Splunk Search

Community Activity

Compare values of 2 columns in a table I have a table that has 2 columns with Transaction ID's shown by a stats values() as below: \| stats values(E-Transac... by ramonnegronvz New Member in Splunk Search 05-03-2020 0 6	0	6
Match and compare fields with different names and from different sources Ok, so I a trying my best to evaluate the differences between two search results. Search 1 gives me a list of "vm_... by garciajbg Explorer in Splunk Search 05-03-2020 0 10	0	10
how to stats counts if one of the field's value greater than 100 ? Hello, I have ALERT field and in this field has different types ALERT values, so i want filter one of them counts if... by corehan Explorer in Splunk Search 05-03-2020 0 2	0	2
Compare todays data with yesterdays for results from a custom command I have a custom command that returns results in tabular format with a _time column as well. Its something like below... by Harishma Communicator in Splunk Search 05-03-2020 0 5	0	5
Create a chart with multiple search and display events filtered by date hi i'm new to splunk, need help to write a query to get records and create a chart based on that . I am trying to com... by mujifax New Member in Splunk Search 05-02-2020 0 3	0	3
How to get the maximum value from a timechart table? Hi folks, I am trying to obtain the maximum value from any cell in a table generated by a timechart search. For exa... by avisram Path Finder in Splunk Search 05-02-2020 1 12	1	12
isuue with inputlookup file to expand multi values Hi Experts, I have a inputlookup file which consists of two fields i,e _time and names fields as shown below, _time... by james_n Path Finder in Splunk Search 05-01-2020 0 1	0	1
Rename group by value Hi, I am using splunk to monitor the performance of a number of long urls and the search strring is like : \| sta... by shangshin Builder in Splunk Search 05-01-2020 0 7	0	7
create new field from substring of another field Hi, in a search i'm trying to take my 'source' field, do a substring on it and save it as another field. Here's what ... by jedatt01 Builder in Splunk Search 05-01-2020 3 4	3	4
How to exclude some result from rex max_match I am trying to search all Measures and Dimensions captured from Extended events of sql server analytics service. ind... by dpatiladobe Explorer in Splunk Search 05-01-2020 0 3	0	3
How do you compare a previous average with the current average Hello I am trying to compare my average events in current month to previous 3 month average (per day [1,2,3...31]) ba... by henderz New Member in Splunk Search 05-01-2020 0 6	0	6
Join type and extra data? Here is my query (time range is YTD): (splunk_server=indexer* index=wsi_tax_summary sourcetype=stash capability=109*... by hollybross1219 Path Finder in Splunk Search 05-01-2020 0 6	0	6
Trying to take specific subsets of data. (15 minute resolution rather than 5 minute being stored in splunk). I have some building occupancy data generated from our wireless network that is logged as one record per floor of eac... by richmond New Member in Splunk Search 05-01-2020 0 4	0	4
How to organize a search with two lookup tables: common and event-specific? In my question I will use a manufacturing monitoring analogy. Employees (uniquely identified by name) work a certain... by pm771 Communicator in Splunk Search 05-01-2020 0 9	0	9
A user can outputlookup and overwrite existing lookups regardless of permissions We just tested in 5.0.2.2 - A user did outputlookup and overwrote a lookup file in etc/system even though in the UI, ... by raziasaduddin Path Finder in Splunk Search 05-01-2020 7 15	7	15
How do I search records for today and 120 days back? sort -date \| dedup Date_Month_Year \| where Date>1575183600 I need this query to run only for the past 120 days from... by tferranteku Explorer in Splunk Search 05-01-2020 0 8	0	8
How can I split stats into rows MY SPL (index=* source="/var/log/authlog" "sudo" AND ("tar -xf" OR "pkg install" OR "pkg uninstall")) OR (index=... by xnx_1012 Explorer in Splunk Search 05-01-2020 0 2	0	2
Including O365 UserAgent data in search Hi all, I'm having trouble getting O365 UserAgent data to show up in a search. Currently, my search looks like: sou... by funkychickin New Member in Splunk Search 05-01-2020 0 1	0	1
lookup field value case sensitivity While field values are not case sensitive by default on Splunk, when we use lookups the default setting for the field... by constantinetamp Observer in Splunk Search 05-01-2020 0 6	0	6
Search results are not wrapping, can't scroll right. I have searched for some traps. The results are not wrapping and I can't scroll any further right. The only way I c... by horngary Engager in Splunk Search 05-01-2020 2 6	2	6
How to Left Join is NULL I just want to get the left cluster (only Table A )as below picture. How should Splunk search be? tu. by fearloess New Member in Splunk Search 05-01-2020 0 3	0	3
No result is showing when i enter the following code . I am trying to generate report using the following command but it is not showing any result . i just want to make sur... by sw9026 New Member in Splunk Search 05-01-2020 0 1	0	1
How to get the top 10 values using timechart? Hi, I have this query and it works just fine index=blah1 OR index=blah2 OR index=blah3 host=media "/fileUpload/im... by dbcase Motivator in Splunk Search 05-01-2020 1 10	1	10
Issue with displaying CPU, Mem & Disk data on the dashboard of Template for Citrix XenDesktop 7 Hi, I have deployed the Template for Citrix XenDesktop 7 with the TA-XD7-Broker add-on deployed on the brokers. Howe... by aknsun Path Finder in Splunk Search 05-01-2020 0 1	0	1
How to put data in table format Name :Test "extensionData": {<!-- --> "entries": [ {<!-- --> ... by chaitu1231 New Member in Splunk Search 04-30-2020 0 2	0	2