Splunk Search

Community Activity

How to create a search string to get data from multiple .txt files? Dear Team, I'm trying to to get data from two .txt files into a single Line Chart. For example, with the followin... by pascoaljo New Member in Splunk Search 09-18-2018 0 3	0	3
Why can't I see the logs in the search head when I select the time window? I can't see the recent logs in the search head for pan devices when i select the time window for anything except all ... by Yogesh7867 Engager in Splunk Search 09-18-2018 1 0	1	0
Why can't the addcoltotals command support an optional Boolean field for comma support? Please, why can't the addcoltotals command support an optional Boolean field for comma support? https://docs.splunk.c... by tb5821 Communicator in Splunk Search 09-18-2018 0 1	0	1
RESTapi error while using dbx query any idea how to fix this? curl -k -u rvanteru https://splunkang.brock.com:59447/servicesNS/rvanteru/splunk_app_db_connect/search/jobs/export --... by rreddy012c New Member in Splunk Search 09-18-2018 0 1	0	1
How do I match IPs with discontiguous mask? I am trying to match IPs from discontiguous mask as follow: 10.0.32.64/255.0.224.192 where as 1st octet: Match ex... by patricknguyen Explorer in Splunk Search 09-18-2018 0 2	0	2
How to edit my streamstats search so that values from a field are displayed? Hi Guys, I am facing a strange problem with streamstats command. Below is my search snippet. There are "blank" value... by Chinmai Explorer in Splunk Search 09-18-2018 0 1	0	1
Handling high number of events with streamstats Dear all, I have been working with streamstats for about 2 years by now and have been always facing the same issue :... by ecoquelin Explorer in Splunk Search 09-18-2018 0 3	0	3
How can I round to the nearest half with the eval command? Hello, I have some values that are in the format of : 0, 0.5, 1, 1.5, 2, 2.5, 3, 3.5, 4, 4.5, 5 I am trying to find... by tkwaller_2 Communicator in Splunk Search 09-18-2018 0 7	0	7
Cannot figure out how to do bucketing in Splunk using return values from previous row Been at this for a day or two. Can't figure it out. I have a list of efforts in a column [1 2 3 2 1 3 1 1 1 5] I ha... by Avaclon New Member in Splunk Search 09-18-2018 0 5	0	5
How can I use the output of streamstats in current row, and have it feed back into streamstats for next row? I need to calculate a running total, which uses two values from the previous row (one being this calculated total), a... by philtanner New Member in Splunk Search 09-18-2018 0 1	0	1
eval last event of 3 date fields Hello, 3 date fields (A B C) : in the source file \|20180830\|NULL\|20180223 How can I compare this 3 dates and extract... by splunkLPN Path Finder in Splunk Search 09-18-2018 0 9	0	9
Is there a way to check if a value is between a list of values? Hello! Is there a way to check if a number is between a list of ranges in a multi value field? For example on this ... by charlesmcdonald Path Finder in Splunk Search 09-18-2018 0 9	0	9
How to replace a character with blank/space value? My field name is 'fileName' and the values it contains are like this: PVOLFEPCL-00515+Berger+Profile+Settings.docx I... by zacksoft Contributor in Splunk Search 09-18-2018 0 2	0	2
Changing the now() reference point before running a saved search Is it possible to change the value of now (or the reference point it uses) so that I can back-date and run a saved se... by Kindred Path Finder in Splunk Search 09-18-2018 0 3	0	3
How do you present an All Green Dashboard when no alerts have been triggered? I have a requirement to present a management dashboard that shows the number of alerts triggered for any clients, but... by kozanic_FF Path Finder in Splunk Search 09-18-2018 0 4	0	4
Searching two indexes to compare and show the difference index="proxy_logs" category="none" \| top category, protocol, url, cs_Referer limit=1000 \| eval results = if(match(u... by SGun Explorer in Splunk Search 09-18-2018 0 6	0	6
How do you create a total column in a chart? Hi, I'm pretty new to Splunk and have been playing around with it. index=sse_cae_summary_idx new_sourcetype=sse_al... by barrowvian Explorer in Splunk Search 09-18-2018 1 6	1	6
How to search only events based on values from a field in lookup file? Lookup file jobsla.csv: Contains start and end batch jobnames for different apps, frequency the jobs will run on(like... by naraininfy Explorer in Splunk Search 09-17-2018 0 8	0	8
How do you use a range with the where command? TransactionName=WPP* \| stats count(TransactionStatus) as TOTAL count(eval(TransactionStatus == "true")) as SUCCESS c... by rsm1444 New Member in Splunk Search 09-17-2018 0 5	0	5
How do you search to return a table of only fields that change between events? Lets say I have a query that returns all of the updates for a given bug ID. This returns a result set for the specif... by smahone11 Engager in Splunk Search 09-17-2018 0 5	0	5
How do you remove all duplicate events from a search? I have two indexes, A and B. Events are copied using the \|collect command from Index A to index B. Later, I am trying... by strickland12345 Explorer in Splunk Search 09-17-2018 0 23	0	23
Why is the following regex expression not matching as expected? I have a field user= xyz\user11 and i need to match user11 ignoring xyz in the user filed below is the regex expres... by SunilMaharishi Path Finder in Splunk Search 09-17-2018 0 3	0	3
Best way to publish a live dashboard that does not allow the logged in user to search other data, and has a persistent login. I'm trying to put a dashboard on a TV in a high traffic hallway with people that aren't allowed to search the other i... by bgagliardi1 Path Finder in Splunk Search 09-17-2018 0 3	0	3
How do you use multiple y-axis fields while using the xyseries command? I have a static table data which gives me the results in the format like ERRORCODE(Y-Axis) and When It happens(_time... by rshivakrishna New Member in Splunk Search 09-17-2018 0 1	0	1
Why is tstats command with eval not working on a particular field? hi, I am trying to combine results into two categories based of an eval statement. The original query returns the... by nmohammed Builder in Splunk Search 09-17-2018 0 3	0	3