Splunk Search

Community Activity

How do you create a link in a table that directs to a form on the same page? Scoured a ton of related questions, but none exactly like this have been posted yet as far as I can tell. I have an ... by nick405060 Motivator in Splunk Search 10-09-2018 0 2	0	2
How to make rows value into columns. I am trying to convert values from rows into columns. below is a example data ServerName Counter Value server1 %_P... by pratapbhanu2047 Engager in Splunk Search 10-09-2018 0 8	0	8
Compare historical hourly average with today's hourly data I am trying to show two things in one graph: 1) bar chart of the count of events for last 24 hours in hourly interval... by splunk2018a New Member in Splunk Search 10-09-2018 0 2	0	2
regex multivalue grouping Hi Guys, I am pretty new to regex and need help with getting repeated values from one event (record). Splunk is sho... by kakarsu New Member in Splunk Search 10-09-2018 0 3	0	3
Is anyone having issues with base searches in 7.2? Having some strange behavior with base searches right now. For example, we have events like this flowing into Splunk... by paimonsoror Builder in Splunk Search 10-09-2018 0 3	0	3
How do I bind values from different indexes with different fields? Good day sirs! I have two different indexes with different fields but same value-ish. index=a: MTH=SEPTEMBER index=... by rajyah Communicator in Splunk Search 10-09-2018 0 3	0	3
How do I get top 10 values of output based on "count(_raw)' values displayed in descending order? My query ends with \| stats count(_raw) by user I want the values to be displayed in descending order based on the... by zacksoft Contributor in Splunk Search 10-09-2018 0 2	0	2
How do I remove a string between the first occurrence of two strings in a query? I am trying to remove all content returned in a field between two specific strings but only from the first occurrence... by Wondergoat77 Engager in Splunk Search 10-09-2018 0 4	0	4
How do I create a drilldown for a specific cell location (not cell value) in a table? Hi there, I read a bunch of related Splunk answers, but so far I haven't seen a solution posted to creating a drilld... by nick405060 Motivator in Splunk Search 10-09-2018 0 9	0	9
How do I compare results from 2 indexes on a common field? Hi guys, Has anyone ever written a search that can compare events(in this case "indicator" across 2 indexes and show... by mwdbhyat Builder in Splunk Search 10-09-2018 0 4	0	4
How do I create a custom key indicator search on a normal Splunk dashboard? Hi Splunker; How do I create a custom key indicator search on a normal dashboard? I don't want to create a custom ke... by abdullahalhabba Explorer in Splunk Search 10-09-2018 1 0	1	0
How do I modify ID results in a table to display a URL or filepath? Hey there, I've been having a look around on here, and through Google, but so far coming I'm up blank. I'm looking ... by replicamask Explorer in Splunk Search 10-09-2018 0 3	0	3
sort coliumns row wise Hi , I have a rsult set like this : status eSIMEntitlement selfcare oauth2 account customer catalog moat ... by Mohsin123 Path Finder in Splunk Search 10-08-2018 0 2	0	2
How come frozenTimePeriodInSecs is not working as expected? HI Friends, I have more than 50 Indexes in my Splunk cluster. For a few of the Indexes, the earliest event is show... by pkumar9610 Explorer in Splunk Search 10-08-2018 0 7	0	7
Why is the Search and Reporting default overwritten during start up? The default folder under SPLUNK_HOME/etc/apps/search has been overwritten and all my changes are now in a default.old... by sarahafrin Explorer in Splunk Search 10-08-2018 0 2	0	2
Is there a good book for learning Splunk queries? Hi, Can someone suggest a good way (or a real good book) on how to learn splunk queries. any suggestions would be ap... by cosmo360 New Member in Splunk Search 10-08-2018 0 4	0	4
How do I get top values based on eval? I have a relatively simple query with which I am evaluating a new field. I'd like to get the top values of this new ... by jackpal Path Finder in Splunk Search 10-08-2018 0 2	0	2
How do I map a field from a lookup to a Splunk index? Hello Splunkers, I have a requirement to match a field from an index to a field in a lookup and then extract the res... by Sidharda Path Finder in Splunk Search 10-08-2018 0 1	0	1
How can I create a search with the stats command which breaks up results into separate rows? Trying to create a query that would search two different network logs (firewall and proxy) and return results. The re... by showard22 New Member in Splunk Search 10-08-2018 0 1	0	1
Why are comparisons not working with percentages as expected? Im working with some thresholds and I'm using \|eval score = if(percentage>Target, 1, percentage<=Target, 0) Looks s... by jamin358 Explorer in Splunk Search 10-08-2018 0 1	0	1
Is there an alternative to JOIN when records are more than 50000? Scenario - I have two indexes: index1 and index2. Inner Query: I need to compare two indexes (Index1 and Index2) wi... by srujan9292 Explorer in Splunk Search 10-08-2018 0 5	0	5
In a dashboard, can you help me with the HTML, CSS and Js for displaying a single number in a bubble chart? I am trying to display number of events by day, number of events of each day in a bubble chart where bubble size depe... by sandeepmakkena Contributor in Splunk Search 10-08-2018 0 0	0	0
How to extract field values in eval with tstats? \| tstats count from datamodel=~~ where Field1="A" by B, C \| eval Addition = B + C When I run above query, all value... by apple143 Engager in Splunk Search 10-08-2018 0 4	0	4
How come empty event information is being displayed? I've been seeing some occurrences in Splunk that I haven't been able to find a reason why this is being shown We use ... by cschavarro New Member in Splunk Search 10-08-2018 0 4	0	4
help with breaking events from router Good Day All. I came across a log file which seems to be missing the carriage and ends. Can anyone assist me in break... by ranjitbrhm1 Communicator in Splunk Search 10-08-2018 0 3	0	3