Splunk Search

Community Activity

Get logs with a distinct value of a field I saw some similar questions but none seem to work In my splunk logs, I have this field called TransactionID: 6c5802... by ank15july96 Engager in Splunk Search 04-11-2019 0 3	0	3
Stats Latest is not returning the Latest value The following search returns the listed DateTime values for the field S3KeyLastModified. index="aws-billing" sourc... by robinettdonWY Path Finder in Splunk Search 04-11-2019 0 3	0	3
how to set token from a table Hi suppose search result: col1 col2 1 2 then <preview> <set token="row1_col2">$result.col2$</set> </previe... by crazyeva Contributor in Splunk Search 04-11-2019 0 7	0	7
tstats web datamodel unable to use status in eval Hi, ive been having issues with using eval commands with the status field from the Web datamodel specifically with t... by eco_rb023 Engager in Splunk Search 04-11-2019 1 3	1	3
Comparing results of subsearch and main search Hi All , My problem statement is to find the blocked queues over 60 minutes consistently which means that there shou... by lohit Path Finder in Splunk Search 04-11-2019 0 3	0	3
Make field reference after a certain value I have a query that has two native fields, they are "referenced_host" and "url". I performed the extraction of the "r... by LeandroKopke Explorer in Splunk Search 04-11-2019 0 3	0	3
Does Splunk SDK provide api for retrying searches I wonder if I have to implement the retry logic by myself by fpan_splunk Splunk Employee in Splunk Search 04-11-2019 0 0	0	0
How to generate multiple charts from one search result faster? Hello, I'm wondering if there is any faster or more efficient way (either using Pivot or some unique query) to gener... by hcheang Path Finder in Splunk Search 04-11-2019 0 9	0	9
Display error :Could not create search create many query in panels, but some panels can display right search result, some can not and display the error:Coul... by kavana Explorer in Splunk Search 04-11-2019 0 12	0	12
Create an list that shows unused data in specific index Hi, Can I in someway create an list that shows unused data in a specific index? Is it possible? by amirarsalan Explorer in Splunk Search 04-11-2019 0 5	0	5
User level Concurrent search limits Hi Everyone, On my system, I have 2 CPU cores In $SPLUNKHOME/etc/system/local/limits.conf file I got below details, ... by maniu1609 Path Finder in Splunk Search 04-11-2019 0 5	0	5
How to select values from not the current source but from the previous source So I know that the following will allow me to search and just to select values from the current sourcetype : [search... by PBerry7538 New Member in Splunk Search 04-11-2019 0 2	0	2
Combine multiple tables in single alert I have 3 different searches. All are printing separate tables. I want to configure the single alert, which will conta... by twh1 Communicator in Splunk Search 04-11-2019 0 2	0	2
Increase count of events but no field results show up When searching with this sample query, results show up like below index=abc sourcetype=def 1.1.1.1 For example, fi... by superstarmd New Member in Splunk Search 04-11-2019 0 2	0	2
Join 2 searches when logs are not the same First I search the number of login by sector for users with a mobile mysearch \| stats count as loginOK by sector T... by faribole Path Finder in Splunk Search 04-11-2019 0 0	0	0
color of column chart I have a graph like this. Now i want to highlight and make red only if Available value is less than 100 in the x axis... by surekhasplunk Communicator in Splunk Search 04-11-2019 0 1	0	1
How to send the processed data to 3rd party system instead of raw data Hi, I need to expose my Splunk Data to a 3rd party tool, It can collect data through REST API. I dont want to send ... by SathyaNarayanan Path Finder in Splunk Search 04-11-2019 0 3	0	3
Multi-value field how to match condition in case statement hello everyone I am analyzing the mail tracking log for Exchange.I divide the type of sendemail into 3 types. @abc... by bestSplunker Contributor in Splunk Search 04-11-2019 0 4	0	4
How to retain original _time from one index using collect command to another index. Hi all, I'm using Splunk 7.2.4(.2) I have an issue, where i want to run this command: index="defaultdb_713" source... by bogdan_nicolesc Communicator in Splunk Search 04-11-2019 0 2	0	2
Search - Report on non-existing fields [API] Hello, I am interacting with splunk through the API (more specifically I use the search.py from the SDK). I have a s... by srj New Member in Splunk Search 04-11-2019 0 0	0	0
lookup file no longer being updated - how to identify how it was being updated A splunk user has identified that a lookup table has not been updated for some time. I was previously unaware of th... by vincenp2 New Member in Splunk Search 04-11-2019 0 2	0	2
Foreach Not Working Hi, I wonder whether someone can help me please. I've put together the following query: `real-time-information_wmf... by IRHM73 Motivator in Splunk Search 04-10-2019 0 3	0	3
How to prevent x-axis values from disappearing on cascading charts on dashboard? When I cascade two reports on a dashboard, the x-axis values automatically disappear. How can I adjust the x-axis val... by nikita012 New Member in Splunk Search 04-10-2019 0 3	0	3
How to get multiple dynamic values from a single log line We have numerous log lines that are in a format similar to the following:- 2019-04-09 13:00:03 DEBUG DynamicName1 10... by littlgra Engager in Splunk Search 04-10-2019 1 2	1	2
Best way to correct tostring(,"duration") bug? Hi there, \| eval session_length=tostring(end-start,"duration") is not padding zeros correctly (I believe just for se... by nick405060 Motivator in Splunk Search 04-10-2019 0 5	0	5