Splunk Search

Community Activity

Why isn't this field transform working? Hi everyone, I'm having trouble applying the following fields transformation — it's not "parsing" during search time.... by dpanych Communicator in Splunk Search 01-23-2019 0 3	0	3
Lookup matching field and bring in new field from lookup Hello, I've been banging my head against the wall over the last like two hours over this and figured I should just po... by rpatelnes New Member in Splunk Search 01-23-2019 0 6	0	6
How do you calculate the difference between two date/time fields and get results in milliseconds? I am trying to calculate difference in my two custom date time/fields and get output results in milliseconds. I trie... by reddyavi256 Explorer in Splunk Search 01-23-2019 0 4	0	4
how to map lookup field doesn't exist in splunk event Hi All, Could you please help me with a query to map a lookup table with splunk events but not aware on matching f... by rakeshksingh New Member in Splunk Search 01-23-2019 0 0	0	0
Accessing whole row / other fields in table format colorPalette expression in Simple XML - 'value' only? Hello Splunkers, I am developing dashboards in a Splunk instance which I don't manage, so I have little room for add... by wowczarek Engager in Splunk Search 01-23-2019 1 5	1	5
How do I get the eval token to wait for the set token to finish? Hi Is there a way to get my eval token to wait for the full result. I am setting a token time_selection_BUFFER.earli... by robertlynch2020 Influencer in Splunk Search 01-23-2019 1 2	1	2
Joining 2 Lookup Tables I'm trying to join 2 lookup tables. To make the logic easy to read, I want the first table to be the one whose data ... by weidertc Contributor in Splunk Search 01-23-2019 0 10	0	10
regex to mask password in props.conf I am need of help to build the regex to mask a password string looking similar to this Password: 22222222abc22222222... by caitcait Explorer in Splunk Search 01-23-2019 0 10	0	10
Regex Help; exceeded configured match_limit I have this query that works in all regex assist sites but is too greedy for my Splunk Environment. I am unable to ad... by JoshuaJohn Contributor in Splunk Search 01-23-2019 0 3	0	3
Using Wildcard as value in a variable Is there any way to use a wildcard as a value to a variable? \| inputlookup Functionalities.csv \| search AppNo=$app$ ... by weidertc Contributor in Splunk Search 01-23-2019 0 15	0	15
How do you format a table row as currency but not the column field only a specific row? I have a table that has various columns of Totals. However, the CurrentYear can represent different information. I o... by EmEdwards Path Finder in Splunk Search 01-23-2019 0 1	0	1
Search help I have the Sophos XG forwarding logs to Splunk. How do i search for users who logged into Sophos XG in Splunk. by ticbos New Member in Splunk Search 01-23-2019 0 2	0	2
How to prevent Eventgen from generating duplicates Hi, I´m new to Splunk and Eventgen. I have a sample with 24 events distributed over 1 day (timestamps from 19.11.2018... by ttyurina New Member in Splunk Search 01-23-2019 0 0	0	0
Can you help me with a lookuptable question? Hello all, I have indexed data that contains an extracted field (domain) and a CSV (https.csv) file with the followi... by adabud6267 Explorer in Splunk Search 01-23-2019 0 4	0	4
Is it possible to have a common URL for Splunk? Hi, We have three different URLs for Splunk for example, https://splunk1.com, https://splunk2.com; https://splunk3.... by dbashyam Explorer in Splunk Search 01-23-2019 0 4	0	4
Why does the stats function remove my fields and what Splunk solutions can I use for the following order: 1st do lastest(_time) -> then do sum(on the result of latest) Hi, I've read a while ago how easier Splunk is vs SQL, but I do not agree within the context of my issue:( I want t... by net1993 Path Finder in Splunk Search 01-23-2019 0 20	0	20
Is it possible to calculate 'responseTime' values in a cumulative stats table? I have identified an issue with a response time stats report that was built by a former Splunk specialist at my organ... by alexandermunce Communicator in Splunk Search 01-23-2019 0 3	0	3
Splunk forms I would want to know if I can create a form as below : Time : 23/01 No of Events ... by Deepz2612 Explorer in Splunk Search 01-23-2019 0 3	0	3
How do you transform table values to a column replaced by values? Hi Folks, I'm still new to Splunk queries. I'm struggling with the following (simple) table transformation: All val... by mgutschelhofer Explorer in Splunk Search 01-23-2019 0 3	0	3
What does the following Splunk health check warning mean? For one of the app we are getting error: Health Check: msg="A script exited abnormally with exit status: 1" What d... by mbagali_splunk Splunk Employee in Splunk Search 01-22-2019 0 1	0	1
How do I count events for the past 45 days when the start date is the 15th of each month? Please Help !!!! I am trying to create an SPL query to count events for the past 45 days from the start date the 15t... by amilavsky Engager in Splunk Search 01-22-2019 0 2	0	2
Does anybody have idea on "INFO PipelineComponent - Process delayed by 1524.266 seconds, perhaps system was suspended?" log message? All my summaries are running and completed successfully. But I can see "INFO - Process delayed by 1524.266 seconds, p... by sesharao92 Explorer in Splunk Search 01-22-2019 2 0	2	0
What's wrong with my rex? I'm trying to time an event. The event occurs within a burst of log events, which arrive at my Splunk server and usu... by stcrispan Communicator in Splunk Search 01-22-2019 0 15	0	15
Why is my single visualization w/trendline total display off by 1? i have the following query and the events/results show "5" but the Single w/Trendline Visualization shows "4". index... by jaj Path Finder in Splunk Search 01-22-2019 0 2	0	2
tabulate timeline of a notable event I'm trying to create a table that displays the timeline of the notable event based on its status from creation. So, ... by pthalasta New Member in Splunk Search 01-22-2019 0 0	0	0