Splunk Search

Community Activity

How do you use strptime with different date formats? I have two date formats coming into my index (01/11/2018) and (01/11/18). I wrote: \| eval LastSeen_epoch = strptime... by JoshuaJohn Contributor in Splunk Search 01-02-2019 1 2	1	2
How do you fix the font size of each single value display panel? How do I fix the font size of each panel as in this i have used single value display with concatenate option but as p... by shishirkumar Engager in Splunk Search 01-02-2019 0 4	0	4
How do I replace '," with ";" between a bracket? I have raw data: IMS,CSCF1,,,{REGISTER,19728881234@domain.com;user=phone,200},,{PUBLISH,19728881234@domain.com;use... by jianyu75074 New Member in Splunk Search 01-02-2019 0 2	0	2
Can you help me format system time? hi, I need to format SystemTime='2018-12-27T04:26:29.200782700Z' like this : yy:mm:dd hh:mm Could you help me plea... by jip31 Motivator in Splunk Search 01-01-2019 0 7	0	7
How do you find the disabled usernames along with the status of their respective adm-usernames? I have 2 types of account for the same user's like 1. username 2. adm-username As a requirement, I need to find the ... by deepak007 Explorer in Splunk Search 01-01-2019 0 6	0	6
Can you help me get my subsearch to work? Hi guys, i need help with a search. I believe it's a subsearch that i need (I need a variable output of one search ... by keiran_harris Path Finder in Splunk Search 01-01-2019 0 5	0	5
Cab a field be used in stats command that's declared in eval command? BaseSearch>\|convert auto(A)\|appendcols[\|convert auto(B)]\|eval C=A-B\|table A B C This gives the result as A B ... by gokikrishnan New Member in Splunk Search 01-01-2019 0 7	0	7
convert num(fieldname) as depth does not convert field to a number When I run the following search, the field does not convert to a number: search\| convert num(Samples.Sample.Depth) as... by tzitello_splunk Splunk Employee in Splunk Search 01-01-2019 0 2	0	2
Can you help me figure out what is the job of the rex field in this line? This is the search: index=vha_pronto sourcetype=pronto_neopil_prd NOT [ search index=vha_pronto sourcetype=pronto_ne... by ramanir New Member in Splunk Search 01-01-2019 0 6	0	6
Convert num not working Convert does not work search \| convert num(quantity) as Quantity The quantity field samples are: 1.0000 ... by venanciop New Member in Splunk Search 12-31-2018 0 3	0	3
How do I get the lower and upper bound of a timechart and use these in an eval? Is there any way to get the upper and lower bound dates for a timechart that has a span of weeks? \| timechart span=... by dojiepreji Path Finder in Splunk Search 12-31-2018 0 5	0	5
Can you help create the regex to extract a field from a XML log? hello, In the log below, I want to extract the field TIMECREATED SYSTEMTIME https://cjoint.com/c/HLDpeThG7Qd Could... by jip31 Motivator in Splunk Search 12-31-2018 0 1	0	1
How can i calculate the minimum time per source(log file) and then get the logs with a time difference of more than 6 minutes? I have a WAF log source where logs are written to CEF files. I need a search that calculates the minimum time per lo... by aamer86 Path Finder in Splunk Search 12-31-2018 0 4	0	4
Prefix search no results Hi, I am making a query where it get some raw syslog data and format into columns with some filters. When I search ... by gmasca Explorer in Splunk Search 12-31-2018 0 4	0	4
How to integrate gns3 to splunk How to send data 514 port to splunk. I have configured TCP udp 514 port and also install cisco app on splunk. I need ... by lmjoin Explorer in Splunk Search 12-30-2018 1 0	1	0
Can you help me with my histogram visualization? Hi all, I would like to show my data via 2 different histograms, but I am having trouble figuring it out. Can someon... by skribble5 Explorer in Splunk Search 12-28-2018 0 5	0	5
Using transactions with IronPort's potentially infinite MID rewrites I've seen quite a few posts about IronPort/Cisco ESA mail logs and how folks have put them together with transaction.... by rharrisssi Path Finder in Splunk Search 12-28-2018 0 2	0	2
Someone else configured field extractions, but I would like to delete some of them. Where do I find them? Hi Guys I am trying to delete some Fields configured by someone else, but I can't find where they are. First of all,... by crazyeva Contributor in Splunk Search 12-28-2018 0 4	0	4
Can't calculate time difference Hello, I want to calculate the time difference between two fields, so I tried the below query, but it didn't work. P... by appleman Contributor in Splunk Search 12-28-2018 0 6	0	6
Can you help me use the where command to limit results? I have a search that works perfectly. It lists the number of calls by area code by state. However, I'm trying to lim... by muzicman61 New Member in Splunk Search 12-28-2018 0 2	0	2
How do you compare 2 fields in different indexes to add a third field? Hello, I can't find out how to do a search to compare the same value in 2 fields, and if this is same value, add a t... by ppiton New Member in Splunk Search 12-28-2018 0 3	0	3
Unable to see the License usage report "Could not create search" I am not able to view my license usage report for Today and Previous 30 days. I am getting below WARNINGS under Messa... by khusain_splunk Splunk Employee in Splunk Search 12-28-2018 0 1	0	1
How come the output of our tstats command is not getting written to a CSV? Hi, I am trying to create a lookup that has the names of all the indexes and the timestamp of the oldest event in th... by Arpit_S Path Finder in Splunk Search 12-28-2018 0 5	0	5
Without using a subsearch, how do you find events that are not in a lookup table? I have a lookup table filled with thousands of user IDs. I have a log filled with tens of thousands of user IDs. I am... by brajaram Communicator in Splunk Search 12-28-2018 0 5	0	5
max result lookups good afternoon I have a lookups that has 11737540 lines, but when I see it in splunk, it only shows me half \| i... by efaundez Path Finder in Splunk Search 12-28-2018 0 1	0	1