... by FraserC1 Path Finder in Splunk Search 08-27-2020 0 2	0	2
How to convert this SQL query to splunk search 8/24 updateI'm sorry, I didn't describe the problem well.I re-corrected the description.I need to find "parent" in t... by foxychen Engager in Splunk Search 08-27-2020 0 7	0	7