Splunk Search

Community Activity

Negative lookahead for props.conf I am trying to create a stanza in props.conf so that all non splunk internal logs go to index=newindex. I tried usin... by htidore Path Finder in Splunk Search 02-17-2020 0 2	0	2
how to calculate fields total size and size used to get %used I have two fields total_size and size_used How can I calculate %used and output as a new field %used TIA by nathanluke86 Communicator in Splunk Search 02-17-2020 0 2	0	2
Excluding a source I have a host sending log data and I am wanting to exclude a specific directory from being ingested and/or indexed bu... by balcv Contributor in Splunk Search 02-16-2020 0 5	0	5
Converting from MB to GB not working HI, I have my query and doesn't seem to convert from MB to GB. What am I doing wrong? Can anyone help me? index= * ... by annageorgiou New Member in Splunk Search 02-16-2020 0 15	0	15
How to find in between duration between three transaction event? Hi, How can I find in between duration between three transaction event? For example, the duration1 between mod1 and ... by limalbert Path Finder in Splunk Search 02-16-2020 0 4	0	4
extracting fields from another field Hi, We are receiving the event in json format and given the _raw event below. I am trying to extract the fields in s... by martinnepolean Explorer in Splunk Search 02-16-2020 0 5	0	5
How do you add all the values in a column to get the total and then divide the total by the number of rows in the column? The column to the right has a total of the percentage increase, but I would like to take that total and divide it by ... by ihaveasplunkacc Loves-to-Learn Lots in Splunk Search 02-15-2020 0 4	0	4
Streamstats Time Sum When Specific Values Hi All, I'm stumped on the following search. The scenario is I'm trying to track the amount of time a support ticke... by mikepangrac Loves-to-Learn Lots in Splunk Search 02-15-2020 0 2	0	2
Extract pairldelim kvdelim JSON problems I have JSON data that I'm trying to extract into fields and unable to get all the data extracted correctly. My query... by trtracy81 New Member in Splunk Search 02-14-2020 0 4	0	4
Time chart for average of duration by Channel span 1h I have the following data and i am trying to create a time chart of the data for average duration by channel "_time"... by saikumarkomati New Member in Splunk Search 02-14-2020 0 3	0	3
getting sum of a multivalues field for ach event Hi, I have a query like below. index=linux sourcetype=iostat mount="*" which will list total_ops for each mount of... by vijaya5 Engager in Splunk Search 02-14-2020 0 2	0	2
Need help in regular expression to extract data. I need to filter the data from below _raw only the SPLUNKXML ="" _raw 2020-02-13 01:04:18.910, COUNT="863132", URL=... by DataOrg Builder in Splunk Search 02-14-2020 0 2	0	2
Time difference between events \| multiple events that are in chronological order I have the following data, and i want to find the time difference between start and end of the request for SID, need ... by saikumarkomati New Member in Splunk Search 02-14-2020 0 4	0	4
Get columns that have non-zero value columns over time (using timechart) Hi Team, Can anyone help me on this - I want to Get columns that have non-zero values over time (using timechart). _... by sahil237888 Path Finder in Splunk Search 02-14-2020 0 2	0	2
Full outer join How can I meet full outer join requirement in my search?? table a and table b with only one filed in two rows are sam... by smolcj Builder in Splunk Search 02-14-2020 4 14	4	14
Splunk Trend Indicator Single Value - Assistance would be appreciated Hi I have panels that produce a number using the stat command (stats count \| where count=0] \| stats count) at the en... by colinmchugo Explorer in Splunk Search 02-14-2020 0 11	0	11
How to subtract results from inner search and then from outer search Hi everybody, I need to find out all the servers on which the Windows EventID=XYZ is not logged. Therefore I run a s... by qman Engager in Splunk Search 02-14-2020 0 1	0	1
From Splunk search results run external command on the field Hello, I want from Splunk search results run external command on the field and return results back to splunk, followi... by msrama5 Explorer in Splunk Search 02-14-2020 0 2	0	2
Can access restrictions be put on a lookup automatically upon creation? Can access restrictions be put on a lookup automatically upon creation? For example: User A creates a lookup <-- can... by jaburke1 Path Finder in Splunk Search 02-14-2020 0 5	0	5
Why does an iframe table view only display 20 records, and how can I increase this? HI All, I am using iframe to display error details in a portal where, in 24 hours, the error count is usually more ... by samarkumar Path Finder in Splunk Search 02-14-2020 4 3	4	3
Unable to search based on certain fields In each JSON event that I put into Splunk, I have a field with the format: "field": "1:2:3:4" However, whenever I t... by sidthesloth98 New Member in Splunk Search 02-14-2020 0 10	0	10
regex to split time/date from field in lookup for timechart I have a lookup and would like to extract the date for a time chart TIA by nathanluke86 Communicator in Splunk Search 02-14-2020 0 5	0	5
How to highlight only the maximum value of a cell in table representation In my dashboard, a table panel which have the percentage of a metric for each month is displayed. Below is the query ... by akarivaratharaj Communicator in Splunk Search 02-13-2020 0 3	0	3
Not Like function !Like I am trying to search for a server which is named differently than all the others in our network. Commonly servers ar... by navdeep1568 New Member in Splunk Search 02-13-2020 0 2	0	2
How to edit multiselect token to include a field with a null value? I have a multiselect box on a field-- modelName modelName can have different values or empty value. eg. modelName="m... by kualo Explorer in Splunk Search 02-13-2020 0 10	0	10