Splunk Search

Community Activity

How do you parse multiple columns (key/value)? Hello, Please help me with this. I have result of two columns: Tag-Key Tag-Value A... by braicu New Member in Splunk Search 03-09-2019 0 7	0	7
Split the total count in the rows per month and show the count under each months Hallo, I am trying to find the total number of different types of events per month(chronologically) and the sum of ... by njohnson7 Path Finder in Splunk Search 03-09-2019 0 12	0	12
How do you return the latest value only if it's not equal to "closed"? I'm having a tough time figuring this one out for some reason. The datasource I am using contains multiple records... by stike100 New Member in Splunk Search 03-08-2019 0 2	0	2
How do you add the average and the standard deviation as a new field? Hi, This might be trivial question, but I am having a hard time to figure it out. Any help is greatly appreciated. ... by mpasha Path Finder in Splunk Search 03-08-2019 0 2	0	2
Regex to extract a number from string Hello, I am trying (rather unsuccessfully) to extract a number of varying length form a sting. The constants are 0s ... by ahogbin Communicator in Splunk Search 03-08-2019 0 11	0	11
Is it possible to add a field by source at index-time ? I would like to add a new field at index-time that will be visible in the list of events. In the same way as Host, so... by magilbert1 Explorer in Splunk Search 03-08-2019 0 8	0	8
Define user field in Security Essentials I have added Security Essentials on my indexer and the Splunk_TA_windows app on the forwarders however when i run the... by samhodgson Path Finder in Splunk Search 03-08-2019 1 5	1	5
can you help me with regex Hi, I have a search with regex ERROR * \| rex ".?(?(?:\w+\.)+\w?Exception).*" \| stats sparkline count by ex... by tulusoy New Member in Splunk Search 03-08-2019 0 5	0	5
Can we search in different time ranges between multiple indexes? Hi, Can I run a search with two or more indexes and specify a different time range in each one? For example, would ... by russell120 Communicator in Splunk Search 03-08-2019 1 11	1	11
List of computers extracted from the computer Scenario: In a way, the local admin user can be retrieved, the computer to remove the domain, and without the domain ... by magun New Member in Splunk Search 03-08-2019 0 7	0	7
How can I group the query? Hi all, I am new to splunk Following is the information: Column1 Column2 column3 f... by uppukumar Explorer in Splunk Search 03-08-2019 0 2	0	2
How eliminate records from a search that appear twice only? Hi, I have a search which returns a list of records, some of them have a duplicate Value. Here's an example of the ou... by emipintus Explorer in Splunk Search 03-08-2019 0 7	0	7
Why is join slow? I've seen a lot about not using join subsearches, how it's slow, etc etc. Which proves to be true in practice. What ... by chirsf Explorer in Splunk Search 03-08-2019 0 2	0	2
Temenos T24 Monitoring whit Splunk Hi team i have been working a new project with banking sector where they are using the Core Banking T24. Does anyon... by evinasco Communicator in Splunk Search 03-08-2019 1 3	1	3
stacked bar chart in timeline series hi! I want to create a stacked bar chart like in a timline series like this \|[----RUN TIME----]\|[----IDLE TIME----]\|... by mdmaala Communicator in Splunk Search 03-07-2019 0 2	0	2
How do I schedule a recurring search that would alert if an index is missing data feeds from hosts? Hi. I need to schedule a recurring search that would alert/email me if an index, say "web", is missing data feeds ... by jasonlow Loves-to-Learn in Splunk Search 03-07-2019 0 3	0	3
List Comparison I'm wanting to find out if it's possible to take a list of items in a text file, conduct a search against that list a... by balcv Contributor in Splunk Search 03-07-2019 0 6	0	6
How do you use fillnull to return a count of 0? I have events that have a value called "Date First Found" that is of the format: "%m/%d/%Y". I calculate the number o... by michael_ermino_ New Member in Splunk Search 03-07-2019 0 2	0	2
With regex, can you help me with a matching issue for a blank space? Hello, I am having an issue with some regex that I wrote. it is working fine except for this blank space. Regex : ... by su_kumar New Member in Splunk Search 03-07-2019 0 7	0	7
Why does my real time search job keeps getting killed? Hi I have a real time search over the past 5 minutes, however it works for 30 seconds an then it dies. any ideas? I... by robertlynch2020 Influencer in Splunk Search 03-07-2019 1 6	1	6
How do you correlate events from two different indexes by date? Hi folks, I have 2 indexes containing information as below: index ABC _time sessionkey ... by ADRIANODL Explorer in Splunk Search 03-07-2019 0 4	0	4
Replication and search factors "not met" We have: - Index Cluster Master - Search head cluster (3 nodes) - Index Cluster (3 nodes) - Heavy forwarder (1 node) ... by davidmills Explorer in Splunk Search 03-07-2019 0 2	0	2
Added _meta to default result in double counts. unable to search data using SPL index=test ssp=3538 following search does return the result index=test ssp=*3538 ... by rbal_splunk Splunk Employee in Splunk Search 03-07-2019 0 1	0	1
What's wrong with my eval case statement? What is wrong with this? \| eval Count=case((sourcetype="input1" OR sourcetype="input2") AND index="foo1", "NA" (sou... by ryhluc01 Communicator in Splunk Search 03-07-2019 0 15	0	15
Field extractions aren’t working as expected since upgraded to 7.2.3 Since upgraded to Splunk version 7.2.3, some fields extractions aren’t showing on the searches properly. In particula... by rsantoso_splunk Splunk Employee in Splunk Search 03-07-2019 0 2	0	2