Splunk Search

Community Activity

Can you help me extract some data with regex? Hi, I have this data {"method":"GET","url":"/rest/icontrol/logout","params":{},"requestStartTime":1548363789220,"re... by dbcase Motivator in Splunk Search 01-24-2019 0 4	0	4
values Shared by Search output and Lookup TIA. This has probably been asked and answered dozens of times but my brain is now mush. The following search gives ... by DavisLee New Member in Splunk Search 01-24-2019 0 1	0	1
How do I round only certain columns/fields ? How do I round only certain columns/fields ? below this \| foreach * [eval <<FIELD>>=round('<<FIELD>>',2)] will round ... by HattrickNZ Motivator in Splunk Search 01-24-2019 0 1	0	1
Can you help me with a problem with an AND operator in a CASE and IF statement? I have one lookup in which there is a field which consist Team Member A1 A2 A3 A4 A5 A6 A7 Now,If TeamMember=(A1 ... by kumagaur New Member in Splunk Search 01-24-2019 0 1	0	1
How do you rename chart columns and add a dynamic count in brackets? I've got an average session duration (gotten via \| Transaction) broken down by EndStatus. EndStatus is the cause of t... by VexenCrabtree Path Finder in Splunk Search 01-24-2019 1 10	1	10
How to display "0" instead of "No Results Found" Hi guys! I have the below query for a Single Value Dashboard Panel. It is counting the daily total error duration of... by auaave Communicator in Splunk Search 01-24-2019 0 5	0	5
How to Extract Values from a KV within a event log I have the below log event. [INFO ] 2019-01-24T04:09:20,513 [thread=framework1234] className=DummyConsumer - {} - {... by vickyvishwa Explorer in Splunk Search 01-24-2019 0 2	0	2
Is there a way to set a field alias at search time? Is there a way to set a Field Alias as search time, I am building a report looking at Windows Event IDs, In this case... by knutsod Path Finder in Splunk Search 01-24-2019 2 3	2	3
Get time difference between events based on the following event My data looks like this: 1. System CheckpointName ProcessTimestamp ConnectionId 2. SAP Checkpo... by florianduhme Path Finder in Splunk Search 01-24-2019 0 7	0	7
Speeding Up a Search Query Matching Subquery Results Hello, I have a search I'm trying to speed up. I have a list of field values stored in a KV store. I use an inputloo... by SplunkPersonal Path Finder in Splunk Search 01-24-2019 0 1	0	1
Multiple time logs in one timestamp Hello Multiple time logs in one timestamp example 19/01/24 10:28:51 [2019-01-24 10:28:51] DEBUG [SyslogReceiver.jav... by jsryu0247 Engager in Splunk Search 01-24-2019 0 1	0	1
Why can't I see data in the Search App's "Data Summary", but the data is searchable? Hi all, I monitor files on a heavy forwarder and use different sourcetypes and hosts for each file, but one common i... by baxiani Explorer in Splunk Search 01-23-2019 0 4	0	4
Big static report I had to have yearly report on my main dashboard. Creating it every day would be really hard, so I am wondering can I... by darioapis Explorer in Splunk Search 01-23-2019 0 1	0	1
Can you help us set a field value based on a field in another event? I'm looking to set a field value in an event based on field values in another event. Given the data: ev=1 req = 123... by jl23 New Member in Splunk Search 01-23-2019 0 2	0	2
How to extract JSON array into a table when there is an optional key/value field in the array? I have a JSONArray with embedded array and an optional field. I'd like to print the data into a table, with each fie... by jdc8723 Engager in Splunk Search 01-23-2019 0 1	0	1
Which regex is the correct extraction for Splunk EPOCH timestamp with decimal microseconds configuration in props.conf ? I have timestamps in my data sources that are EPOCH with fractional microseconds for example: 1547528398.991103 1547... by baegoon Explorer in Splunk Search 01-23-2019 0 1	0	1
Python SDK splunklib slow search compared to search app on search head. Via Python REST API SDK jobs.create(search) search starts and runs, but takes like 20 minutes compared to search app ... by tonymorin Explorer in Splunk Search 01-23-2019 0 0	0	0
Can you help me using dedup and count? I have the following search based on F5 logs that count the HTTP POSTs by src in a five-minute bucket: index=f5 acti... by jwalzerpitt Influencer in Splunk Search 01-23-2019 0 10	0	10
Could you introduce and use dynamic statistics in eval commands? I'm trying to calculate an average column in a chart by renaming the Total column (created with the addtotals command... by DouglasSmithers Engager in Splunk Search 01-23-2019 0 2	0	2
maping a client name resolution search result to an IP address at the time of name resolution Good day, I am trying to create a search that can first search DNS for a certain domain name and after if finds a ma... by mpasha Path Finder in Splunk Search 01-23-2019 0 0	0	0
Why isn't this field transform working? Hi everyone, I'm having trouble applying the following fields transformation — it's not "parsing" during search time.... by dpanych Communicator in Splunk Search 01-23-2019 0 3	0	3
Lookup matching field and bring in new field from lookup Hello, I've been banging my head against the wall over the last like two hours over this and figured I should just po... by rpatelnes New Member in Splunk Search 01-23-2019 0 6	0	6
How do you calculate the difference between two date/time fields and get results in milliseconds? I am trying to calculate difference in my two custom date time/fields and get output results in milliseconds. I trie... by reddyavi256 Explorer in Splunk Search 01-23-2019 0 4	0	4
how to map lookup field doesn't exist in splunk event Hi All, Could you please help me with a query to map a lookup table with splunk events but not aware on matching f... by rakeshksingh New Member in Splunk Search 01-23-2019 0 0	0	0
Accessing whole row / other fields in table format colorPalette expression in Simple XML - 'value' only? Hello Splunkers, I am developing dashboards in a Splunk instance which I don't manage, so I have little room for add... by wowczarek Engager in Splunk Search 01-23-2019 1 5	1	5