Splunk Search

Community Activity

Unable to calculate a difference after using mvindex with _time field I am using a transaction to combine events and I want to calculate the difference in time between the two events. I a... by tewarbit New Member in Splunk Search 08-05-2019 0 3	0	3
eval calculations how to solve the above issue using eval function. (1 * 100) / (1 + 2) = % . by Dsrao12345 New Member in Splunk Search 08-05-2019 0 2	0	2
AD FS ip field extraction Stuck on regex question for Ad FS logs. I am trying to extract all ips following a field ("Client IP: ") in a AD FS ... by jig004 Engager in Splunk Search 08-05-2019 1 2	1	2
Convert Transaction Search I made the following search to group exceptions together that happened within 1 second but I want to be able to view ... by bah5663_98 Explorer in Splunk Search 08-05-2019 0 2	0	2
Read CSV and use with index info (first four rows) JOB_NAME,Description ATUALIZACAOATIVOS,BATCH-PRO-AGRO BLOQUEIO-EMISSORES,BATCH-PRO-AGRO CONCATENAPD... by nsantiago17 Explorer in Splunk Search 08-05-2019 0 2	0	2
Timechart fillnull with append search So, I'm trying to come up with a way to compare data from this year and last year into a Single Value Graph but I am ... by ecedwards Engager in Splunk Search 08-05-2019 0 1	0	1
I am getting mostly info=denied events for specific users while searching for _audit index. While user can no longer query any indexes. Does that info indicates permission issues? or something else. I am getting info=denied events for specific users while searching for _audit index. What is the significance of this... by pateriaak Explorer in Splunk Search 08-05-2019 0 3	0	3
How to generate a search to find which Splunk user and URL is generating queries? I need queries like: which Splunk user generating the query? Output need [ Username, Time, Search Query] Which Sp... by dpraveen88 Explorer in Splunk Search 08-05-2019 0 3	0	3
Help with creating an earliest/latest event table (Using Splunk 6.1.2 for...reasons) Background: We send out a push notification to a third party. The third party som... by katharsys Path Finder in Splunk Search 08-05-2019 0 6	0	6
Use of Lookup with search query Hi, I need some help related to a search query. My search query has a field called "holdings" which contain data like... by Shashank_87 Explorer in Splunk Search 08-05-2019 0 3	0	3
Can someone help me with Regex or rex command? I have a field name called Column1 with the following data below... Data1: \|Transitioned to:Team1\|Transition Reason:... by trem0re09 Explorer in Splunk Search 08-05-2019 0 6	0	6
Difference between _time and -indextime Hi, We have splunk UF installed on our streamers. The splunk UF sends logs to splunk forwarder of our analytics set... by strive Influencer in Splunk Search 08-05-2019 1 8	1	8
How to calculate date based upon a patch lot value. How can we apply below logic in splunk. We have the data in Splunk which is coming out as below. Host Patching L... by sbhatnagar88 Path Finder in Splunk Search 08-05-2019 0 2	0	2
how to copy of entire splunk instances to another instance? Hii Everyone, I want to move all the knowledge objects and everything from one splunk instance to another instance...... by marisstella Explorer in Splunk Search 08-05-2019 0 5	0	5
Extract Fields Apache Logs Hi i have raw data like this: 192.0.100.3 - - [30/Jul/2019:00:06:05 -0500] "GET /test/ HTTP/1.1" 403 207 "-" "Mozill... by miguelebf New Member in Splunk Search 08-04-2019 0 2	0	2
column name updated how to keep both query results ini same dashboard Hi, index="spectrum" * \| eval foo=_cd \| rename "ns1.alarm.ns1.attribute{}.$" as value "ns1.alarm.ns1.attribute{}.@i... by surekhasplunk Communicator in Splunk Search 08-04-2019 0 4	0	4
Discrepany in total count Hello guys, I have the following syntax and data: However, there is a discrepancy with the total count per catego... by chinkeeparco Explorer in Splunk Search 08-04-2019 0 10	0	10
How to produce multiple values graphs We have a log of some metrics that look like this: 20:45:00 10.10.71.01 values : [12035313, 233658, 0, 0, 24249, 13... by jhuysing Explorer in Splunk Search 08-04-2019 0 6	0	6
Help with Regex extracting fields Can someone please help with extracting the bold highlighted field from below /07981368-d226-4cf6-8d88-9853c843bcb9... by saikumarsplunkt New Member in Splunk Search 08-04-2019 0 1	0	1
Optimize repeat searches in append I have a search in below format: index=xyz sourcetype=abc...\|table code... \|join code[search index=def ....] \|where... by harshal_chakran Builder in Splunk Search 08-04-2019 0 7	0	7
timechart is continous - cannot ignore the timeframe of missing events. one of our dashboards were using below query \| timechart count span=1d cont=false in 6.6.4 Splunk enterprise, we cou... by praphulla1 Path Finder in Splunk Search 08-04-2019 0 8	0	8
Display timechart by adding values from other panels I have 3 panels. Each panel runs a query and displays the result in timechart. This works fine. Now , I would like t... by balash1979 Path Finder in Splunk Search 08-04-2019 0 8	0	8
How to combine chart count for two fields in one search Hi, Can any one help me adding two fields in one search I am seeing both fields in splunk selected fields but not s... by monipinni Explorer in Splunk Search 08-04-2019 0 2	0	2
How can I refine this search string to grab those for the whole year and add other Splunk commands to break them into common ‘buckets’ with counts for each type of error without duplicate error types? How can I refine this search string to grab those for the whole year and add other Splunk commands to break them into... by belamg New Member in Splunk Search 08-04-2019 0 2	0	2
help with CASE needed I have the following example: \|makeresults \| eval trigger=0\|eval decision=case(trigger=1;[\|savedsearch test\|eval t=1... by damucka Builder in Splunk Search 08-03-2019 0 3	0	3