Splunk Search

Community Activity

Multiple value for the same field in one event.How to determine statistics I have an event having 3 errors..I have a regular expression written to capture the error as "ERROR".And now i have a... by prettysunshinez Explorer in Splunk Search 03-22-2020 0 11	0	11
Using multiple parameters for regexp host extraction Dear community, I am lost in creating a regexp that will ease up my data input creation. So I do have a file share be... by patrickprodoehl Explorer in Splunk Search 03-22-2020 0 2	0	2
\|dbxquery query="SELECT DISTINCT last_name FROM hr.employees" connection="ORCL_PDB1_CONN" Building a Dashboard dropdown. The following query works fine and there are no duplicates in the resultset however t... by jaxxsplunk Explorer in Splunk Search 03-21-2020 0 2	0	2
Tail and head commands for two different values on same field Hi Experts, I have a requirement. I have a field called 'exception' and it has two values. one as 'open file' and a... by Allampally Path Finder in Splunk Search 03-21-2020 0 3	0	3
lookup access across non-clustered search heads Hello experts and splunkers, I have a splunk environment which consists of 2 Search Heads, which are not clustered -... by takashi6 Explorer in Splunk Search 03-20-2020 0 2	0	2
Assistance on search using appendcols where the subsearch can have a different number of rows I am having issues with a search / Sub-search with appendcols when the number of rows are different. I have a summa... by dsbruce Explorer in Splunk Search 03-20-2020 0 2	0	2
Evaluate a new column based on formula from a lookup file Hello! Have this requirement: Have a business process. For each business process, some KPIs have been identified. H... by its_shubham Engager in Splunk Search 03-20-2020 0 6	0	6
AVG Count of a error message Good morning, I log different error messages in SPLUNK and want to get the average number of each error message and... by 123michi19 Explorer in Splunk Search 03-20-2020 0 3	0	3
strip portion of an email I am needing to strip a portion out of email's. I have a list of email addresses where some of them contain -priv be... by brownt61 Explorer in Splunk Search 03-20-2020 0 4	0	4
how to rank or group similar data together ? Hi all, I have a requirement as below, When there is a name field, I want it to be ranked similar names together Na... by johnsasikumar Path Finder in Splunk Search 03-20-2020 0 2	0	2
Difference between two times Hi, I have two fields in my report. Time_Created and Time_Closed. They are for time an incident ticket was created a... by mbasharat Builder in Splunk Search 03-20-2020 0 6	0	6
how to table job names at each time Hi Guys, I have the following query which i am showing line chart in a panel, how ever i want to show the jobnames a... by pench2k19 Explorer in Splunk Search 03-20-2020 0 1	0	1
Avoiding renaming multiple columns using time based streamstats Hi there, I'm trying to create a time series data using streamstats function. Got it figured out, but is there any ... by hollybross1219 Path Finder in Splunk Search 03-20-2020 0 2	0	2
Lookup in a lookup table with multivalue fields Hello, I have a lookup table that looks like below: dns ip server1 ip1,ip2,ip3 server2 ... by vpaschalidis Loves-to-Learn in Splunk Search 03-20-2020 0 1	0	1
Is it possible to only return events that have no corresponding start or end transaction event? Hi Splunk community, I'm currently trying to correlate different event sources and events with each other. My sear... by horsefez Motivator in Splunk Search 03-20-2020 0 6	0	6
Cannot access results of a Searchmanager in a for loop I have a dashboard that should perform a dynamic number of searches. For this purpose I created a search manager, whi... by mariuswal New Member in Splunk Search 03-20-2020 0 0	0	0
How do you use the lookup value as a variable? Hi, I have the following lookup, which is basically a mapping lookup: lookup name: "scoring_rules" source , field... by lozarich007 New Member in Splunk Search 03-19-2020 0 2	0	2
Scatter Plot for time x-axis and numbered Y axis I am looking to plot scatter plot to show all the data points in a particular time. Some how I am not able to get aro... by howardroark Explorer in Splunk Search 03-19-2020 1 23	1	23
How to check if an index exists efficiently? In elasticsearch one would do HEAD [index_name] and check if an index exists efficiently. Is it possible to do someth... by dapitis Engager in Splunk Search 03-19-2020 0 13	0	13
How to convert epoch to human readable format at index time for multiple time values? Event data has multiple time values in the Epoch time format. I am able to convert the one used for event timestamp w... by donaldwayne1975 Path Finder in Splunk Search 03-19-2020 0 3	0	3
Combine the Sum of Two Fields Hi all, For a search similar to the following: index=myindex "Search Term" NOT field=value source="mylog.log" \| eval... by bcarr12 Path Finder in Splunk Search 03-19-2020 0 3	0	3
How to get session key in a search script (\| script ) similar to the way a scripted input can? I'm storing a few credentials in Splunk keystore using setup.xml endpoint="storage/passwords". I have no problem ex... by avilandau Path Finder in Splunk Search 03-19-2020 1 16	1	16
Sonicwall VPN group by field then sum of a field? Hi, We are getting data from syslog for ssl vpn login. Here is a sample log. ,,"'0'",,"'-'",,"Thor","'Tunnel'","MCU... by mashhoorgulati Engager in Splunk Search 03-19-2020 0 2	0	2
Split is converting my empty strings back into null? This query kills morejunk even though it should NOT be doing so: \| makeresults \| eval a="1 2" \| eval b="junk" \| appe... by nick405060 Motivator in Splunk Search 03-19-2020 1 5	1	5
Calculating total in row Hi, I need help adding b+ c together to get a total, I will then calculate a percentage using a/combined b+c. Is thi... by khanyag1 New Member in Splunk Search 03-19-2020 0 11	0	11