Splunk Search

Community Activity

Help with the Splunk settings to localize dates and numbers from English to Italian -- doc instructions didn't work I followed the document to translate splunk to a specific language http://docs.splunk.com/Documentation/Splunk/6.5.2/... by KavyaSabu Explorer in Splunk Search 02-26-2019 0 6	0	6
Stats Count Eval If Hi, I wonder whether someone can help me please. I'm using number the following as part of a query to extract data f... by IRHM73 Motivator in Splunk Search 02-26-2019 0 9	0	9
Can you help me with the following query? Hello, I am trying to calculate the RTT time of a host where the IP is in a different source, and the rtt time is in... by vrmandadi Builder in Splunk Search 02-25-2019 0 4	0	4
Is there a way to display Count per hr for last 24hrs with Average per hr for the last 30 days as an overlay? Hi Splunk Gurus, Hoping someone out there might be able to provide some assistance with this one. I have a requirem... by kozanic_FF Path Finder in Splunk Search 02-25-2019 0 9	0	9
How do you trigger an alert using stats count to return 0 when value is 0? I have an alert that is not triggering because there are no events occurring for one of my search parameters. I woul... by markhvesta Path Finder in Splunk Search 02-25-2019 0 3	0	3
Compare and filter table results Given the table below: VIP Group State Primary_VIP Group1 Down Backup_VIP Group1 Down Primary_VIP Group... by bertzela Engager in Splunk Search 02-25-2019 0 1	0	1
How to use NOT in Transaction command i have query like below and got result index=ABC host=xyz123 \| transaction startswith="failure" endswith="success" ... by logloganathan Motivator in Splunk Search 02-25-2019 0 5	0	5
I need to group events that have the same date and the same ip address HI folks! I need to group by two variables but am having trouble figuring it out. time ip_address user ... by tullir New Member in Splunk Search 02-25-2019 0 5	0	5
How do you get the yearly count data? Hi, index="os" sourcetype="Service" CaseNumber="Test-2018*" (Group="Secure" OR Group="health") AND (Section="Connect... by ramesh12345 Explorer in Splunk Search 02-25-2019 0 3	0	3
How to expand macros in a Splunk search? I have a search as follows: index="x" search_name="`Y`" (status=Z) \| `A` \|`B` where A and B are macros Now how ca... by pavanae Builder in Splunk Search 02-25-2019 0 7	0	7
How to create a table in which mandatory and optional fields are correctly aligned Hello, I have a problem extracting data from a log with format not fixed. I explain: each row of my log contains a m... by marcoemme41 New Member in Splunk Search 02-25-2019 0 6	0	6
How do you merge events by _time field and add new fields? Hi everyone, My data is as flowing. The cnt is events count of scanner_type by day. I want to show everyday`s diff... by perlish Communicator in Splunk Search 02-25-2019 0 1	0	1
How to display Current group ? Hi, index="os" sourcetype="Service" status=* (Group="Data/Config" OR Group="Secure") AND (Section="Site Problem" OR ... by ramesh12345 Explorer in Splunk Search 02-25-2019 0 0	0	0
How do I extract a field value after a specific string in unstructured data? Hi, I would like to extract a new field from unstructured data. FX does not help for 100%, so I would like to use re... by HeinzWaescher Motivator in Splunk Search 02-25-2019 1 2	1	2
Can you help me with my regex expression? Hi Team, I'm struggling to get the regex expression for the following values. I want to capture the text before the ... by pench2k19 Explorer in Splunk Search 02-25-2019 0 2	0	2
How to get latest parameter from csv disregarding empty values Hi splunk comunity! I have dashboard with text input, which starts to execute when i change my parameter in text box... by mishaaaaaaaaaa Explorer in Splunk Search 02-24-2019 0 6	0	6
How do I search from 2 different indexes? Hi, How do I search in two indexes? I am looking for the IP address in both the indexes at that same point of time a... by ajayrejin Explorer in Splunk Search 02-24-2019 1 6	1	6
Search for POST params Hi- I am pretty new to Splunk. Can we search for a specific (form) parameter against a POST REST call ? by ashishgarwal New Member in Splunk Search 02-24-2019 0 1	0	1
Splunk extraction of fields for email texts I have the infra as shown below: Splunk Log Forwarder-> Splunk Indexer The Log forwarder defines which data goes int... by tan_junyuan Engager in Splunk Search 02-23-2019 0 1	0	1
How to calculate no of opened ticket in past in splunk Hi , i want to calculate total no . of opened incidents by a user over a time interval in dynamic environment in spl... by himanshu_b_shek New Member in Splunk Search 02-23-2019 0 4	0	4
help on rangemap command with loadjob Hi I use the search below in order to display GOOD or BAD in a panel When I execute the query i have a result But I... by jip31 Motivator in Splunk Search 02-23-2019 0 8	0	8
Can you help me with a subsearch? Hi, I use the search below in order to display the model of a host for only the host which has a Wear_Rate>0 But th... by jip31 Motivator in Splunk Search 02-23-2019 0 2	0	2
How to capture 2nd max value of a field and compare with 1st max value of the same field I have data in json format as following:- {Run=1 , Average=2.1, Max=3, Min=1.4, Transaction=Sample1} {Run=1 , Average... by pratyushak New Member in Splunk Search 02-22-2019 0 2	0	2
Difference in result with timechart span=1d dc(ip) vs timechart span=1h dc(ip) I am using distinct count with time chart for the whole day (yesterday). The result is varying if the span is change... by aa274t New Member in Splunk Search 02-22-2019 0 5	0	5
Reference Time on Dashboard Load (and adjust to time change) Hi, I was wondering how I can reference the time picker on load for a dashboard and make sure that it's the right fo... by mrstrozy Path Finder in Splunk Search 02-22-2019 0 1	0	1