Splunk Search

Community Activity

Total Logon Count for Each month Hello Splunk Gurus I need help with the following. I am sure it is pretty simple command but my head stopped working... by carlyleadmin Contributor in Splunk Search 07-10-2019 0 3	0	3
Are there any use cases that justify the over-head of automatic lookups? Our team discourages all users from using automatic lookups due to the over-head incurred in each search query. Ar... by ddrillic Ultra Champion in Splunk Search 07-10-2019 1 3	1	3
data set linking I need help to link the provided dataset with link enterprise on windows. the interface is not getting any reports fr... by ngangaedward New Member in Splunk Search 07-10-2019 0 0	0	0
timechart of a sliding window count I need a timechart that counts the number of distinct fieldx where that fieldx has more than x events in that span/bi... by pr0n Explorer in Splunk Search 07-10-2019 0 2	0	2
Display data in a table based on fields. I have 3 fields in my table. Store_id Minutes Date 1234 40 07/06 1232 50 07/07 1234 60 07/07 1232 70 07/06 I w... by nikita012 New Member in Splunk Search 07-10-2019 0 2	0	2
How do I get addtotals to exclude one of the column? I need to addtotals to exclude one of the columns created as a result of chart command. P.S: I need exclusion, not i... by pkaarana New Member in Splunk Search 07-10-2019 0 7	0	7
how do I change label name on legend for a graph? Hi, We've our JSON code that send to Splunk. Everything is working great as expected, but I would like to know how ... by matoulas Path Finder in Splunk Search 07-10-2019 0 4	0	4
How to sum the numbers based on a condition and store it in new field? Requirement - account_no can have many session_no and session_no can have many sub_session_no. For each session, I wa... by amaurya1 Explorer in Splunk Search 07-10-2019 0 2	0	2
Splunk 'mail merge', how could I substitute 'named text' in a field with values from other fields Hi, In short, just wondering if anyone has used Splunk for 'mail merging' I have a dynamically generated field cont... by splunked38 Communicator in Splunk Search 07-10-2019 0 0	0	0
Increase the size of a sparkline that is part of a single value visualization. I have a dashboard with a single value sparkline based off a timechart: index=[theindex] event_name=[theevent] \| ti... by SplunkHorse New Member in Splunk Search 07-10-2019 0 2	0	2
Pie-chart with count from different search criteria Hi All, I'm trying to create a pie chart where i'v 2 search result sets from different condition and different source... by habisht Explorer in Splunk Search 07-10-2019 0 3	0	3
Timechart avg of values greater than 0 I'm building a time chart of avg daily backup volume, and I need to exclude entries where volume = 0. The reason be... by codedtech Path Finder in Splunk Search 07-10-2019 0 1	0	1
show empty table instead of no results found hello splunk communitie, i am new to splunk but found allot of information allready but i have a problem with the giv... by jeroenborger Explorer in Splunk Search 07-10-2019 0 2	0	2
Compare results from yesterday to today Hello Splunkers. Yesterday I don't have events but today I have it. For example: Event aaa today exists 100 times ... by rjfv8205 Path Finder in Splunk Search 07-10-2019 0 0	0	0
Can I use the "IN" command like this? index=myIndex FieldA="A" AND LogonType IN (4,5,8,9,10,11,12) The documentation says it is used with "eval" or "wher... by twjack Explorer in Splunk Search 07-10-2019 0 2	0	2
Search Query Help: Number of Events per Event Code and Total size of those events Hey All, I am trying to calculate the number of events per EventCode along with the total size in kb/mb of all event... by adalbor Builder in Splunk Search 07-10-2019 1 6	1	6
How to subtract specific events, key pairs? Not sure where I should be going but, I am all for raw data going into fields, enhanced etc... I am looking at our ra... by cxfuent29 New Member in Splunk Search 07-10-2019 0 5	0	5
How to dynamically add results / correlate in a search with a sub-search I want to dynamically add fields to my result set depending on a search I did. How do I can add fields/new columns b... by bahndg Explorer in Splunk Search 07-10-2019 0 2	0	2
What kind of request you need to create to select all the logs in which all fields are filled? What kind of request you need to create to select all the logs in which all fields are filled? by kaizersx New Member in Splunk Search 07-10-2019 0 2	0	2
How to filter results using fields from lookup file I have a challenge in front of me that I can't figure out. I spent a few hours searching 'answers' and made some hea... by chrisray_view New Member in Splunk Search 07-09-2019 0 3	0	3
Diff help please I have a search that returns one result, one of the fields is called whatchanged, and this field really has two value... by mcbradford Contributor in Splunk Search 07-09-2019 0 1	0	1
How can I make a table for multiple Windows Events ? How can I make a table for multiple Windows Events ? This search gives me good results for one Event Code, but I hav... by itrimble1 Path Finder in Splunk Search 07-09-2019 0 2	0	2
Need help with a regex I am terrible with regexes. What regex would I need to extract "pdf" from the following? This was not pulling all ev... by bwindham Path Finder in Splunk Search 07-09-2019 0 2	0	2
Is there a way to get addcoltotals to show up at the top of a report, rather than at the end? I have a report that reports the count of events per another field. I can get a total of all of these events but it ... by jbezanson Engager in Splunk Search 07-09-2019 1 5	1	5
Report from multiple indexes I need to create a report based on three different search criteria from three different sources. But since its a reco... by runiyal Path Finder in Splunk Search 07-09-2019 0 2	0	2