Splunk Search

Community Activity

time difference between two events HiI am using below query to get the details of alarms which has (one Warning and one OK status) or (one Critical and ... by surekhasplunk Communicator in Splunk Search 08-19-2020 0 8	0	8
Add several information on a point Hi everyone, I'm looking for how to add information on a graphical point. My graph shows only an average and an ofnum... by Lucie99 Explorer in Splunk Search 08-19-2020 0 2	0	2
data joins I've got a few different tables, all csv, that provide different information.The main events table includes a bunch o... by friskyapple Explorer in Splunk Search 08-19-2020 0 1	0	1
How to use data models in subsearch I am trying to use data models in my subsearch but it seems it returns 0 results.\| datamodel disk_forecast C_drive se... by eidil Explorer in Splunk Search 08-18-2020 0 4	0	4
"This search uses deprecated 'stats' command syntax." Getting this informational message when running "stats count" commands:This search uses deprecated 'stats' command sy... by mitag Contributor in Splunk Search 08-18-2020 0 12	0	12
How to extract count of specific event from nested JSON? I have this data coming in every minute to monitor application performance: { "events": [ { "appId": "mock-app... by chtmai Explorer in Splunk Search 08-18-2020 0 5	0	5
Unable to see data indexed 4 hours ago Hi,Data was indexed 4 hours ago. At the time i was able to see the data when searching the relevant index. 4 hours la... by PN3000 Loves-to-Learn in Splunk Search 08-18-2020 0 2	0	2
deprecated 'stats' command syntax notification on a sample Splunk search Running a sample search suggested by "Add sparklines to search results" in Splunk Documentation for the latest versio... by mitag Contributor in Splunk Search 08-18-2020 0 1	0	1
Did anyonen else lose all of their "Splunk Answers" history? I am aware that answers.splunk.com has changed engines and is now community.splunk.com. The migration announcement st... by bloizides Observer in Splunk Search 08-18-2020 0 4	0	4
Is there a dashboard visualization that allows editing a lookup table in the UI instead of using lookup editor? Is anyone aware of a dashboard visualization that will allow me to edit a lookup table in the UI? Rather than using L... by daniel_althoff8 Loves-to-Learn in Splunk Search 08-18-2020 0 0	0	0
License Usage by Each Indexer License Usage by Each Indexer : Need to find license usage by each indexer. by vishaltaneja070 Motivator in Splunk Search 08-18-2020 0 2	0	2
How to pivot results table? I got above result from my splunk query: index="cx_aws" source="notifications-service"\|stats count by tokenValidator... by vinod0313 Explorer in Splunk Search 08-18-2020 0 1	0	1
How do I modify the span for timechart to match a chart I'm defining with a time range of "last 7 days"? Hello! I've been playing around with the timechart command and spanning, however, there is an issue I'm having when ... by goodsellt Contributor in Splunk Search 08-18-2020 2 17	2	17
Arithmetic operation on fields from different events Consider the below types of eventsfields : OS transaction numbersEvents: Win purchased ... by sstanlee Explorer in Splunk Search 08-18-2020 0 6	0	6
Populating non-existent values where multiple timestamp comparisons exist. We have the following SPL query which generates statuses (i.e. "Success", "Failure", "Warn") for various different "s... by adnankhan5133 Communicator in Splunk Search 08-18-2020 0 6	0	6
Key value field extraction from Cisco devices Hi there,digging deeper into the REST API and XML parsing. When running an XML status command on our Ironport I get t... by marcluescher Explorer in Splunk Search 08-18-2020 0 1	0	1
Checking when a field value has changed Hi team, I have a highly simplified set of log entries similar to the sample data below: \|makeresults \|eval dummy="... by rleyba828 Explorer in Splunk Search 08-18-2020 0 4	0	4
xyseries drops result with duplicate timestamp I have this data_timeEventCodeMessage2020-06-16T19:48:53+00:004136Too late now2020-06-16T19:49:53+00:001234I don't kn... by lstewart_splunk Splunk Employee in Splunk Search 08-18-2020 0 3	0	3
If / Then Conditional. Heres what i'm trying to accomplish: requestID status123456 errored321654 ... by codichulo Loves-to-Learn in Splunk Search 08-18-2020 0 3	0	3
What exactly does dedup_splitvals do? Hi,I can't grasp the concept of dedup_splitvals. I was writing search for a pie chart on my dashboard, something like... by vrulev_algn Loves-to-Learn in Splunk Search 08-18-2020 0 0	0	0
How to reformat search results? Helloi got result like below from the splunk queryABC123DEF456GHI789But i want to show like belowABCDEFGHI by vinod0313 Explorer in Splunk Search 08-18-2020 0 3	0	3
Add certain feilds to an existing query to filter the count Below is my existing query :i want to add ceratin common feilds with different value for the respective indexes .How ... by bapun18 Communicator in Splunk Search 08-18-2020 0 2	0	2
Splunk HelloI have a log like this:ABC=true,DEF=false,GHI=false,JKL=trueI want to show only ABC and JKL in the result,becaus... by vinod0313 Explorer in Splunk Search 08-18-2020 0 3	0	3
Multivalued field extraction This is the search i am using to extract key/value from the field "RID" with multivalued "DEF"\| rex max_match=0 fiel... by Abhi89 New Member in Splunk Search 08-18-2020 0 2	0	2
Using blacklist on Windows TA and XML events Hi, ive successfully blacklisted the windows event 4658 with this line_blacklist2 = $XmlRegex="<EventID>4658<\/EventI... by dieguiariel Path Finder in Splunk Search 08-18-2020 0 3	0	3