Splunk Search

Community Activity

Using the GUI, how can I search for events related to a specific host? I'm in the process of creating a troubleshooting guide for our networking team. I would like to be able to look up ev... by progress101 New Member in Splunk Search 06-04-2019 0 2	0	2
Can you help me do an eval for a percentage of two values in an Xyseries? I have my derived tables \| stats count by breached region \| xyseries region breached count REGION NO YES U... by TCK101 New Member in Splunk Search 06-04-2019 0 3	0	3
Dropdown input panel: Search is not changing as per dropdown selection So I created a dropdown input panel for weekwise but my search is not changing as per dropdown selection - ... we... by rashi83 Path Finder in Splunk Search 06-04-2019 1 5	1	5
Charting percentage of a total over time? I'm working with some HTTP access logs that have a status code in them. Most are successful messages, naturally. I wo... by Jason Motivator in Splunk Search 06-04-2019 5 5	5	5
playing with data II q1- how can i get c4 where c4 will always be difference of values in c3 against first of c2 - next of c2 for example ... by reverse Contributor in Splunk Search 06-04-2019 0 2	0	2
How to create difference of two values Q1: How can I get c4 where c4 will always be the difference of values in c3 against max of c2 - min of c2 For exampl... by reverse Contributor in Splunk Search 06-04-2019 0 15	0	15
Calculating percentages based on counts I'm trying to get percentages based on the number of logs per table. I want the results to look like this: Table ... by hduncan7 Engager in Splunk Search 06-04-2019 0 3	0	3
Using dedup to keep the oldest events Hi all, I know that the "dedup" command returns the most recent values in time. However, I'm currently in a situatio... by acdevlin Communicator in Splunk Search 06-04-2019 0 7	0	7
subsearch inserts AND My ultimate goal is to grab the srcIP and time from an event in one index, then search another index for the same src... by mikefoti Communicator in Splunk Search 06-04-2019 0 2	0	2
How to create time dependent thresholds from lookup? Hello, I have a question on using lookups in a search. I want to achieve that I have a scheduled search to compare t... by willemjongeneel Communicator in Splunk Search 06-04-2019 0 5	0	5
How to get an average from this search? I'm using the following search which I have working in a dashboard. "A PUT was made to OpenAAA API - Status: OK" \| ... by kvanwagoner New Member in Splunk Search 06-04-2019 0 19	0	19
help with multiple search in one SPL needed Hello, I have the following search: index=_internal sourcetype=scheduler savedsearch_name="Anomaly Detection - new-... by damucka Builder in Splunk Search 06-04-2019 0 8	0	8
Comparing Field Value with last Month Value and show if different Hi , I need help with following Log : 5th May device="devicename" policy="XYZ" BW_Limit="any number" Total_BW="any ... by atulitm Path Finder in Splunk Search 06-04-2019 0 5	0	5
How to search IP with wildcard? I want to exclude both primary and secondary IP addresses from a search. For example: src_ip!=192.50.244.10 AND src... by mveca New Member in Splunk Search 06-04-2019 0 4	0	4
Using token in query where token is evaluated in the query itself I have the following query to be performed, where "STRING" is replaced across different queries. Is there a way to re... by denzelchung Path Finder in Splunk Search 06-04-2019 0 4	0	4
How to access fields within a subsearch / Inputlookup I cannot figure out how to use a variable to relate to a inputlookup csv field. service_tier.csv region, plan, pri... by wrussell12 Explorer in Splunk Search 06-04-2019 0 3	0	3
Special fillnull? Polulate null values with evaluated calculations This is my code index="google_apis" source="https://www.googleapis.com/youtube" \| timechart span=1h avg(subCount) ... by morethanyell Builder in Splunk Search 06-04-2019 0 4	0	4
Why is the same search producing different results? First off, before I even ask, let me state that using Splunk on Splunk is not a solution for us as we are trying to p... by EricLloyd79 Builder in Splunk Search 06-03-2019 0 3	0	3
I am trying to combine three indexes using left join but not all the values are showing up even though the data exists. index=A \| stats count by host ID \| eval ID=upper(ID) \| rename host as HOST, ID as USERID, count as LOGIN_FAILURES \| j... by dogaasad New Member in Splunk Search 06-03-2019 0 1	0	1
Extract access_combined from JSON msg field Hello! I have JSON events coming from Pivotal Cloud Foundry. Included in the JSON is the 'msg' field which includes... by johnansett Communicator in Splunk Search 06-03-2019 0 1	0	1
How to create a string that produce a weeks worth of averages? How would I create a result like below: in avg(v2) of Last week and avg(v2) of current week Please guide. Thanks. ... by reverse Contributor in Splunk Search 06-03-2019 0 2	0	2
How to extract multiple values for multiple fields within a single event? I have nessus data for Installed Windows Updates (PluginID 52001). Here is a list of quick-fix engineering updat... by rayaivy Explorer in Splunk Search 06-03-2019 0 2	0	2
Having sum function issues after entering multiple names on index Hi, I'm having a problem trying to sum all the "marcador05" and the others by Country when I put one country name on ... by nsantiago17 Explorer in Splunk Search 06-03-2019 0 0	0	0
How to to plot Cluster/Choropleth map with source data (hostname only) Created a lookup file with static Latitude and Longitude for 2 countries and used this search: \| inputlookup test_g... by rashi83 Path Finder in Splunk Search 06-03-2019 0 5	0	5
Add a (sparkline) to a (table) Is it possible to add a sparkline to a table? Most examples list stats or charts, but nothing about tables, which mak... by albyva Communicator in Splunk Search 06-03-2019 0 4	0	4