Splunk Search

Community Activity

Not able to convert field from string to number The below is my query to extact fields from screenshot attached. index=*** host=* source=**** \| rex field=... by nilbak1 Communicator in Splunk Search 03-26-2020 0 4	0	4
Display "Zero" when 'stats count' value is '0' I would like to display "Zero" when 'stats count' value is '0' index="myindex" "client.ipAddress" IN ( 10.12.12.13... by sriniavula66 New Member in Splunk Search 03-26-2020 0 2	0	2
Splunk Field Extraction inside a bracket Hi All, Is there any faster way to extract fields with this format on props and transforms file? like Key value pair... by jadengoho Builder in Splunk Search 03-26-2020 0 4	0	4
Why is my map command returning an error when there are no results from the main search? Hi, I'm having issues where the map command returns an error when there are no results from the main query. In my us... by packland Path Finder in Splunk Search 03-26-2020 1 13	1	13
How to sum up numeric value for a matching string pattern? Hi, I have following pattern in my logs and i have need to sum up the numeric values. I want to sum up how many prod... by modipawan8126 New Member in Splunk Search 03-26-2020 0 5	0	5
rex and eval I have a rex statement that parses multiple events and extracts the servers and its state:, something like below. in... by garumuga New Member in Splunk Search 03-26-2020 0 2	0	2
How to create a timechart with actual values (NOT aggregation) Hello Team, from below words I would like to get only value 497 and that has to be timechart with actual value, how ... by chandukreddi Path Finder in Splunk Search 03-26-2020 0 3	0	3
Decide between two queries? I need to decide which token to use in a dashboard query (one or the other would be used for my "host" filed in the r... by tjsnow Explorer in Splunk Search 03-26-2020 0 2	0	2
Chart Series colors keep rearranging themselves. I have a timechart area chart that shows three types of event over time ("Node up", "Node Down' and "Node Rebooted").... by ocallender Explorer in Splunk Search 03-26-2020 1 3	1	3
edit Linux agents to always return 'host' as FQDN? This seems to be a common question and I've read several previous discussions. The issue seems to be that the default... by ttovarzoll Path Finder in Splunk Search 03-26-2020 0 13	0	13
getting the average time from multiple transactions So I have some data in the format of Time \| UUID \| event_name_status \| actual_... by brunelstudent New Member in Splunk Search 03-26-2020 0 2	0	2
Field Extraction regex, stop at word or $ So I have some data that I'm trying to extract the application name from. These are Citrix ICA syslog events. Here'... by JDukeSplunk Builder in Splunk Search 03-26-2020 0 4	0	4
How to rank data based on field value? I've got data say in following format (*there may be more than three types of exception) Name,Exception,count ... by s20071035 Engager in Splunk Search 03-26-2020 0 3	0	3
Are Splunk-metrics needed to search logs for pods? Hi, When I perform any search in Splunk, the left side has Interesting Fields and Selected fields showing a list of ... by sunk New Member in Splunk Search 03-26-2020 0 0	0	0
makeresults query stuck in v7.3 Hello, One of the dashboards has a makeresults query like below, with about 250 append statements. \| makeresults\| e... by saneja New Member in Splunk Search 03-26-2020 0 2	0	2
Help me write props.conf /transforms.conf for below data. 36,03/26/20,13:12:04,Packet dropped because of Client ID hash mismatch or standby server.,IP,,B88584ADE973,,0,6,,,,,,... by muizash Path Finder in Splunk Search 03-26-2020 0 1	0	1
How to handle "no results found" in subsearch Hi all, I have a subsearch that returns me the delta between two events. The problem is, sometimes the two events I... by tsa_asap Engager in Splunk Search 03-26-2020 0 2	0	2
Need help in time difference for events Hi All, Pleas help me in getting a query to display the time difference from the events that mentioned below index=op... by jerinvarghese Communicator in Splunk Search 03-26-2020 0 7	0	7
How to regex multiple events, store it in one variable and display based on User click? Hi, I am looking for some help on the below query. I have list of APIs which has different parameters in the URL. I ... by rkrish71 New Member in Splunk Search 03-26-2020 0 8	0	8
Fix datetime.xml file in SPlunk So I have to update my datetime.xml file in Splunk because timestamp extraction problem after 1jan 2020. According t... by muizash Path Finder in Splunk Search 03-26-2020 0 2	0	2
Splunk Add-on for ServiceNow：about the table "sys_audit_delete" Hello. Please help me.... I failed to get the table "sys_audit_delete" via Splunk Add-on for ServiceNow. I succeeded ... by kanahayashi Explorer in Splunk Search 03-25-2020 1 8	1	8
Combine some of the results in a field and count the total Hi all, I am trying to get a count of all users signed into our VPN. While this is easy, i need it broken out based ... by mungerc New Member in Splunk Search 03-25-2020 0 1	0	1
Stats issue with multivalue field Hi, I am tracking my assets with vulnerabilities. My minimized sample query is: index=vuln \| stats dc(dns) as impac... by mbasharat Builder in Splunk Search 03-25-2020 0 4	0	4
How to get LDAP group name by using query or REST API? by viswanathsd Path Finder in Splunk Search 03-25-2020 0 10	0	10
How to create a bar chart that counts completed tickets and averages Hi guys! I am pretty new to this and in researching I have not found what I am looking for or did not recognize the a... by tmanuel1 New Member in Splunk Search 03-25-2020 0 2	0	2