Splunk Search

Community Activity

Comparing index sizes on 2 dates I have been asked to create an alert that looks at the index sizes (all indexes) for today, and compare them to the s... by tsheets13 Communicator in Splunk Search 03-06-2020 0 5	0	5
Time periods for query and alert Hi there!I'm running this query index="staging" \|eval raw_len=len(_raw) \| eval raw_len_gb = raw_len/1024/1024/1024 \| ... by alekseisaiko Path Finder in Splunk Search 03-06-2020 0 5	0	5
Conditional searching using eval command with if match Hi SMEs: I would like to define a print event type to differentiate Remote Prints from Office Print jobs. From my p... by mdeterville Path Finder in Splunk Search 03-05-2020 0 4	0	4
Splunk query to exclude the searched strings based on date and display in table Hi Splukers, I have a requirement to search for some filenames and display the missing files as per the date. Thus, ... by asharmaeqfx Path Finder in Splunk Search 03-05-2020 0 6	0	6
Convert this time format to epoch I have a time in the format of: 3:21:34 AM 12/8/2014 I'm trying to convert this to epoch time. Can anyone lend a h... by hagjos43 Contributor in Splunk Search 03-05-2020 4 10	4	10
COnversion of PM /AM time to epoch not working as expected 2/11/2020 11:49:00 AM 2/11/2020 9:55:00 PM How to convert this into Secs.. Conersion of AM and PM is not working a... by ashanka Explorer in Splunk Search 03-05-2020 0 2	0	2
How to convert string data in a field to proper case? I'm trying to convert string data in my fields to proper case e.g. josh smith to Josh Smith. Is there any function in... by drewski3420 New Member in Splunk Search 03-05-2020 0 7	0	7
Setting field value based on another field I have a value in my events called type, which is a single digit integer (1, 2, 3, etc.) I would like to create a new... by tsheets13 Communicator in Splunk Search 03-05-2020 0 2	0	2
How to extract a field with regex Hi Everyone Sample logs: {"kubernetes":{"container_name":"sign-template-services","namespace_name":"merch-ps-signs-... by maria_n Explorer in Splunk Search 03-05-2020 0 3	0	3
split specific values from list Hi All, I have data like below Drive Free_Space C:,D: 500 GB,450 GB E:,D: 25... by harishalipaka Motivator in Splunk Search 03-05-2020 0 3	0	3
Expand requirement for running on same OS? The requirements state that all cluster systems must run the same OS. Does this include the same OS version level of... by cisaksen Explorer in Splunk Search 03-05-2020 0 1	0	1
Splunk Data Input Script apparently running in root directory I am experimenting on a test system and have a simple shell script that consists of one line to call Python 3 to run ... by julianniemeyer New Member in Splunk Search 03-05-2020 0 0	0	0
Search and lookup table fields comparison Hello everyone,I have the challenge to compare two date fields, one coming from a search and the other one is reporte... by DomenicoFumarol Explorer in Splunk Search 03-05-2020 0 2	0	2
Join two queries Hello, i Have this query that i want to improve \| loadjob savedsearch="myquery" \| where (strftime(_time, "%Y-%m-%d"... by tahasefiani Explorer in Splunk Search 03-05-2020 0 7	0	7
Splunk table get values smaller than 4 months Hello, I have the below query which works fine: {My search} \| rename user_id as User \| stats max(asctime) as "Last ... by anouar_jben Explorer in Splunk Search 03-05-2020 0 5	0	5
How to calculate percentage increase/decrease for indexes per day? How would I calculate the percentage increase/decrease, for indexes on a per-day basis? Thx by jwalzerpitt Influencer in Splunk Search 03-05-2020 1 8	1	8
How to pull a report of application log where DEBUG level log is enabled Hi, is there anyway to pull a report to get the data of log where DEBUG level log is enabled, based on the index and... by iqbalintouch Path Finder in Splunk Search 03-04-2020 0 0	0	0
Question on role creation for editing xml i would like one user to edit xml code or change query on the panels/dashboard of his app alone. what is the capabil... by jiaqya Builder in Splunk Search 03-04-2020 0 2	0	2
Help on fields command which doesnt works hi I use the search below in order to count the number of degradation by model This search is a scheduled search and... by jip31 Motivator in Splunk Search 03-04-2020 0 11	0	11
Alternative Join command for comparinga field with subsearch Hi, I have given a query to return me a list of details as below , however the results for all of 30 days are not pop... by Jayanthi6397 New Member in Splunk Search 03-04-2020 0 4	0	4
How to trim white spaces in events in search time Hi, i have an event having white spaces in between i want to trim it the data is coming from db connect i don't ha... by vikram1583 Explorer in Splunk Search 03-04-2020 0 1	0	1
how to make the search in ascending order? HI , I have a log file where it has a sequence of activity of users. I am trying to parse that log. Splunk is parsing... by sajoseph Explorer in Splunk Search 03-04-2020 3 3	3	3
Find accounts with lastlogon older than X days Hi, I have built out an AD inputlookup that includes lastlogon dates. When I attempt to find only those users with ... by heidihart Engager in Splunk Search 03-04-2020 0 3	0	3
rex over multiple lines Dear all, hope to find here some help. I've tried now several things including searching in the answers here but don... by tbasima1 Explorer in Splunk Search 03-04-2020 1 11	1	11
Splunk where not query returning incorrect results Hello, I have the following where not query returning rows that exists in sub search, following is the query environm... by msrama5 Explorer in Splunk Search 03-04-2020 0 3	0	3