Splunk Search

Community Activity

Splunk Rex: Extracting fields of a string into a Column I'm a newbie to SPlunk REX trying to do some dashboards and need help in extracting fields of a particular variable i... by rczone Path Finder in Splunk Search 11-19-2019 0 7	0	7
How do I create a subsearch with a duration greater than a selected value of the original search? The original search is selected with the drop down box at the top of the screen. I created a subsearch with earliest... by lmzheng Explorer in Splunk Search 11-19-2019 1 4	1	4
How to remove white spaces in field value? I am having an field name called "JOBNAME" which contains some jobname values and some empty values(which means there... by hariniramesh New Member in Splunk Search 11-19-2019 0 1	0	1
Using case in an eval statement, with values undefined in the case function displayed in stats table as well. The command I am running is: basesearch \| eval number = case ( number = "1" , "Number 1" , number = "2" , "Number 2... by amcb90 Engager in Splunk Search 11-19-2019 0 1	0	1
Combine/ Compare two REX fields Hello, I'm having the two REX fields and want to search the logs with those fields. Which one matches that field nee... by kamaleshwar Explorer in Splunk Search 11-19-2019 1 2	1	2
How to wrap a regex multiline event to form a single event until you find the date at the beginning of the interaction Hi, I have the following log format, How can I break this multiline event on condition that "2019-11-12T09: 51: 28.2... by leandromatperei Path Finder in Splunk Search 11-19-2019 0 4	0	4
Splunk Practice Environment I'd like to set up a practice Splunk environment so that I can practice various install methods of Splunk (clustering... by itsmevic Communicator in Splunk Search 11-19-2019 0 2	0	2
How to restrict search results to columns wanted I have a search that returns a large amount of information in each row, resulting in many columns, most of which I do... by jtpryan New Member in Splunk Search 11-19-2019 0 7	0	7
What is the difference between == and = in SPL ? Hi, I've seen it several times but don't know the difference and when to use == instead of = . Like in these samples... by HeinzWaescher Motivator in Splunk Search 11-19-2019 0 2	0	2
How to report a peak count per day based on a per minute count? I'm trying to determine a way to report a peak per minute count per day (in this case, the last 30 days) If i run th... by karlduncans Engager in Splunk Search 11-19-2019 0 4	0	4
Why does my search fail when searching indexed extractions with double colons where the value contains spaces? We are using a CSV input, which generates indexed extractions - some of the field values contain spaces. Here is som... by mevans292 New Member in Splunk Search 11-19-2019 0 7	0	7
How to report a busiest/peak hour for each day for the last 30 days? Hi, I am trying to find the busiest time of the day for last 30 days. What i need is a table like this - Day Peakhou... by Shashank_87 Explorer in Splunk Search 11-19-2019 0 3	0	3
How to break a multi-line event with regex, provided that the date and time containing the milliseconds changes only at the beginning of the line. Hi, I have the following log format, How can I break this multiline event, with the condition if the date is changed ... by leandromatperei Path Finder in Splunk Search 11-19-2019 0 4	0	4
rename the search results for multiple conditions Hello, I'm trying to rename query output and those are string values. expecting output for field MANAGER_NAME would b... by nagarajsf Explorer in Splunk Search 11-19-2019 0 5	0	5
Lookups load 500 times in one search Hi, the environment uses 170 lookups and during one single search, they get loaded exactly 500 times each wich sums... by misteraufziehvo New Member in Splunk Search 11-19-2019 0 4	0	4
is there a way to search who has access to an index? is there a way to search who has access to an index without having to dig thru the access controls, roles and users? ... by packet_hunter Contributor in Splunk Search 11-19-2019 1 3	1	3
Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run? Hi, One of my customers received a "waiting for queued job to start" message today, and it then took about 5 minutes... by a212830 Champion in Splunk Search 11-18-2019 10 10	10	10
merging 2 fields based on a common 3 field in the same index I have an index with multiple fields that I have created using "Extract new fields". The following is the what my cur... by reddevilz Engager in Splunk Search 11-18-2019 0 1	0	1
How to calculate the Average Weighted as definition? Hello All I have been looking on the forum for a solution on how to calculate the average weighted. I see several op... by adamaso New Member in Splunk Search 11-18-2019 0 2	0	2
How to change format and then insert+combine them Hello. Could anyone help me out? I have a DoB string with the following format dob='2002-01-03' I would like to fo... by prot3ctor New Member in Splunk Search 11-18-2019 0 7	0	7
How to get a direct count of results which are over a certain amount? I've set up the following search with a count of events based on specific time frames over a week span: index=epacka... by mcram52 New Member in Splunk Search 11-18-2019 0 1	0	1
Timetable/Schedule is been given in lookup table, how to use it in splunk query Hi Splunkers, I am stuck in a situation where I have been provided an input lookup file containing operational hours... by hanikawadhwa Explorer in Splunk Search 11-18-2019 0 5	0	5
How to read different time slots from lookup table Hi splunkers, I have a situation to read different operational hours of same bin size for the last 3 days Scenario:... by hanikawadhwa Explorer in Splunk Search 11-18-2019 0 1	0	1
chart only display when event exist at day / day hour Hi how to display in chart only the days (or day & hour) when a „event“ (in my case speedtest results) is/are avail... by buzek Explorer in Splunk Search 11-18-2019 0 4	0	4
Why doesn't a > WHERE clause work when an = does? I cannot seem to get my search to return results when comparing a property with a greater than comparison even though... by 47024 New Member in Splunk Search 11-18-2019 0 6	0	6