Splunk Search

Community Activity

How to get sum of field based on it's value? Hi, I would be grateful for any help. In my fields we are having two fields which are: data.user_id and data.confi... by swdowiarz Path Finder in Splunk Search 09-23-2019 0 6	0	6
Time difference by grouping identical events Suppose I have the following events. 2019-09-20 01:40:09 INFO Listener processing event with message key A1:B1:C1... by peeeeeeeeeeter Engager in Splunk Search 09-23-2019 0 1	0	1
Field extract and zip them. (product=X Phone , 512 ГБ, золотой,shipMethodCode=E3,qty=1,deliveryType=STH,partNumber=MRU/A,deliveryDate=4 Окт - 11 ... by sandeepmakkena Contributor in Splunk Search 09-22-2019 0 4	0	4
Append the columns of a search onto the results of another search many times [lookup, but for a search] Search A returns many events for each ID. Search B returns a single event for each ID. My end result is a table wit... by ccunov New Member in Splunk Search 09-22-2019 0 6	0	6
Find the date on max value I have a table below, how can I find the date I have the most income? Thanks. date Income 9/18/2019 20... by jgan New Member in Splunk Search 09-22-2019 0 2	0	2
custom generating command 'Command xxx appears to be statically configured for search command protocol version 1' I am attempting to use custom generating command protocol version 2, but my command seems to be detected as version 1... by pmeyerson Path Finder in Splunk Search 09-21-2019 0 0	0	0
eval, if, len, substr to produce specific results So far, I've had success with the following command: eval Port=if(len(Port)>=22,substr(Port,1,len(Port)-2),Port) ... by noob4now New Member in Splunk Search 09-21-2019 0 1	0	1
Account Lockouts Report for Active Directory Hello, I'm running the following search that gives me accounts that get locked out and targets the specific domain c... by brookshelpdesk Engager in Splunk Search 09-20-2019 0 3	0	3
How to remove certain values from table column? I have a extracted a field, which has mutiple values applname = app1, app2 , app3 when i form a table with applnam... by ashanka Explorer in Splunk Search 09-20-2019 0 1	0	1
How to extract latest event for unique account numbers? Hello, I'm trying to extract some fields for the latest event based on unique account numbers. I've tried using late... by srive326 Explorer in Splunk Search 09-20-2019 0 3	0	3
Most recent event per host ( \| Head 1)? So I need to pull only the most recent event from each of 60+ hosts, and put them in a table. I'm thinking something ... by marquiselee Path Finder in Splunk Search 09-20-2019 1 5	1	5
Config Documentation Sites Not Opening When one searches a config on Google, e.g. props.conf, the first result is almost always the page you'd want. However... by morethanyell Builder in Splunk Search 09-20-2019 0 6	0	6
Eval Calculate fields with null values Hello, I am attempting to run the search below which works when all values are present "One, Two, Three, Four" but wh... by cooperjaram Engager in Splunk Search 09-20-2019 0 4	0	4
splunk pager duty integration How can I troubleshoot why this is not working? I'm seeing the alert firing in Splunk and a log event showing that it... by Prakash493 Communicator in Splunk Search 09-20-2019 0 1	0	1
Alternative to Join Subsearch to avoid 50k results limit I can use the following search to get 1 day worth of data, but anything longer causes the subsearch to hit its limit.... by mjhermansky New Member in Splunk Search 09-20-2019 0 3	0	3
Stats aggregation with potentially a eval-where clause is ideal I am trying to work a set of data that looks like this: I want to display it like so: My problem is getting the ... by thulasikrishnan Path Finder in Splunk Search 09-20-2019 0 4	0	4
Conditional searches in the same search Hello ! Is there a way to do conditonal searches depending of the result of a first search ? I mean, here is an exem... by julienlance Explorer in Splunk Search 09-20-2019 0 4	0	4
How to search last event before specific time I have a search that has a join in it. I want to use the first search event timestamp to dynamically find the "last ... by l0gik Explorer in Splunk Search 09-20-2019 0 2	0	2
How to embed a Splunk element inside an HTML element (e.g. in a table) For some custom UI improvement, I need to arrange Splunk input elements in a certain way, e.g. align them horizontall... by benholfeld New Member in Splunk Search 09-20-2019 0 2	0	2
Bar Chart Line length change My current search output showing the following result, for one entry it is greater than the rest. I want to show th... by ayush1906 Communicator in Splunk Search 09-20-2019 0 4	0	4
Performant method for referring to original event field values after aggregation? I am working with computer systems—for this question, the type of systems is not important—that forward events to Spl... by Graham_Hanningt Builder in Splunk Search 09-19-2019 0 4	0	4
Can we hide certain values of data like account number? Dear Team, As per my requirement i need to make few sensitive client data not visible. Can we do something like acc... by santosh11 New Member in Splunk Search 09-19-2019 0 2	0	2
How to calculate the difference of two searches Following is my splunk search : index=main "rest/bi/applicationStatus" Action_Response_Time>1 earliest=-1h \| eval ... by salavilli0611 New Member in Splunk Search 09-19-2019 0 6	0	6
How to sort dynamic column names by time? For a data set like this: stage=Cstage1 status=h1_status1 host=host1 _time=time1 stage=Astage2 status=h1_status2 hos... by yuanliu SplunkTrust in Splunk Search 09-19-2019 0 0	0	0
Missing field values in report We have logs in the following format[1]. We created a report with few fields like time, service, operation, method, p... by pdantuuri0411 Explorer in Splunk Search 09-19-2019 0 9	0	9