Splunk Search

Community Activity

Add a column that is the difference of the first two columns. So suppose that everyday Splunk takes in a report that houses 9 different fields, one of which is called 'status'. St... by Username1 Path Finder in Splunk Search 07-22-2020 0 2	0	2
Linechart with clustered data Hi all, I need to show the number of concurrent logged users within the last 30 days. What I would like to have is a ... by paxo Loves-to-Learn Lots in Splunk Search 07-22-2020 0 1	0	1
How to group by from two fields and perform stats depending of the field? Hello,Let me give you an example. I've got the following table to work with:src_groupdest_groupcountAB10BA21AC32BZ6 I... by davietch Path Finder in Splunk Search 07-22-2020 0 9	0	9
REST API Incomplete Results Getting incomplete (lesser number of events as results ) when using rest API. The same search i run in the splunk ent... by vvvinamer Engager in Splunk Search 07-22-2020 0 4	0	4
External search command 'dbquery' returned error code 1. Script output = 'There is no such database [abcdef] available. Hi @gcusello ,When I am running the following query it is working fine .\|dbquery wmsewprd "select REC_TYPE, CODE_TYP... by rahul2gupta Path Finder in Splunk Search 07-22-2020 0 9	0	9
How to find the week number of a date in a month and same week(number) in previous month I have a date field in "%m/%d/%Y" format.I need to find the week number of this date and find the same week number of... by mani Explorer in Splunk Search 07-22-2020 1 2	1	2
Not able to see my lookup while creating an automatic lookup. Not able to see my lookup while creating an automatic lookup.While creating an automatic lookup i am not able to see ... by veerendra_modi Loves-to-Learn in Splunk Search 07-22-2020 0 0	0	0
looping a function HI Splunkers, I am looking for some help on loops in splunk. I have a lookup file like below.from,toparent,child1pare... by nadlurinadluri Communicator in Splunk Search 07-22-2020 0 4	0	4
Rest API Search If i run a post search method, it returns a sid. How would i come to know that the search is complete and that when i... by vvvinamer Engager in Splunk Search 07-22-2020 0 4	0	4
How to search for status change in field values? Hello, I have events with id, status that is collected everyday for all the ids. I would like to know when the time(... by kiru2992 Path Finder in Splunk Search 07-22-2020 0 5	0	5
Transaction via Rex I have a query that I'm trying to get the amount of time a transaction takes to execute. I was selecting only a piece... by jasoneaton Engager in Splunk Search 07-21-2020 0 3	0	3
Having trouble passing values in a macro to collect command. Splunkers,I sure hope this is just user error and I am myopic today! Have a simple macro: collectevents(2) args=index... by ddelmont Explorer in Splunk Search 07-21-2020 0 2	0	2
Query partially if csv doesn't exist. -- Looking for IF-ELSE scenario with eval My query looks like thisindex=* sourcetype="MYSOURCE" \| table company_id \| dedup company_id \| where company_id != "-... by aravindsurya77 Observer in Splunk Search 07-21-2020 0 3	0	3
How to find the data from nested log I am using below query index=aws earliest=-12h eventName=AuthorizeSecurityGroupIngress "items{}.cidrIp"="0.0.0.0/0" A... by john_snow Engager in Splunk Search 07-21-2020 0 1	0	1
Group event Hello,I have some log events that are structured like that:<timestamp> - [INFO] <serialnumber 1><timestamp> - [INFO] ... by Nadeige New Member in Splunk Search 07-21-2020 0 2	0	2
Timechart graph with difference in values over the last 60 minutes I have the result below in a table, but for some technical reasons I need to check these values in a bar chart, but... by leandromatperei Path Finder in Splunk Search 07-21-2020 0 1	0	1
create a multivalue field, based on multiple single value fields with the same field name Hi there, I have a bit of a tough one.I have a log with multiple entries of the same field, basically a list of value... by fsiemons Engager in Splunk Search 07-21-2020 0 1	0	1
How do I extract a string of numbers using Rex to work the AVG out from a string to a number How do I extract a string of numbers using Rex to work the AVG out from a string to a number As it is showing as blan... by joe06031990 Communicator in Splunk Search 07-21-2020 0 5	0	5
Can edit event visualization self? like exclude date in Event column.... / search / Hi Splunkers! This is just an example from splunk. And it is a just similar visualization what i want to. Except a po... by summerura Explorer in Splunk Search 07-21-2020 0 1	0	1
Issue with the AVG however min and max work fine. Hello, I am using the stats command however the AVG shows as being blank yet min and max works fine: Index=index_ tes... by joe06031990 Communicator in Splunk Search 07-21-2020 0 8	0	8
How can i run STATS Sum command with group by another field(not date)? Hi,I have a sample data as following, for multiple date, separate space stats.{"object":"DOC1","date":"2020-06-13","w... by bidhanjena13 Engager in Splunk Search 07-21-2020 0 1	0	1
Excluding my own activity from searches in audit index Searching for events in _audit is special because when I run a search, my own ad-hoc search gets added to the returne... by chris94089 Path Finder in Splunk Search 07-21-2020 0 5	0	5
How to dynamically pass the current and last month in search? Hi,I have field as Jan , Feb ,Mar .... Dec with values for each month and I want to take sum of current month and las... by avni26 Explorer in Splunk Search 07-21-2020 0 1	0	1
What should I use to put a TAB literally in a regex replacement within transforms.conf? What should I use to put a TAB literally in a regex replacement within transforms.conf? I've tried \t but that's not... by stefan1988 Path Finder in Splunk Search 07-21-2020 0 4	0	4
display columns from 2 splunk queries based on a common column Hi All,I have a query where I am passing one field from the output( outer query )to the another query using subsearc... by akkaraju Explorer in Splunk Search 07-21-2020 0 6	0	6