Splunk Search

Community Activity

How to create difference of two values Q1: How can I get c4 where c4 will always be the difference of values in c3 against max of c2 - min of c2 For exampl... by reverse Contributor in Splunk Search 06-04-2019 0 15	0	15
Calculating percentages based on counts I'm trying to get percentages based on the number of logs per table. I want the results to look like this: Table ... by hduncan7 Engager in Splunk Search 06-04-2019 0 3	0	3
Using dedup to keep the oldest events Hi all, I know that the "dedup" command returns the most recent values in time. However, I'm currently in a situatio... by acdevlin Communicator in Splunk Search 06-04-2019 0 7	0	7
subsearch inserts AND My ultimate goal is to grab the srcIP and time from an event in one index, then search another index for the same src... by mikefoti Communicator in Splunk Search 06-04-2019 0 2	0	2
How to create time dependent thresholds from lookup? Hello, I have a question on using lookups in a search. I want to achieve that I have a scheduled search to compare t... by willemjongeneel Communicator in Splunk Search 06-04-2019 0 5	0	5
How to get an average from this search? I'm using the following search which I have working in a dashboard. "A PUT was made to OpenAAA API - Status: OK" \| ... by kvanwagoner New Member in Splunk Search 06-04-2019 0 19	0	19
help with multiple search in one SPL needed Hello, I have the following search: index=_internal sourcetype=scheduler savedsearch_name="Anomaly Detection - new-... by damucka Builder in Splunk Search 06-04-2019 0 8	0	8
Comparing Field Value with last Month Value and show if different Hi , I need help with following Log : 5th May device="devicename" policy="XYZ" BW_Limit="any number" Total_BW="any ... by atulitm Path Finder in Splunk Search 06-04-2019 0 5	0	5
How to search IP with wildcard? I want to exclude both primary and secondary IP addresses from a search. For example: src_ip!=192.50.244.10 AND src... by mveca New Member in Splunk Search 06-04-2019 0 4	0	4
Using token in query where token is evaluated in the query itself I have the following query to be performed, where "STRING" is replaced across different queries. Is there a way to re... by denzelchung Path Finder in Splunk Search 06-04-2019 0 4	0	4
How to access fields within a subsearch / Inputlookup I cannot figure out how to use a variable to relate to a inputlookup csv field. service_tier.csv region, plan, pri... by wrussell12 Explorer in Splunk Search 06-04-2019 0 3	0	3
Special fillnull? Polulate null values with evaluated calculations This is my code index="google_apis" source="https://www.googleapis.com/youtube" \| timechart span=1h avg(subCount) ... by morethanyell Builder in Splunk Search 06-04-2019 0 4	0	4
Why is the same search producing different results? First off, before I even ask, let me state that using Splunk on Splunk is not a solution for us as we are trying to p... by EricLloyd79 Builder in Splunk Search 06-03-2019 0 3	0	3
I am trying to combine three indexes using left join but not all the values are showing up even though the data exists. index=A \| stats count by host ID \| eval ID=upper(ID) \| rename host as HOST, ID as USERID, count as LOGIN_FAILURES \| j... by dogaasad New Member in Splunk Search 06-03-2019 0 1	0	1
Extract access_combined from JSON msg field Hello! I have JSON events coming from Pivotal Cloud Foundry. Included in the JSON is the 'msg' field which includes... by johnansett Communicator in Splunk Search 06-03-2019 0 1	0	1
How to create a string that produce a weeks worth of averages? How would I create a result like below: in avg(v2) of Last week and avg(v2) of current week Please guide. Thanks. ... by reverse Contributor in Splunk Search 06-03-2019 0 2	0	2
How to extract multiple values for multiple fields within a single event? I have nessus data for Installed Windows Updates (PluginID 52001). Here is a list of quick-fix engineering updat... by rayaivy Explorer in Splunk Search 06-03-2019 0 2	0	2
Having sum function issues after entering multiple names on index Hi, I'm having a problem trying to sum all the "marcador05" and the others by Country when I put one country name on ... by nsantiago17 Explorer in Splunk Search 06-03-2019 0 0	0	0
How to to plot Cluster/Choropleth map with source data (hostname only) Created a lookup file with static Latitude and Longitude for 2 countries and used this search: \| inputlookup test_g... by rashi83 Path Finder in Splunk Search 06-03-2019 0 5	0	5
Add a (sparkline) to a (table) Is it possible to add a sparkline to a table? Most examples list stats or charts, but nothing about tables, which mak... by albyva Communicator in Splunk Search 06-03-2019 0 4	0	4
Does zooming out on timeline re-execute search? I was watching the Splunk Fundamentals 1 videos and they state that when zooming in on the timeline the same search i... by kamryn Explorer in Splunk Search 06-03-2019 0 2	0	2
How to get the actual Query from SID? Hello Community, I have the sid from splunkd.log. Now I would like to know if there is any way to get the actual que... by sudheerchamarth Explorer in Splunk Search 06-03-2019 0 6	0	6
How to use line breaking regex for Shibboleth audit logs? We are using Kafka Connect and we just started to ingest Shib audit logs. I am getting a bunch of events all rolled i... by jwalzerpitt Influencer in Splunk Search 06-03-2019 0 2	0	2
srtemp folder issue Hi All, Can we delete the files which are located in srtemp folder it is using huge space by x1045866 Explorer in Splunk Search 06-03-2019 1 0	1	0
Possible bug in value of $latest$ of previous business week Hi, On my dashboard I have a time picker. When I choose previous business week then its $earliest$ contains -6d@w1 a... by fjp2485 Engager in Splunk Search 06-03-2019 0 0	0	0