Splunk Search

Community Activity

How to search a field for values that are stored in another field? Hi, Can you please help me with the following case? I'm trying to use the value of a field to search within the valu... by macoo Explorer in Splunk Search 09-27-2018 0 6	0	6
How do you reference a field value as a field to use in a table? So I have a field day_Today=Friday Now I want to use the value of day_Today as a field in my table \| table Date va... by michaelrosello Path Finder in Splunk Search 09-27-2018 0 3	0	3
How to extract data using regex? Hi All, I Have data in below mentioned format. I need to extract value CUP_Used and cup_used using regex and store i... by Shan Builder in Splunk Search 09-27-2018 0 5	0	5
Could you help me with my regex expression? hi I would like to extract the field in bold with a regex: 06/09/2018 - 14:23:01 -- End of installation of ePO (5.0... by jip31 Motivator in Splunk Search 09-26-2018 0 2	0	2
Will you help me with this string to date conversion? I'm struggling to convert this to a Splunk readable format. Sep 18, 2018 17:25:24.870411000 Can you me figure out h... by jiaqya Builder in Splunk Search 09-26-2018 0 4	0	4
How do I combine subtotals and totals in a search query? Is it possible to do this? Should I use appendcol? multisearch? join? Please enlightened me. Scenario: The IP below... by rajyah Communicator in Splunk Search 09-26-2018 0 5	0	5
Ignore empty data point when calculating average I am trying to calculate the average for a few columns and rows but I have came across the following issue. Some rows... by ermosk Engager in Splunk Search 09-26-2018 0 10	0	10
Transactions and reporting multivalue event types Hi all. I'm having trouble expanding a multivalued Transaction into separate fields by their corresponding values. I'... by dmart New Member in Splunk Search 09-26-2018 0 0	0	0
Can you help me convert a field value extracted by a rex command to another date time format? Hello Community, I have certain field values extracted by using rex command. The timestamp format of the field value... by ameyapatil29 Explorer in Splunk Search 09-26-2018 0 2	0	2
How can I make a correlation between events where one is a calculated field and the other field is not in all the events? A requirement is to get a list of domains (src_host) with the count of their actions (blocked, delivered) associated ... by ssyed2009 New Member in Splunk Search 09-26-2018 0 0	0	0
How do I compare two time slices? I have a search that I want to run twice, but for different time slices. The result of the two slices will then be co... by asturt Explorer in Splunk Search 09-26-2018 0 4	0	4
In a table, how do I get the count for multiple field results? Hi All, I've been trying to figure out for some time how to get the count of the events for each individual fields a... by zovinchong New Member in Splunk Search 09-26-2018 0 9	0	9
How do I sum or subtract values depending on 2 distinct fields and chart them? Hi folks, I have a table in the following format: Date Buy(qty) CurrencyBuy Sell(qty) Curr... by ADRIANODL Explorer in Splunk Search 09-26-2018 0 1	0	1
Why does addcoltotals not display decimal totals? Hello, I've noticed that the addcoltotals command doesn't display decimals if the total contains a decimal. Run anyw... by andrewtrobec Motivator in Splunk Search 09-26-2018 0 4	0	4
Can you help me Join 3 source types using OR? It would be great if anyone could help me to join data from 3 source types: 1) sourcetype_1 has fields AA,MM,CC,Amt1... by poojak2579 Path Finder in Splunk Search 09-26-2018 0 6	0	6
Why am I getting an "unknown search command error" when trying to execute a custom command on the Search Head? I have created a custom generating command on the search head. I also want to execute this command on the search head... by kiril123 Path Finder in Splunk Search 09-26-2018 0 0	0	0
How do you feed a variable to an LDAP search to resolve account name to displayname? I'm having an issue taking a search I have and feeding one of the results to an LDAP search to generate a new field t... by splunkbacon Explorer in Splunk Search 09-26-2018 0 2	0	2
Why is my JSON regex expression not working properly? I have a JSON file, which is being indexed by Splunk, the format is like - { testdata : [ { "test... by Dawson014 Path Finder in Splunk Search 09-26-2018 1 7	1	7
Can you help me integrate a lookup into a search? I am trying to integrate a lookup into a search with no success. My goal is to run the search, lookup the hostname o... by donemery Explorer in Splunk Search 09-26-2018 0 5	0	5
The Splunk search shows that events exist, but why does the Events tab show "No results found"? I am trying to list specific events, but I am not able to view them. Splunk shows that events exist, but it comes up ... by yasinmoha Path Finder in Splunk Search 09-26-2018 3 15	3	15
Including a total line for stats by X hi, i use stats for a lot of reports, generally using a "by" clause. Is there a way to generate a summary line for st... by brettcave Builder in Splunk Search 09-26-2018 2 3	2	3
Why does data model show name of lookup definition in its fields? Hello, in the past few weeks, we have run into some strange behavior with a data model. It is somehow connected to g... by tomaslulei Engager in Splunk Search 09-26-2018 1 0	1	0
Outlook Launch Time query issue We are currently using Event 45 to calculate the average load for Outlook: Microsoft KB & Sample Data What we have f... by MartinMcNutt Communicator in Splunk Search 09-26-2018 0 6	0	6
After joining two counts with dbquery, why are the results getting truncated? I have one query where I want to get the results in terms of installed,uninstalled and exception machines. We are ge... by kumagaur New Member in Splunk Search 09-26-2018 0 5	0	5
How do I apply $ symbol for Y-axis values in a Splunk Chart? How do I apply $ symbol for Y-axis values in Splunk column Chart? In the dashboard visualization, we are trying to a... by kvr New Member in Splunk Search 09-26-2018 0 2	0	2