Splunk Search

Community Activity

How to dynamically set an index based on a string in events with a fallback option? I have some logs where there are events that are like this: Apr 5 21:16:33 myhost001.company.com key=value key2=va... by Ricapar Communicator in Splunk Search 08-21-2019 0 6	0	6
Logs are getting truncated after the forwarding has been setup into splunk The data in event 1 is incomplete and the rest of it is getting populated into event2 and so on . If i am not wrong ,... by Sujithkumarkb Observer in Splunk Search 08-21-2019 0 0	0	0
Failed to parse templatized search for field.... Hi. I wonder whether someone may be able to help me please. I'm using the query below: \| multisearch [ search `gat... by IRHM73 Motivator in Splunk Search 08-21-2019 0 3	0	3
Lookup Table search wildcards I have created a lookup table, service.csv host,service,resource "host1","fdl","all" "host2","finance","db" "host3... by balcv Contributor in Splunk Search 08-20-2019 0 2	0	2
Return Timestamp from inner and outter search Hi, I am trying to create a search that finds two sequential events. So far I have: index=wineventlog EventCode=462... by shayvdee Explorer in Splunk Search 08-20-2019 0 4	0	4
Get a total for a multivalue field by multiple fields Greetings, I'm trying to get multiple totals for multiple fields. My current query incorporates \| stats count as ... by cquinney Communicator in Splunk Search 08-20-2019 0 3	0	3
How can I extract a license file from existing license volume Hi, I am trying to extract a license file from our current license pool. All I could see is the delete option for th... by divyamudundi Path Finder in Splunk Search 08-20-2019 2 4	2	4
XML Parsing Props.conf Any help is appreciated in parsing the following xml data retrieved from DB connect input. We just need the Name an... by uvmk61 New Member in Splunk Search 08-20-2019 0 5	0	5
help with tstats and eval Hi, I'm trying to count the number of events for a specific index/sourcetype combo, and then total them into a new f... by a212830 Champion in Splunk Search 08-20-2019 0 1	0	1
How to search for data Hello there, In our company we've been using Splunk for a while now but I think we use it not to it's full potential... by juanherrera Explorer in Splunk Search 08-20-2019 0 7	0	7
Do math on this period's numbers versus last period's I'd like to build an alert that essentially says "if the count from this hour is more than twice, or less than half, ... by shulmaniel New Member in Splunk Search 08-20-2019 0 3	0	3
Multiple stat intervals over a large dataset/summary index We have logging with user data for the requests each use does. We have created some averages and dashboards with this... by aohls Contributor in Splunk Search 08-20-2019 0 4	0	4
How to get Stats from Search and Average? This is probably quite simple and I am missing something.. i am using this search. index=sxxx sourcetype=sxxx host=... by jpsquires New Member in Splunk Search 08-20-2019 0 3	0	3
use of tstats instead of stats I am trying to iterate through 16million data and trying to use tstats instead of stats... please help me out in conv... by vikashperiwal Path Finder in Splunk Search 08-20-2019 0 6	0	6
i am seeing this entry over 30000 times a minute - KLM\software\policies\microsoft\systemcertificates\disallowed\crls this is one of the events i am seeing and we are trying to figure our why only 20-30 servers are doing this 08/20/20... by rmcmillin New Member in Splunk Search 08-20-2019 0 0	0	0
Table view in dashboard Hi i am trying to create a Dashboard. i need some assistance on creating a table format. i have some executions like... by venkat0896 Path Finder in Splunk Search 08-20-2019 0 10	0	10
Compare two fields to pull data Hello, I currently have a search running on two different indexes pulling different fields. There is one field cal... by nlisle New Member in Splunk Search 08-20-2019 0 2	0	2
How to start transaction with the earliest event I need to document a transaction that begins with a multithreaded process. The process creates multiple entries in a... by jasongb Path Finder in Splunk Search 08-20-2019 0 12	0	12
Find how many times source type stopped sending data with in a month? Have to find a source type how many times it is not sending data to index within a month or some period of time Than... by Reddi694325 Path Finder in Splunk Search 08-20-2019 0 1	0	1
get process time and group by status Hello everyone I'm using this query `\|eval Status = case (eventId="endProcess" ,"Completed" ,eventId="error","Term... by hazemfarajallah Explorer in Splunk Search 08-19-2019 0 6	0	6
How do I get a list of users who can log into splunk? All, Is there an Api call or search I can run to get a list of users who can log into Splunk? bonus points if we ca... by daniel333 Builder in Splunk Search 08-19-2019 0 1	0	1
Error in 'rex' command: Invalid argument: ' ' -- How do I fix this issue? Hi, I have a daily search that suddenly stopped working (upgraded from 6.7 to 7.1 before it stopped working, I believ... by russell120 Communicator in Splunk Search 08-19-2019 0 6	0	6
How to get duration for a transaction with multiple start and end points? Hi, I'm looking to get a duration for a transaction that has multiple pairs of StartsWith and EndsWith conditions. ... by amunag439 Explorer in Splunk Search 08-19-2019 0 1	0	1
subsearch to combine multiple queries and sum up example log data project_name=abc category=xyz job_id=1 stage_begin=compile time=2019-08-16 15:00:00 project_name=ab... by vanakkam New Member in Splunk Search 08-19-2019 0 10	0	10
How to create an alert when searched index has no data I have the following search, and i want to be able to only show the indexes that have 0 data during a specified time ... by dmws New Member in Splunk Search 08-19-2019 0 4	0	4