Splunk Search

Community Activity

How to use join using stats by count on two different searches? Hello, I am trying to use the join by userid on 2 different sub queries using join feature, both the queries are retu... by msrama5 Explorer in Splunk Search 04-16-2019 0 2	0	2
How to create a Splunk search to find response time for API Calls? I want to calculate response time from my logs for all records and our application logs in below format, Can you plea... by mintally New Member in Splunk Search 04-16-2019 0 2	0	2
Search Help : How to list latest raw event for a field by index and sourcetype? Hi all, How to form a table to display latest raw event for field mentioned by index and source type. This is the ou... by harshal_chakran Builder in Splunk Search 04-16-2019 0 1	0	1
Can you perform an automatic lookup based on the output of another automatic lookup? I have an automatic database lookup that I'm using to pull in data on values that may change over time within my DB. ... by chris2416 Explorer in Splunk Search 04-15-2019 2 9	2	9
Can you launch a search from within a custom search command? Hello, I have already created a custom search command, Can I launch from my python scripy a search that gets me value... by MarcHelou New Member in Splunk Search 04-15-2019 0 2	0	2
How to get statistics from the same session with multiple events? There are multiple events with 1 same field - unique_session, how to combine and count events from that unique sessio... by gumarovv New Member in Splunk Search 04-15-2019 0 6	0	6
How to search for values not present in the lookup table Hi, I Have a table-1 with tracking IDs ex: 123, 456, 789 and the other query which returns a table-2 with tracking ... by akarunkumar321 Engager in Splunk Search 04-15-2019 0 19	0	19
realtime search scaling I have read about some limits you can come across when doing realtime searches. When trying to scale this out shoul... by splunkbacon Explorer in Splunk Search 04-15-2019 0 3	0	3
How to coalesce events with different values for status field? I have this search that will display the following index=autosys source= jobName= \| where statusText="SUCCESS" OR st... by x213217 Explorer in Splunk Search 04-15-2019 0 3	0	3
Why wasn't the lookup csv file replicated? We created a lookup via the outputlookup command and we can see the file under $SPLUNK_HOME/etc/apps/<app name>/looku... by ddrillic Ultra Champion in Splunk Search 04-15-2019 0 1	0	1
How to extract sourcetype using rex? Hi everyone, I have 40 source type with different names so I was wondering if i can extract sourcetype using rex. a... by splunkuseradmin Path Finder in Splunk Search 04-15-2019 1 1	1	1
Can regex remove spaces inside a capture group? I am using regex slot and port information. Here is an example of the syslog output: Slot1 : OLTPort2 Is it possib... by donemery Explorer in Splunk Search 04-15-2019 0 7	0	7
How to create a search to get count total with percentage against total count? Hi there, I have below result with this query. index="abc" Properties.CorrelationId != XYZ \| stats count by Prope... by sudheeraha Engager in Splunk Search 04-15-2019 0 3	0	3
Is it possible to sort or reorder a multivalue field? Anyone have any thoughts as to how to reorder a multi-valued field? Ideally I'd like to be able to do a "sort" or in... by Lowell Super Champion in Splunk Search 04-15-2019 4 5	4	5
How to extract particular string in the data? Hi Team, I m planning to collect the highlited text from the raw data as below info : Detailed logging to /apps/dat... by pench2k19 Explorer in Splunk Search 04-15-2019 0 10	0	10
How do i get the count of Java Threads on a particular server using Splunk? Hi, I want to calculate the Java threads on my 4 application servers. I have one query but i believe that gives all t... by Shashank_87 Explorer in Splunk Search 04-15-2019 0 2	0	2
Using MVZip and MVExpand on MultiValue fields where array sometimes doesnt exists {<!-- --> "timestamp": "2019-04-11T16:44:45.497462", "payload": {<!-- --> "KEY_CHK_DCN_NBR": "19054", "recommendations": ... by rajkumarsowmy New Member in Splunk Search 04-15-2019 0 2	0	2
How to build a chronological event list I have an index that lists (among other things) a device, event date, and level (1-4). Devices change levels at rando... by cpressl New Member in Splunk Search 04-15-2019 0 0	0	0
Eval statement not working... For some reason the following isn't working: index="sandbox" sourcetype="as-cdr" \|stats count AS numCalls \|append [s... by msarro Builder in Splunk Search 04-15-2019 0 5	0	5
How do I alert when a host stops sending data? What's the best way to create a search to identify which hosts have not sent a syslog message to Splunk in the last 2... by matt Splunk Employee in Splunk Search 04-15-2019 2 10	2	10
Combine different searches into a single table or report Hi I have 10 different Splunk queries that return results only when there is an issue or a flag of 1. All the queries... by johnsasikumar Path Finder in Splunk Search 04-15-2019 0 1	0	1
How to customize and sort columns with specific conditions? Hi, I am looking to sort column with specific condition. Condition: if column Context_Command contains * it should... by AKG1_old1 Builder in Splunk Search 04-15-2019 1 2	1	2
combine two search results tables by matching fields value Hello Guys , I am having results from two different query 1> index=_internal ("version" AND source="/opt/splunk/va... by kannu Communicator in Splunk Search 04-15-2019 0 10	0	10
Filter search string to field with only 1 specific value I want to output computers who only has started 1 specific application Field values: Application + Computers There i... by lbkAconectodk New Member in Splunk Search 04-15-2019 0 7	0	7
Help on subsearch Hello I use the search below it works fine..... BUT for some host, I cant catch the fields there is in the subsearch... by jip31 Motivator in Splunk Search 04-14-2019 0 7	0	7