Splunk Search

Community Activity

Best way to format out time field for average time I am using the linux time command to see how long it takes to run a process. My logs show as runtime=0m0.000s So ex... by agentguerry Path Finder in Splunk Search 10-07-2019 0 1	0	1
Problem calculating fields at index time when input csv fields are all quoted I was wondering if anyone knows about the next, and if there’s any solution: I have tried to calculate two fields at... by cajose3pepe New Member in Splunk Search 10-07-2019 0 2	0	2
CSV empty quoted field extraction problem Hi there, I have the next CSV file: "CLM_TIMESTAMP","CLM_DATE","CLM_NUMBER" "1569301200","24/09/2019 00:00:00","389... by cajose3pepe New Member in Splunk Search 10-07-2019 0 3	0	3
System and Nobody had no roles I am trying to get the System access attempts with invalid credentials. Folks with unknown user names. I am using th... by dcrooks_cbp New Member in Splunk Search 10-07-2019 0 4	0	4
Timecharts and Multiple Operating Systems I'm currently attempting to make a 6 month trend of multiple OS' compliance percentages into one timechart, but am ru... by giventofly08 Explorer in Splunk Search 10-07-2019 0 5	0	5
How to search csv for values in a lookup table? I have a large csv with lots of columns and a lookup table below payload .exe .zip *.7z How do I search all fiel... by akke Explorer in Splunk Search 10-07-2019 0 1	0	1
How to use two different search time ranges in one splunk rule? I have the following scenario: I have to find events with certain specifications in the last 15 minutes, and the sear... by veromihaiu Path Finder in Splunk Search 10-07-2019 0 5	0	5
Is it possible to split lines and re-use certain fields? I have thise event: ID=FAKE_ID_NAME,TS=1570441680,F1=1380,F2=60,F3=60,F4=1500 For my analysis it would be very usef... by wvanloon New Member in Splunk Search 10-07-2019 0 4	0	4
How to combine multiple field values to create single field name in eval statement. Hi, I'm trying to combine the values of multiple fields to together form a single field name in an eval if statement... by jurjenterpstra New Member in Splunk Search 10-07-2019 0 3	0	3
Use Kafka Streams to perform Splunk Transaction Hello, My client uses an email solution that produces a log for each step in email processing, hence, we have a vari... by zineddine New Member in Splunk Search 10-07-2019 0 0	0	0
timechart sorting multiple fields I have the following query index="search_index \| timechart avg(time1) as time1_in_mins ,avg(time2) as time2_in_min... by balash1979 Path Finder in Splunk Search 10-07-2019 0 3	0	3
Matching showing incorrect values Hi guys & girls, about the following query: \| makeresults \| eval expectedm="10" \| eval expectedM="1" \| eval match=c... by RobertEttinger8 Explorer in Splunk Search 10-07-2019 0 3	0	3
Using external lookup and mstats together Hi All, I have a search like this: \| mstats span=1d sum(_value) as "ClosedTime" WHERE index=metrics_prod metric_nam... by zahorans New Member in Splunk Search 10-07-2019 0 7	0	7
Count of values in from values() function hello there, I am trying to create a search that will show me a list of ip's for logins. issue is i only want to see... by msmapper Path Finder in Splunk Search 10-07-2019 1 3	1	3
How to use Splunk ODBC driver to import an excel report to splunk? Hi All, I want to import a scheduled excel report generated from one prod system to splunk. When I manually imported... by sara91 Explorer in Splunk Search 10-07-2019 0 1	0	1
help for doing a pie chart from 2 subsearch hi I have the search below `test` [\| inputlookup host.csv \| table host \| rename host as USERNAME ] ... by jip31 Motivator in Splunk Search 10-06-2019 0 7	0	7
Good design ? so I have 1000 pages in my application .. I want to check which pages are performing poorly ... a trend .. I am thi... by reverse Contributor in Splunk Search 10-05-2019 0 5	0	5
extracting value from complex JSON Hi, need help on how to extract dat from this JSON. i have used spath to extract a part of my JSON to get this data s... by mcohen13 Loves-to-Learn in Splunk Search 10-05-2019 0 4	0	4
Return only those events who exist in consecutive time bins So I'm working on a search that returns standard network stuff and using a bin to bucket the data by a day. Something... by jpawloski Path Finder in Splunk Search 10-05-2019 0 2	0	2
Drilldown Search Removing Math Operators I am using the new Drilldown feature in Splunk Enterprise 6.6 to drilldown to a search. In the Drilldown Editor dial... by mstark31 Path Finder in Splunk Search 10-04-2019 0 3	0	3
Splunk query not giving me results HI All, Could any one help me in this on urgent basis: My query is malfunctioning : index=auto_prod_okta eventType... by punyanit Path Finder in Splunk Search 10-04-2019 0 4	0	4
Joining two queries using Append and results are different Hello Experts Actually I am trying to join the results of two queries and show in dashboard. There are 3 indexes 1a... by gopiven Explorer in Splunk Search 10-04-2019 0 2	0	2
How to generate timely fake event and compare with real event Hello all, how do I create a timely dummy event (without using "\|lookup" external file) to compare with the real gene... by egonstep Path Finder in Splunk Search 10-04-2019 0 5	0	5
What's the difference between NOT and != ? It appears to us that NOT and != are different. It seems that != <val> implies that <val> is not empty. Is it right? by danielbb Motivator in Splunk Search 10-04-2019 0 3	0	3
How to pass earliest / latest parameters to a macro from a map section ? Hello everyone, I'm stuck since many days trying to understand what is preventing Splunk from passing arguments to t... by eric_d New Member in Splunk Search 10-04-2019 0 2	0	2