Splunk Search

Community Activity

Join two datasets (main search and subsearch), keep all keys in both, and update non-key fields with data from the subsearch If I have two searches, one generates fields "key A" and "Column A" and the second search generates fields "key B" "C... by cdhippen Path Finder in Splunk Search 03-22-2019 0 4	0	4
Timechart - Running Total By Product Hi, I would like to create a timechart that shows the running total revenues for each product. First I've created a ... by HeinzWaescher Motivator in Splunk Search 03-22-2019 1 5	1	5
SPL command to copy paste rows in lookup with increment values i have lookup like following : ID jobname start_time end_time frequency 1 abc 0:00 21:00 ... by gowtham495 Path Finder in Splunk Search 03-22-2019 0 1	0	1
Eventstats not getting the latest event based on the field Hi Team, I am trying to get the latest event from the list of events , id field is common across all the ... by imurpalvicky Engager in Splunk Search 03-22-2019 0 8	0	8
Splunk problem with fast and smart mode Hello community, I am facing a problem ,I have an instance of splunk installed on linux server , And I am trying to ... by virtuosoo Explorer in Splunk Search 03-22-2019 0 6	0	6
Optimize my search This is my search: Function="- Parts::GetPartSection =>" \| rex "maingroupNo\>(?.+)\\(?.+)\\(?.+)\" \| convert timefor... by jyab6z Path Finder in Splunk Search 03-22-2019 0 2	0	2
how to add field values of a table to another field values in a different table in a dashboard belonging to same Index hello all, I want to add field values of a table with field values of another table in a dashboard both belonging to ... by preacher_15 Explorer in Splunk Search 03-22-2019 0 1	0	1
Duration Timer hi!I have a prototype here that has three switches for each light, Green, Yellow and Red Light respective. Each time ... by mdmaala Communicator in Splunk Search 03-21-2019 0 1	0	1
query to get top 10 users Hello everybody, I am getting data in "index=test", I am trying to get top 10 Calling userid's with there call count... by splunkuseradmin Path Finder in Splunk Search 03-21-2019 0 1	0	1
How to search what field values are missing using a lookup table per period of time? - follow up I am using a search that was provided as an answer to a previously posted question - How to search what values are mi... by christopheryu Communicator in Splunk Search 03-21-2019 0 4	0	4
Duration between events Given transit data like: 2019-03-19 19:00:32 GMT vehicle_id="58" stop_direction=Inbound 2019-03-19 19:05:45 GMT vehi... by plucas_splunk Splunk Employee in Splunk Search 03-21-2019 0 2	0	2
how to carry calculations down the pipe for further calculations? Goal: Count the percentage of users that scroll to through each section of a page. Problem: I know the number of use... by user93 Communicator in Splunk Search 03-21-2019 0 8	0	8
How to find the first saturday of every month? Hello, I am currently stuck with finding the first Saturday of every month. Below is a screenshot of what i currentl... by vpurushottam Explorer in Splunk Search 03-21-2019 0 2	0	2
Optimize Search I have to create an alert where as soon as the number of events at time X has changed. There are two following scena... by nicxso Engager in Splunk Search 03-21-2019 0 6	0	6
how to search by too deferent champs Hello , how to search by two different champs ? I try "OR" but not result Thanks by aalaa Path Finder in Splunk Search 03-21-2019 0 2	0	2
Colors inversed in my piechart ! why ? Hi ! I have a piechart and I assigned red color for a x value and green color for a y value on it. But sometimes it ... by henriq_c Explorer in Splunk Search 03-21-2019 0 5	0	5
How to exclude two grouping of results in query? Hello, this is my first forum entry and I'm really hoping this question is clear. Currently, my timechart results are... by noob4now New Member in Splunk Search 03-21-2019 0 4	0	4
How to make the column one color? Hi I have a table with TEXT, i have 3 columns. \| table no1 no2 email I want the column email to be gray, I cant s... by robertlynch2020 Influencer in Splunk Search 03-21-2019 0 5	0	5
How do you handle a lookup in search head cluster? We are facing an issue with CSV lookup files after migrating from standalone search head to a cluster. The lookups ar... by sakthiganesht Explorer in Splunk Search 03-21-2019 1 9	1	9
Insert one search into other search as a new column My code: My basic search\| rex "maingroupNo>(?.+)\(?.+)\(?.+)\" \| convert timeformat="%H:%M:%S" dur2sec(TimeInSec) \|... by jyab6z Path Finder in Splunk Search 03-21-2019 0 1	0	1
Percent search Hello , I have a table, each line of this table has a specific value, I need a search command to calculate the perc... by aalaa Path Finder in Splunk Search 03-21-2019 0 2	0	2
How to covert GMT Time(0-12:00) to PST time. My result is giving me the output for GMT time for the given time what I have defined. by rajhemant26 New Member in Splunk Search 03-21-2019 0 3	0	3
How to expand the count field and show all the events as a search result? There is my search result in the attached image. What I want to do is to expand the count field and show all events ... by jyab6z Path Finder in Splunk Search 03-21-2019 0 2	0	2
count duplicate instances of multivalue field Hello. I have events that have a field "Security_ID" that is a multi value field. It may contain something like: N... by splunkbacon Explorer in Splunk Search 03-20-2019 0 1	0	1
Find latest data for each grouped item Oct 26 10:40:50 m eg[0]: group:group1 name:name1 size:10 speed:20 Oct 26 10:40:50 m eg[0]: group:group2 name:name... by surfi2000 New Member in Splunk Search 03-20-2019 0 3	0	3