Splunk Search

Community Activity

Performantly overriding sourcetype per event with new replacement string, not backreference? I know how to use Splunk 7.3.0 to overrride source type per event using a backreference. For example, given this snip... by Graham_Hanningt Builder in Splunk Search 11-20-2019 1 9	1	9
combined two fields with eval , count is not displaying correctly Base search \| search "body.refundTenderType"=* \| search "body.refundTenders{}.paymentType"=* \| rename body.refundTend... by monipinni Explorer in Splunk Search 11-20-2019 0 0	0	0
Get list of all jiras with project name and issuetype I am using this query but I am not getting any data \| jirarest jqlsearch "project = CHANGE AND issuetype in ("App C... by nukarajusundeep New Member in Splunk Search 11-20-2019 0 6	0	6
Sorting the top 10 values of the each field that is grouped HI I need to get top 10 values of the src_count on each grouped item. The query which i have is index=palo \| st... by renjujacob88 Path Finder in Splunk Search 11-20-2019 1 4	1	4
Looking for the correct approach in integrating our prediction platform with Splunk Hi, I am a beginner here. We run a prediction platform for network incidents and wish to integrate with Splunk. We w... by abhilashr New Member in Splunk Search 11-20-2019 0 1	0	1
How to include counts with 0 events? Stats count is not showing me the number of counts if there are no events for the particular search. index="myIndex... by eliassplunk Explorer in Splunk Search 11-20-2019 1 8	1	8
Creating Bubble Chart with both X and Y axis as a category, and bubble size as a metric \| makeresults \| eval A=" North\|WidgetA\|1000### South\|WidgetA\|2000### East\|WidgetA\|1000### West\|WidgetA\|300### Nor... by ferenc0521 New Member in Splunk Search 11-20-2019 0 0	0	0
How to display an number of lines in a table panel without limit or head Hi I would like to know if there is a way to define a number of line (8 for example) to display in a single panel wit... by jip31 Motivator in Splunk Search 11-20-2019 0 1	0	1
Where and or statement for multiple values Hello, I'm building a search that tracks the use of memory allocated(mem_alloc), memory in use(mem_used), CPU in use... by codedtech Path Finder in Splunk Search 11-20-2019 0 3	0	3
How do I delete lookup file (CSV) from a lookup lists using query? Hi All, When i run this query \|rest services/data/lookup-table-files I get a list of CSV data. From that, i want to ... by harishalipaka Motivator in Splunk Search 11-20-2019 1 4	1	4
How to determine if a value changes with time, the last five values are always incremented, and then set to alarm How to determine if a value changes with time, the last five values are always incremented, and then set to alarm by duwenhua New Member in Splunk Search 11-20-2019 0 1	0	1
How to search in index with a condition from another index Hi, I have 2 different indexes. Index1: _time Fehlermeldungtext 2019-07-01 22:01:30 Streckenüberwachung Auslauf! 20... by spisiakmi Builder in Splunk Search 11-20-2019 0 3	0	3
File upload with user defined charset does not recognized German umlaute We are trying to upload a text file with German text, but the German umlaute are not recognized Manual file upload ... by schomar New Member in Splunk Search 11-20-2019 0 2	0	2
How do I get different field values in different fields that are associated with same field value in another field? Hi, could you please help me with below info: user service name device abc12... by 90509 Engager in Splunk Search 11-20-2019 0 5	0	5
Can I place a TAG within a TAG? Can I place a TAG within a TAG? I am creating different level TAGs, where I have a lower level containing specific s... by mrcassout New Member in Splunk Search 11-20-2019 0 2	0	2
Error while joining two lookups based on condition Hi , I want to join the two lookups based on one field that I am creating conditionally in the second lookup. So, Lo... by rohankin New Member in Splunk Search 11-20-2019 0 3	0	3
How to check if Data in a Lookup Table does not exist in another Index I am creating a query to check if a list of accounts owned by our team exists and with correct privilege type in anot... by mgbersales Loves-to-Learn in Splunk Search 11-20-2019 0 2	0	2
Field Extraction Hi All, I want to extract the log to be extracted from error message till : message : , but not getting it, I have tr... by shivam_j New Member in Splunk Search 11-19-2019 0 7	0	7
Where can I find information about searches that reach their max_mem_usage_mb limit? Hello, After debugging a search I discovered that the max_mem_usage_mb limit on my system had been reached. A chang... by andrewtrobec Motivator in Splunk Search 11-19-2019 0 0	0	0
Splunk Certified User (認定試験) Splunk Certified User 認定試験は日本語で受けられますか？ by amifune_splunk Splunk Employee in Splunk Search 11-19-2019 1 1	1	1
Returned Results of "0" when event count > 0 I am writing a custom dashboard that shows the number of alerts based on severity. The severities are Critical, High... by willadams Contributor in Splunk Search 11-19-2019 0 5	0	5
dnslookup very slow, odd results. (Splunk 7.2.3) I have a single windows domain. Inside that domain I have 2 subnets, 192.168.1.x, 192.168.2.x. I have ... by oliverj Communicator in Splunk Search 11-19-2019 1 6	1	6
Filter by token only if token is present I want to display all of my widgets by their type. Sometimes though, I want to look up a particular widget (via a tex... by stevedefazio Explorer in Splunk Search 11-19-2019 0 3	0	3
How to insert empty lines in the field before and after a specific pattern? Hello, I have a column / field called LINE that consists of the several text lines. I would like to format it a bit ... by damucka Builder in Splunk Search 11-19-2019 0 5	0	5
Splunk Rex: Extracting fields of a string into a Column I'm a newbie to SPlunk REX trying to do some dashboards and need help in extracting fields of a particular variable i... by rczone Path Finder in Splunk Search 11-19-2019 0 7	0	7