Splunk Search

Community Activity

Display only specific values in a column field in Splunk Hi, I have a list of values getting displayed in one of the columns - Error Messages (for all languages) which i have... by sudeep5689 Explorer in Splunk Search 05-11-2020 0 13	0	13
How to increase chart column number more than 3000? Hi Guru, I would like to show my data with 4000 x 3000 matrix. I used chart command but the limit for the number of ... by brandy81 Path Finder in Splunk Search 05-11-2020 0 4	0	4
Base and post process search Can someone help me in understanding the actual use of base and post process searches please. And I would also like t... by prettysunshinez Explorer in Splunk Search 05-11-2020 0 2	0	2
eval round Hi all, During evaluating round I got the error: \| stats avg(duration) AS "booking average time" by hours \| eval "b... by slipinski Path Finder in Splunk Search 05-11-2020 0 6	0	6
help with if-else statement Hello, I have this query : index="prod" eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-... by sarit_s Communicator in Splunk Search 05-11-2020 0 10	0	10
Search syntax help I import csv files structure like following A Last Login Region Disable abc@abc.com ... by kenntun Engager in Splunk Search 05-11-2020 0 1	0	1
visualization in a line chart after reaching a threshold it needs to show in different color how is it ?? by punithjigali Explorer in Splunk Search 05-11-2020 0 1	0	1
Joint two table with subrow I' struggle with joining two following table: Table1 Table 2 The row company of table 1 contains two industry_id,... by alberttra Engager in Splunk Search 05-10-2020 0 1	0	1
Results no show for users Hi I create report and share with users (join to ldap server). they can see report but when click on numbers that sho... by indeed_2000 Motivator in Splunk Search 05-10-2020 0 0	0	0
Relative and Exact Time Hello, I am using these two commands at the end of my search, and it works. \| timewrap d \| where _time >= relative_t... by genesiusj Builder in Splunk Search 05-09-2020 0 15	0	15
transpose xyseries not helping Need to transform like this. Please help. Before: Col1----Col2 Name1---- a ------------b --------c After:... by mukulraghuram New Member in Splunk Search 05-09-2020 0 1	0	1
extract fields from multiple events. Below are my events. Event1:contains Messages Id and Status Event2: contains Messages Id and Origin E... by valivarthiramu New Member in Splunk Search 05-09-2020 0 1	0	1
report on disk usage spikes? Need a report that: Lists volumes with significant disk usage spikes over a given timeframe.Plots those disk usage s... by mitag Contributor in Splunk Search 05-09-2020 0 10	0	10
Use field values in a query for loop Hi, I want to use field values for a search query and then export the results for each field value to a CSV For examp... by nwong1 New Member in Splunk Search 05-08-2020 0 1	0	1
Extracting Field from 2 different events Dear All, I want to extract fields from the below events. The problem I'm facing is that the fields are not in harmo... by ralam Explorer in Splunk Search 05-08-2020 0 3	0	3
Bell curve from stats I haven't seen much on creating a bell curve in Splunk. I've created a query that returns 30,000 events for 40+ assoc... by seomaniv Explorer in Splunk Search 05-08-2020 0 4	0	4
can we make a field to _time and pass values through earliest / latest in splunk can we make a field to _time and pass values through earliest / latest or through Time range button ? by rakeshksingh New Member in Splunk Search 05-08-2020 0 4	0	4
Is it possible to use base search in append sub search? I want to use base search for query2 as well Thanks! by ny34940 Path Finder in Splunk Search 05-08-2020 1 15	1	15
How do I use a field gathered from one search in a completely independent search (without a join) I need to do one search with value A in the logs to get value B, then search on value B in another, independent searc... by splunkuser2127 Loves-to-Learn in Splunk Search 05-08-2020 0 2	0	2
Is the search job inspector option the best way to determine the performance of a search query? Hi, I am pretty new to Splunk and wanted to know how to determine the performance of a query? Is it through the "Ins... by vpurushottam Explorer in Splunk Search 05-08-2020 0 2	0	2
Search Bar - large queries fail to execute and cause "Disconnected from Server" error? When I attempt to enter very large queries into the search bar I get errors in chrome and eventually a "disconnected"... by markconlin Path Finder in Splunk Search 05-08-2020 0 3	0	3
Can you specify timezone in a REST API search? I'm using the REST API with a one-shot search to pull back some previously summarized information. The summary indexi... by jedatt01 Builder in Splunk Search 05-08-2020 2 4	2	4
Create new fields based on value of another fields. Hi All, In my log, I have one field called ServerName. Below are some values of that field. DAAPP2aBANG2 DFAPP20bLON... by paragvidhi Engager in Splunk Search 05-08-2020 0 1	0	1
I want to omptimize the regex? ErrorMessage : 'rex' command: has exceeded configured match_limit, consider raising the value in limits.conf. \| rex field=_raw max_match=0 "BodyOftheMail_Script\s=\s\[\sBEGIN\s{0,}(?<BodyOftheMail>.((.\|\n)*?)(?=\s{1,}END\s\]))"... by vn_g Path Finder in Splunk Search 05-08-2020 0 2	0	2
How to merge two events with same field into one I have two rows having follwing values: Name Text Count A ABC 1 A EFG 1 I want that my result should be di... by sudeep5689 Explorer in Splunk Search 05-08-2020 0 3	0	3