Splunk Search

Community Activity

Can you help me to extract a specific event from a log? Hello In a report, i used the code below in order to search for an error code in my events. But, when a code is fou... by jip31 Motivator in Splunk Search 10-03-2018 0 2	0	2
In a search, how do you group similar URL patterns? I am doing a search and evaluating count, avg RT based on some URL patterns. Below are the URLs for my category pages... by alex129 New Member in Splunk Search 10-03-2018 0 8	0	8
Can you help me with my query that uses multiple where conditions? I have a search to identify when a particular server activates "hardware mode" and doesn't exit within a certain time... by jcleary47 Path Finder in Splunk Search 10-03-2018 0 2	0	2
How do I return lookup events only if they match certain field values? Hi, I have two lookup files below: masterinventory.csv type make model year storeID keycode... by russell120 Communicator in Splunk Search 10-03-2018 0 3	0	3
How to extract values where the field name has multiple spaces? Hello, I'm trying to figure out a way to extract values where the field has multiple spaces in it. When I do a sim... by gnoellbn Explorer in Splunk Search 10-03-2018 0 8	0	8
i have a join query which i need to optimize using OR and Stats, Since i am dealing with timestamp and fetching last(field), i am struggling, Can any one help? index="index1 sourcetype="sourcetype1" \| join deviceId [ search index="index2" sourcetype="sourcetype2" productFamil... by m4sucess New Member in Splunk Search 10-03-2018 0 7	0	7
How can I get time picker earliest and latest epoch values before doing a search? Hi, How can I get 'raw' earliest and latest value before doing search? I need the epoch seconds format, so -1d@d co... by lukasz92 Communicator in Splunk Search 10-03-2018 1 10	1	10
How do you show a row count in a dashboard panel? Hello All I am not sure how to show the row count in my dashboard. I have one panel that searches a list of hosts... by edwardrose Contributor in Splunk Search 10-03-2018 0 2	0	2
How do I extract the latest occurrence of a field from multiple lines? Want to capture the latest occurrence of "working_condition_check - status -" which is "Stopped". Please help me in... by nkchaitanya Explorer in Splunk Search 10-03-2018 0 2	0	2
Can you help me use the rex command to parse API's JSON? I have the following JSON, but I'm not really familiar with Splunk's rex function. I tried this command without succe... by gcescatto New Member in Splunk Search 10-03-2018 0 1	0	1
How to calculate the "number of files" field in the table colunm of "Files & directories Hi, I would like to know how to calculate the "number of files" field in the table colunm of "Files & directories",w... by Shuhei052492 Path Finder in Splunk Search 10-03-2018 0 0	0	0
In a search, How do I get the next to the last value(or field)? I have data that looks like this; When I perform my search the data returned by Splunk looks like this on the dashbo... by hartcl1 Explorer in Splunk Search 10-02-2018 0 2	0	2
How do I combine " \|stats count by host " and "\| stats distinct_count(host)" in one table? I can search for events and run stats count by host. And I can run a search of distinct number of hosts. I want t... by pretzel2 Path Finder in Splunk Search 10-02-2018 0 8	0	8
Is there a way to search for what searches have been run over a period of time and by who? Hi, Is there a way to search for what searches have been run over a period of time and by who - preferably listing t... by Skins Path Finder in Splunk Search 10-02-2018 0 2	0	2
Error after stats command Hi, I need your help, I have a search like this index=test sourcetype=XY \| stats count(Field1) AS f1 by action=... by hoerberm New Member in Splunk Search 10-02-2018 0 4	0	4
Can you help me optimize this query without join using stats and OR? index="index1" sourcetype=show_command \| join id [ search index="index2" sourcetype=software_data ] \| sort _time \| ... by m4sucess New Member in Splunk Search 10-02-2018 0 3	0	3
How do I create an alarm if a value stored in a CSV changes? Hi, I have a CSV file with the following structure: NAME DiskSerial ProcSerial ... by josedgaravito New Member in Splunk Search 10-02-2018 0 1	0	1
How do I join an index with a lookup? Hi, I need to join my query with a lookup which contains a field called username. I need to get the users who — exi... by Shashank_87 Explorer in Splunk Search 10-02-2018 0 1	0	1
How do I extract IP and port using regex in Splunk Cloud? Hi , May I please get some help on extracting 1) IP only 2) IP and corresponding port together Connection termin... by harishnpandey Explorer in Splunk Search 10-02-2018 0 4	0	4
How do you join 2 tables while showing what's not in table 1? This successfully shows a combined table with users that are in Table1 and Table2. However, I want to show all users ... by zaynaly Explorer in Splunk Search 10-02-2018 0 3	0	3
How do I use the tstats command to count field pairs? Hello everybody, i want to count how often does a specific pair of src-dest appear... something like src, dest, co... by alex_kh Explorer in Splunk Search 10-02-2018 0 1	0	1
Chart Drill Down changes Date time range I have a dashboard with a chart inside it. The query of the chart is: base_search \| eval _time = time\| bucket _time... by shayhibah Path Finder in Splunk Search 10-02-2018 0 5	0	5
Join two stats searches and run stats/group on the result I'd like to join two searches and run some stats to group the combined result to see how many users change/update bro... by gregorymountfor Explorer in Splunk Search 10-02-2018 0 0	0	0
No results DBX I like to use DATABASES. I connected DBX and made a connection. With the query: \| dbxquery query="SELECT * FROM \"XXX... by LH_SPLUNK Explorer in Splunk Search 10-02-2018 0 1	0	1
How do I remove a particular row from my stats command based on the value of another row? source="something_source" topic="something_topic1" OR topic="something_topic2" earliest = "-1d" client="cpu1305" \| st... by avisriv New Member in Splunk Search 10-02-2018 0 2	0	2