Splunk Search

Community Activity

Splunk query to get top sorcetypename=kubernetes_logs, devided by services (or namespaces) Hi there! I need a query, that will show me Top Sourcetype Sizes by Day, where sourcetype=kubernetes_logs, and the ku... by alekseisaiko Path Finder in Splunk Search 03-04-2020 0 3	0	3
Simple search with eval. Why is no table shown? Here is the search: index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat!="HOST SCORING" \|eval check_cat=case(... by alex1895 Path Finder in Splunk Search 03-04-2020 0 8	0	8
xml field extraction with a twist Data example: <Asset href="/company/rest-1.v1/Data/Story/2530981/6709286" id="Story:2530981:6709286"><Attribute name... by manderson7 Contributor in Splunk Search 03-04-2020 0 6	0	6
How can I sum several dates that are in a single field? I need to sum several dates that are on a single field to then divide it with another field to get an average date. D... by franciscof Explorer in Splunk Search 03-04-2020 0 1	0	1
How can I perform a basic math operation between two fields? I need to perform a subtraction between two date fields in order to get a specific age. How can I do this? by franciscof Explorer in Splunk Search 03-04-2020 0 2	0	2
lookup file with a mix of ranges of IP and unique IP Hi all I use a lookup file with a mix of ranges of IP and unique IP to count events of login My file is like this ... by faribole Path Finder in Splunk Search 03-04-2020 0 1	0	1
How to convert now() into strptime? Does anyone knows how to do this? Im having a trouble with this convertion. Thanks in advance by franciscof Explorer in Splunk Search 03-04-2020 0 4	0	4
help on lost event with join command helloI use the search below in order to monitore the last reboot and the last logon date `LastLogonBoot` \| eval Syst... by jip31 Motivator in Splunk Search 03-04-2020 0 4	0	4
Regex: skipping or jumping over segments for field extraction Hey there! I am wondering if it is possible to create a regex for field extration which extracts a string, but at th... by Bastelhoff Path Finder in Splunk Search 03-04-2020 0 6	0	6
How to get most recent results based on field value? Hi, I'm trying to get the results based on recent field value. How to filter the events with the most recent scan d... by vikram1583 Explorer in Splunk Search 03-03-2020 0 1	0	1
Search 2 date fields and find amount of days minus weekend days Hello, I need to formulate a search there I have 2 date fields one is START_TIME 2020-02-28 19:19:58.0 other field is... by nathbe01 Explorer in Splunk Search 03-03-2020 0 1	0	1
How can I count mv fields by type? My data looks like: { parent_id: 1 child_info: [ { id: 123, status: "PA... by akshaysaraf Explorer in Splunk Search 03-03-2020 0 6	0	6
How can I tell a field value's type (number or string) just by looking? I know that I can use the isnum() and isstr() functions but surely there is a more obvious way, right? by woodcock Esteemed Legend in Splunk Search 03-03-2020 1 7	1	7
How to get total count of endpoints based on ClientID? I am trying find solution to get Total count of URL Endpoints by field. In this case by ClientID. Below is example... by sameena822 New Member in Splunk Search 03-03-2020 0 11	0	11
What is the purpose of TSTATS in a Summary Index? Hi, Quick question, is it possible, or is there any point to using tstats over stats when creating a summary index? ... by mansel_scheffel Explorer in Splunk Search 03-03-2020 2 3	2	3
How do you monitor a Windows shared directory? I have Splunk Enterprise installed on a Linux Server. I need to monitor a Windows Shared Directory containing a CSV f... by alonsocaio Contributor in Splunk Search 03-03-2020 0 7	0	7
How to create a table from indexed nested array I have been banging my head against the wall for a while and would love some help. Imagine I have the two event logs ... by nordstromemg New Member in Splunk Search 03-03-2020 0 5	0	5
Multivalue Extraction I have the following set of data within each event: stack_trace: [ [-] { [-] class_name: FOO file... by cquinney Communicator in Splunk Search 03-03-2020 0 4	0	4
If one field null, populate another field with 0 Hello Splunkers, I have two fields that correlate. One field is hostname and another field is score. When I try to g... by cooperjaram Engager in Splunk Search 03-03-2020 0 2	0	2
When using the rangemap command, how do I determine the order in which ranges display in tables and charts? When you have a set of events that share a field with a numeric value, you can group those events together according ... by mattness Splunk Employee in Splunk Search 03-03-2020 1 2	1	2
How can Splunk loop through a list of numbers and do an action against each of them? We have got a problem to find a list of 500+ client servers (but less than 1000), which are missing DNS entries. the ... by koshyk Super Champion in Splunk Search 03-03-2020 1 4	1	4
Select a row based on highest value of a field. Hi All, I have a table like below (raw table), which shows count of request per 4 hours from two services over a per... by KarunK Contributor in Splunk Search 03-03-2020 0 3	0	3
How to pick the status what i wish to I have table with 3 field values as follows SOR Datafeed Status 1art xxx Met SLA 1art yyy Missed SLA 1art zzz Met SL... by pench2k19 Explorer in Splunk Search 03-03-2020 0 9	0	9
use stat results as string instead of numbers Hi everyone, so I am wondering if it is possible to display my results as a string for computername instead of displa... by rtalcik Path Finder in Splunk Search 03-03-2020 0 2	0	2
Is there a way to identify when we are getting close to jobs concurrency limits? Is there a way to identify when we are getting close to the concurrency limits? we know that there are error messages... by danielbb Motivator in Splunk Search 03-03-2020 0 3	0	3