Splunk Search

Community Activity

	How to remove unfinished buckets from "bin" command I am using a bin command on _time field to have 10 minute sections of data. Like below: \|bin _time span=10m minspan=... by rohitmaheshwari Explorer in Splunk Search 02-27-2020 0 1	0	1
	Why is disk used in my SEARCH HEAD too high? I can check that 80% of my disk is used in my Search Head. How to decrease it and what exactly is taking up space? Th... by muez Explorer in Splunk Search 02-27-2020 0 2	0	2
	Getting counts of each search result over time I am trying to determine a way to search for user logins over time to get an idea of application usage. If I have a ... by chadwell Explorer in Splunk Search 02-27-2020 0 2	0	2
	Help with props.conf with lookup? All, I have a lookup, which I in turn want to do a couple aliases on. But doesn't seem to work. I get clienthost ba... by daniel333 Builder in Splunk Search 02-27-2020 0 3	0	3
	How to mask a password in a log coming from an HTTP Event Collector I am trying to mask a password that is inside a log coming from HTTP Event Collector. I configure my props.conf with... by dnavia29 New Member in Splunk Search 02-27-2020 0 8	0	8
	iplocation.py file missing from $SPLUNK_HOME/etc/apps/search/bin/ Hello Eveyone, I am trying to use iplocation command to search for ip address info within my network. My search is as... by rahulkumarfgf Explorer in Splunk Search 02-27-2020 0 5	0	5
	What is the most elegant way to convert from float to currency in SPL? Miraculously in 2020 there still hasn't been a Splunk Answer that details an elegant way to convert from float to cur... by nick405060 Motivator in Splunk Search 02-27-2020 0 1	0	1
	Alternative solution for join with bad performance I need to do a search on multiple indexes/events and need to do a join on different fields from both. Below query wor... by amdhindsa New Member in Splunk Search 02-27-2020 0 3	0	3
	Can't get my chart to sort Here is my query index="myIndex" AND host="myHost" AND ObjectName="myObjectName" \| eval secondsEpoch = GroupDateTim... by peterimbery Engager in Splunk Search 02-27-2020 0 2	0	2
	Routing the data to a different Index via Regex Hello, We have a source ABC sending us logs and are being stored inside an index called all_logs. From that source, ... by shiv1593 Communicator in Splunk Search 02-27-2020 0 3	0	3
	How to replace a dynamic string in an event? I want to replace a dynamic string in an event.. Example: error occurred from the server ABCXYZ12345ABCXYZ under lend... by marisstella Explorer in Splunk Search 02-27-2020 0 11	0	11
	is it possible to use json file with csv lookup file? Hi all, i have used csv lookup file to csv files to map the values . Can i use json file instead of csv file to map t... by anooshac Communicator in Splunk Search 02-27-2020 0 5	0	5
	splunk event time and timestamp on log file is not matching. splunk event time and timestamp on log file is not matching. Our log file has below entry for timestamp "2020-02-20 1... by sim_tcr Communicator in Splunk Search 02-27-2020 0 4	0	4
	Correlate two events with one common field value Hello, I have some logs with a common field and I'd like to correlate them. here my first event: 26/02/2020 16:3... by mvagionakis Path Finder in Splunk Search 02-27-2020 0 3	0	3
	how to pass filter token based on filter value in search query? Hi, I have below multiselect filter , based on username="ABC" , I need to display two more filters.( ip, city) And w... by avni26 Explorer in Splunk Search 02-27-2020 0 3	0	3
	how to get my duration from transaction my search query is this: DESCRIPTION="sump pump" OR (DESCRIPTION="ejector pump" AND DESCRIPTION="run/stop") \| rex fi... by chookp Explorer in Splunk Search 02-27-2020 0 6	0	6
	question on stats and blank values i have a table like below. cola:colb:colc:cold 1::2:3: :::: 1:2:3:4 when i do a stats , i only get non-null values i... by jiaqya Builder in Splunk Search 02-26-2020 0 8	0	8
	AD user modification Hi All I have an AD Account how can i know what modifications has been done in last one month on this account from s... by risingflight143 Explorer in Splunk Search 02-26-2020 0 3	0	3
	Using Eval and stats together I am trying to feed the results of (2) subsearches into and eval search. \| eval Average=data/asstes [stats sum(data)... by ianpaquette New Member in Splunk Search 02-26-2020 0 2	0	2
	How to add commas into a number and make the final result a string? hi there, I need to add decimal comma separation for a long number such as 2546788 that is, 2,546,788 Then I need to ... by maximusdm Communicator in Splunk Search 02-26-2020 0 3	0	3
	How to use multisearch for inputlookup tables ? please provide an example. I want to check data from two different lookup tables and relate it using multisearch command. by Uday_Gonti New Member in Splunk Search 02-26-2020 0 2	0	2
	Trim string after second exclamation mark Hi, I have a field called SESSION_ID which has a value "0cdWYCu982HhTjoSYMUgnrCIW8c1apbU!1706637738!1581997108157" I ... by mandlikarbaaz Loves-to-Learn Everything in Splunk Search 02-26-2020 0 3	0	3
	Metric Index problem with null values I am running Splunk Enterprise 8.0.1 monitoring files with a universal forwarder and putting info from csv files into... by drezanka Explorer in Splunk Search 02-26-2020 0 0	0	0
	Compare columns in same table Hello, I have the following table: column1 column2 Andrew Andrew George George Paris Berlin I would... by carlospalma03 Engager in Splunk Search 02-26-2020 0 2	0	2
	DB Connect - another "index 1 is out of range" - how to fix it? Trying to pull specific fields out of the database tables "LastContact" and listing the output with a timestamp (Last... by arimaldo Explorer in Splunk Search 02-26-2020 0 1	0	1