Splunk Search

Community Activity

Cumulative Distinct over time from the start of the selected time range Hi, I need to find out distinct number of users over time per hour. I have managed to reach the below query: \| time... by cbhattad Path Finder in Splunk Search 10-14-2019 1 4	1	4
Unable to filter out lookup table values I'm trying to filter out false-positive domains in a search of DNS events by using NOT on the ut_domain field of the ... by browncardigan Path Finder in Splunk Search 10-14-2019 0 4	0	4
How to convert _time to mm/dd/yyyy Day H:M:S AM/PM My _time format reads 2019-10-13 04:19:21 I try to convert this _time value to the format mm/dd/yyyy day h:m:s AM or ... by vnguyen46 Contributor in Splunk Search 10-14-2019 0 4	0	4
Display job time with total run and runtime of subtasks I am not sure the best way to ask this but we have a job with subtasks, and the subtasks have subtasks. I wanted to g... by aohls Contributor in Splunk Search 10-14-2019 0 1	0	1
access search results for search upon login Hi, Sorry, a very n00b question and i apologise if this is in the doco but i couldnt find anything in the search doc... by sdewar83 Path Finder in Splunk Search 10-14-2019 0 2	0	2
How do I get Automatic Lookup to handle null value lookups? My automatic lookup csv file is using say 2 columns; Col1 & Col2. Row entries are 'Success' & 'Failure' in Col1. Co... by khudson3 New Member in Splunk Search 10-14-2019 0 13	0	13
Routing data to specific index based on REGEX on Heavy forwarder , regex expression is from JSON data. Hi All, Unable to route the json logs based on a a keyword (regex ) "MyService_DataApp" on the event to a particula... by mahesh423 Explorer in Splunk Search 10-14-2019 0 3	0	3
How to get aggregate total of 3 months of response times in chart I've created a search to chart the average response times of each application over the past 3 months. How would I ge... by fisuser1 Contributor in Splunk Search 10-14-2019 0 1	0	1
How to track the bundle size on indexers over time Hi all, I wanted to set up an alert to monitor the bundle size if the size is about to reach the limit. I am able to... by splunkrocks2014 Communicator in Splunk Search 10-14-2019 0 7	0	7
How to combine multiple time fields in order to create a full date for an event occurrence I currently have 3 different fields that contain parts of a date that must be put together to give a full time. I hav... by asewell97 New Member in Splunk Search 10-14-2019 0 3	0	3
show top 5 CPU Usage vom VMware Hosts Hi Splunkies, this is my search: index="vmware-perf" sourcetype="vmware:perf:cpu" hypervisor_id="*" \| join hyperviso... by pduvofmr Path Finder in Splunk Search 10-14-2019 0 12	0	12
How to ignore concrete rows from csv file before indexing? Hi, I spent really a lot of time, but found no solution. Here is my problem. There is CSV file, which should be inde... by spisiakmi Builder in Splunk Search 10-14-2019 0 3	0	3
search down sevices Hi , I have a list of services in my oracle server , i want to control the status of this services (Services Up and ... by aalaa Path Finder in Splunk Search 10-14-2019 0 2	0	2
How to combine foreach command with lookup data? Hello, In order to clean our filtering rules we'd like to check if some of our old URL's are still in use (an if yes... by AlexeySh Communicator in Splunk Search 10-14-2019 0 5	0	5
Transposing a table with _time as header and grouping the results Hello all, I currently have a search that produces the following output: This is the result of multiple append an... by dojiepreji Path Finder in Splunk Search 10-14-2019 0 2	0	2
Custom iplocation We are currently the implication command to external IP addresses and it works great. Is it possible to create a cus... by pjohnson1 Path Finder in Splunk Search 10-14-2019 0 1	0	1
split columns with multiple values and make into row Hi, I have a query output which have many fields out of which only 2 fields have more than one values. So when thos... by surekhasplunk Communicator in Splunk Search 10-14-2019 0 3	0	3
Charts over X-days Good Day Team, I started reading on Splunk today and I have began my exercises. I am stuck on how to generate charts... by masambaghost Explorer in Splunk Search 10-14-2019 0 4	0	4
Timechart values using an eval field Hello all, I have a search that goes like this: index="_internal" (ticket_type="Incident") (classification="level-... by dojiepreji Path Finder in Splunk Search 10-14-2019 0 1	0	1
How to search values from stats to output other stats Hi, I'm new to Splunk and I'm trying to make the following search work: Search: \| >= 50 document queries from the ... by n00ber Engager in Splunk Search 10-14-2019 1 3	1	3
How to change alignment of String to right side Hi splunkers, After generating the table the columns having string datatype will automatically aligned to left side ... by SanthoshSreshta Contributor in Splunk Search 10-13-2019 0 3	0	3
How to list all sourcetypes I am trying to list all sourcetypes in an index using dc Using index="test" \| stats dc(sourcetype) as sourcetypesonl... by ialahdal Path Finder in Splunk Search 10-13-2019 1 2	1	2
Only one value from subsearch being used by parent I would like all the results from a field extraction in search "A" to be used as search criteria in search "B". I am ... by 775149 New Member in Splunk Search 10-13-2019 0 2	0	2
How to use regex to look for hosts from /24, /25, and /26 subnets? I have a dozen /24 subnets that I am looking to find any IP addresses on that subnet in my search as well as a addres... by rholm01 Explorer in Splunk Search 10-13-2019 0 2	0	2
How to calculate a value from 2 different sources? I am pretty new to splunk. It would be great if someone can help me with a search command. I have productId as one of... by kirthi_d Engager in Splunk Search 10-13-2019 0 4	0	4