Splunk Search

Community Activity

How do I create a field that contains the differences between 2 other multi value (MV) fields? I have a search that returns two multi value fields. I am looking to create a third field which would contain the dif... by bkwoka Explorer in Splunk Search 10-08-2018 0 7	0	7
Need to extract fields at index time Hello Experts, I am new to Splunk and trying to extract fields at index time. I have distributed setup where have 2 c... by Ajinkya1992 Path Finder in Splunk Search 10-08-2018 0 7	0	7
Can you help me add a multvalue field extracting search to props? Hello Splunkers, I have the below search working fine and extracting fields so how can i add to props file to make i... by Splunk_rocks Path Finder in Splunk Search 10-08-2018 1 3	1	3
issue : splunk query is not displying correct result for negative number in range between min(-10) to max(-7) Hi , we have one field Score which contain floating poiint value(score) score -9.5 -9.4 -9.3 -9.0 -8.9 -8.7 -7.9 -7.... by PCIIT New Member in Splunk Search 10-07-2018 0 0	0	0
sourcetype linux_secure fields not extracted According to the Splunk documentation some sourcetypes will be automatically recognized. This includes linux_secure. ... by jeremyarcher Path Finder in Splunk Search 10-07-2018 0 8	0	8
How do I activate "_thefishbucket" index? Hi, Im trying to execute index="_thefishbucket" but I cannot get any kind on data, searching in forum looks like the... by sant1ago New Member in Splunk Search 10-06-2018 0 3	0	3
Is there a lookup table in Splunk ES for mac addresses? All, Is there a lookup table for mac addresses in Splunk ES ? Any formal way or tackling this if not? by daniel333 Builder in Splunk Search 10-06-2018 0 1	0	1
How do I divide the sum based on a criterion using the eval command? Hi I have the following search: [my search] \|dedup @timestamp \|stats sum(json_message.amount) as "total" by json_me... by xelian New Member in Splunk Search 10-06-2018 0 5	0	5
How expensive is sha256() in computing power? Our saved-search is summary-index enabled and is running every 5 minutes. Each event's uniqueness is a combination o... by morethanyell Builder in Splunk Search 10-06-2018 0 2	0	2
How do I convert milliseconds on y axis to seconds in query Splunk? Im trying to convert the milliseconds on the y axis to seconds, TM is the field that has the milliseconds. (TM field ... by Jewatson17 Path Finder in Splunk Search 10-06-2018 0 2	0	2
How do I perform eval function on chart values? Example Search: Index=* \|chart count over Character \|addcoltotals Example output: Char ........Count A... by Romeo_James Engager in Splunk Search 10-05-2018 0 1	0	1
How do you extract and aggregate on field names instead of values? I am working with a log format that contains some upstream and downstream request details, containing a URI and a var... by bcatwork Path Finder in Splunk Search 10-05-2018 0 2	0	2
How do you take a value out of a field and make a new field with it? How do i take out the port number (portnr) from the args field and make it to a field called "port" by a search? Can... by aatha89 Explorer in Splunk Search 10-05-2018 0 8	0	8
How do you consolidate values when fields are the same? Hey guys, thanks for taking time out of your day. I'm relatively new to Splunk and just need help with formatting s... by riffe88 Engager in Splunk Search 10-05-2018 0 6	0	6
How to get the field name of the maximum value of several fields? I have data that has several fields. I want to compare the fields to find the max value of them, which I can do via ... by brajaram Communicator in Splunk Search 10-05-2018 0 2	0	2
How come the text input token is not filtering out all results? I'm having trouble filtering results using a text input token. When I enter the name of an application, the record... by gbwilson Path Finder in Splunk Search 10-05-2018 0 11	0	11
How do you group data in 5-minute windows? I have several lines which look like : 2018-10-05 15:10:00.000, STEP="STEP1", VALUE="1965.00000", ZONE="CITY1", CODE... by celianouguier Explorer in Splunk Search 10-05-2018 0 1	0	1
How do I convert results to an X-Y table? I have query results that look like this: Risk Age Total High gt30 16 High gt60 3 High ... by claatu Explorer in Splunk Search 10-05-2018 0 8	0	8
How do I use the addcoltotals command with a stats list or stats values? How do I use addcoltotals with a stats list or with stats values? I'm trying to include the totals for each line val... by johnward4 Communicator in Splunk Search 10-05-2018 0 5	0	5
How do I use a field with a dash (-) in an "if" search? I get a minus error if the search if looks like this: index=my_index sourcetype=my_sourcetype \| eval my_field = if (... by jwhughes58 Contributor in Splunk Search 10-05-2018 0 3	0	3
How do you compare several values to get the highest one? Hello, I want to compare several values to get the highest one. For example: index / count .................... by sant1ago New Member in Splunk Search 10-05-2018 0 2	0	2
Can you help me create a table like the one in the following example? Dear Team, I have data in this format, as shown in actual and expecting results as shown in expected. Is this achiev... by syjayaraj Explorer in Splunk Search 10-05-2018 0 3	0	3
Could you help me with the syntax for an "IF/THEN" and "IF/ELSE" search? Hi , i want a syntax for this: if Response_time>3000 then Response_time="gt3SEC" else if Response_time>1000 and Re... by Mohsin123 Path Finder in Splunk Search 10-05-2018 0 7	0	7
How do I extract multiple key values from a double quoted JSON? I have data in splunk as following: log: [INFO ] 17:01:43.572 : [main] o.a.k.c.Processor:process(103): response ... by baskarkrishnanc Engager in Splunk Search 10-05-2018 0 7	0	7
How do I find events that have a specific value in an array of JSON strings? I have a JSON object that includes a field that is an array of strings. So something like this: { "tags": [ "v... by cpomerantzuniso New Member in Splunk Search 10-05-2018 0 1	0	1