Splunk Search

Community Activity

Why are the queues full and searches in error on Search Head? Hello, We are having some issues finalizing the installation of our Splunk environment. We have 2 Linux servers: 1 Se... by performancemoni Path Finder in Splunk Search 08-19-2020 0 1	0	1
Combine a numerical field with a string field separated with a dash Hello,I am trying to combine couple of fields data separated by a dash. Tried few options but could not get the expec... by subhrangshu Explorer in Splunk Search 08-19-2020 0 2	0	2
Extracting a JSON boolean value I've been unable to get a boolean value extracted from JSON written to Splunk. The data looks like this: build: {<!-- --> ... by danl Explorer in Splunk Search 08-19-2020 0 5	0	5
Why do these seemingly identical searches return different results when sorted? I have four versions of a nearly identical search. The last one returns a completely different result. What is it a... by CarbonCriterium Path Finder in Splunk Search 08-19-2020 0 3	0	3
Filtering a Field Extracted with Rex Hello,I am having trouble with filtering fields extracted using rex as follows:rex max_match=0 field=sessions_as_clie... by user333 Engager in Splunk Search 08-19-2020 0 2	0	2
Separate rows for a string ? I have a string like this below{ABC,DEF,GHI,JKL}i am able to show it as below in my result 1. ABC DEF GHI JK... by vinod0313 Explorer in Splunk Search 08-19-2020 0 1	0	1
How to search indexed JSON array output for objects that match a distinct name/value pair I'm calling a REST API using curl on a UF to collect data from a remote DataPower appliance; the output is in JSON fo... by beetlegeuse Path Finder in Splunk Search 08-19-2020 0 2	0	2
Case open count and trend history We're using a REST API to connect to a case / monitoring system and retrieve any data newer than the last run. This d... by benhooper Communicator in Splunk Search 08-19-2020 0 5	0	5
Removing some results from stats count by function Hi all,I'm a bit of a newbie to splunk but I was trying to create a dashboard using the stats count by function for a... by DCUpro Explorer in Splunk Search 08-19-2020 0 2	0	2
time difference between two events HiI am using below query to get the details of alarms which has (one Warning and one OK status) or (one Critical and ... by surekhasplunk Communicator in Splunk Search 08-19-2020 0 8	0	8
Add several information on a point Hi everyone, I'm looking for how to add information on a graphical point. My graph shows only an average and an ofnum... by Lucie99 Explorer in Splunk Search 08-19-2020 0 2	0	2
data joins I've got a few different tables, all csv, that provide different information.The main events table includes a bunch o... by friskyapple Explorer in Splunk Search 08-19-2020 0 1	0	1
How to use data models in subsearch I am trying to use data models in my subsearch but it seems it returns 0 results.\| datamodel disk_forecast C_drive se... by eidil Explorer in Splunk Search 08-18-2020 0 4	0	4
"This search uses deprecated 'stats' command syntax." Getting this informational message when running "stats count" commands:This search uses deprecated 'stats' command sy... by mitag Contributor in Splunk Search 08-18-2020 0 12	0	12
How to extract count of specific event from nested JSON? I have this data coming in every minute to monitor application performance: { "events": [ { "appId": "mock-app... by chtmai Explorer in Splunk Search 08-18-2020 0 5	0	5
Unable to see data indexed 4 hours ago Hi,Data was indexed 4 hours ago. At the time i was able to see the data when searching the relevant index. 4 hours la... by PN3000 Loves-to-Learn in Splunk Search 08-18-2020 0 2	0	2
deprecated 'stats' command syntax notification on a sample Splunk search Running a sample search suggested by "Add sparklines to search results" in Splunk Documentation for the latest versio... by mitag Contributor in Splunk Search 08-18-2020 0 1	0	1
Did anyonen else lose all of their "Splunk Answers" history? I am aware that answers.splunk.com has changed engines and is now community.splunk.com. The migration announcement st... by bloizides Observer in Splunk Search 08-18-2020 0 4	0	4
Is there a dashboard visualization that allows editing a lookup table in the UI instead of using lookup editor? Is anyone aware of a dashboard visualization that will allow me to edit a lookup table in the UI? Rather than using L... by daniel_althoff8 Loves-to-Learn in Splunk Search 08-18-2020 0 0	0	0
License Usage by Each Indexer License Usage by Each Indexer : Need to find license usage by each indexer. by vishaltaneja070 Motivator in Splunk Search 08-18-2020 0 2	0	2
How to pivot results table? I got above result from my splunk query: index="cx_aws" source="notifications-service"\|stats count by tokenValidator... by vinod0313 Explorer in Splunk Search 08-18-2020 0 1	0	1
How do I modify the span for timechart to match a chart I'm defining with a time range of "last 7 days"? Hello! I've been playing around with the timechart command and spanning, however, there is an issue I'm having when ... by goodsellt Contributor in Splunk Search 08-18-2020 2 17	2	17
Arithmetic operation on fields from different events Consider the below types of eventsfields : OS transaction numbersEvents: Win purchased ... by sstanlee Explorer in Splunk Search 08-18-2020 0 6	0	6
Populating non-existent values where multiple timestamp comparisons exist. We have the following SPL query which generates statuses (i.e. "Success", "Failure", "Warn") for various different "s... by adnankhan5133 Communicator in Splunk Search 08-18-2020 0 6	0	6
Key value field extraction from Cisco devices Hi there,digging deeper into the REST API and XML parsing. When running an XML status command on our Ironport I get t... by marcluescher Explorer in Splunk Search 08-18-2020 0 1	0	1