Splunk Search

Community Activity

Will you help me fix my license usage by host query? Hello All, I am using Splunk version 7.1.0 for the Distributed Management Console (DMC) and I want to calculate the ... by vrmandadi Builder in Splunk Search 09-12-2018 0 4	0	4
How do you extract all values for respective fields from multi line event? I have below event in my log which is output of a single command. TIMESTAMP=2018-09-11T06:47:56\|HOSTNAME=a9tvdb152\|C... by twh1 Communicator in Splunk Search 09-12-2018 0 4	0	4
How to record/calculate the duration of overlapping transactions I have a transaction overlap issue. The output below is my data from search query with a transaction command. Here... by raynold_peterso Path Finder in Splunk Search 09-12-2018 0 2	0	2
Why is my below search throwing the following error: "Predict Error: Too few data points: -5." ? The search below throws the error whenever there are more than two hosts searched for.: command="predict", Too few da... by johnnyfrx Path Finder in Splunk Search 09-12-2018 0 0	0	0
How to do a real-time search with inputcsv? Per the real-time search documentation, you cannot use inputcsv in a real-time search. I'm looking to display real-ti... by nick405060 Motivator in Splunk Search 09-12-2018 0 5	0	5
How do I compare field results to counts? Hi I have three communication types: Start, Update, Restore. Each event can have multiple communication types to mul... by bcarnot Path Finder in Splunk Search 09-12-2018 0 3	0	3
How to calculate the difference between two fields from different sources? Hi All, please. How to get the difference between two fields from different sources? For example, know what is conta... by jfeitosa_real Path Finder in Splunk Search 09-12-2018 0 2	0	2
Why am I getting an Invalid result in span between two dates? This code: \| makeresults \| eval StartTime = strptime("2018-01-01 00:00:00", "%Y-%m-%d %H:%M:%S") \| eval End... by morethanyell Builder in Splunk Search 09-12-2018 0 2	0	2
Can you help me extract and replace a new field from present field? I have one field named as "data1" and I need to create another field named as "data2". In this new field, I need to c... by mustafag Path Finder in Splunk Search 09-12-2018 0 3	0	3
How can I add a static value into a table row? I would like to create a dashboard to have some charts for showing statistics of occurrence. The query for plotting t... by kcchu01 Explorer in Splunk Search 09-12-2018 0 3	0	3
Can you help me with my statistics table? Hi Team, I need help with the below use case. I have application logs in which each event has below fields salepro... by newbie2tech Communicator in Splunk Search 09-11-2018 0 1	0	1
How to edit my search to create a memory utilization dashboard for Windows machines? I am trying to set up a Memory utilization dashboard for Windows machines. I did try to set up the dashboard but I am... by vn86893 Explorer in Splunk Search 09-11-2018 0 2	0	2
Why is "stats latest(field) as FIELDNAME" not displaying any values under FIELDNAME in search results? My last stats command is not showing the values by sublocation. It shows each sublocation but no values are shown. ... by jhampton_3rd Explorer in Splunk Search 09-11-2018 1 3	1	3
Could you help me with arrays, expands and joins? Hello So I have data in TSV format that I am indexing. Some of the fields are arrays in the format of ['23458567','23... by tkwaller_2 Communicator in Splunk Search 09-11-2018 0 3	0	3
Why is '"foreach" ingoring some columns in the calculation? Hi, I'm trying to calculate the ratio for all columns of a table compared to a specific column. So in the example be... by HeinzWaescher Motivator in Splunk Search 09-11-2018 0 5	0	5
How to use regex on field names? For example. Is there any way to convert this: into this? Don't care about the numbers but the value of the seco... by tamakg Path Finder in Splunk Search 09-11-2018 0 8	0	8
Is there an easy way to pair two events with the same sourcetype that have the same values in different fields? I am looking for an elegant solution to the following problem: I want to summarize data from two different events whi... by ssiat479 Engager in Splunk Search 09-11-2018 0 5	0	5
How do you search all fields in a sourcetype with regex? The context: I'm looking for sensitive information patterns showing up in the IIS sourcetype that we have. What I ca... by CMSchelin Path Finder in Splunk Search 09-11-2018 0 3	0	3
How to create a scheduled job time to find the run time of each of the searches? I'm working w/ a similar issue as: https://answers.splunk.com/answers/512103/how-to-get-a-list-of-schedules-searches-... by moorvogi Path Finder in Splunk Search 09-11-2018 0 6	0	6
How do I use a sparkline within tstats to visualize data feed over the last 24 hours? I want to use a tstats command to get a count of various indexes over the last 24 hours. I also want to include the ... by DEAD_BEEF Builder in Splunk Search 09-11-2018 0 1	0	1
Simple XML drilldown link search won't recognize regex or rex I have a dashboard panel with a table. I am able to change the drilldown search when selecting a row in the panel tab... by flegel2 Explorer in Splunk Search 09-11-2018 2 9	2	9
How do I search for exact sequence of events? Hi All Wondering if anybody can assist. We're logging privilege user activity (GUI interactions etc) and looking to ... by kelvinJE Engager in Splunk Search 09-11-2018 0 3	0	3
How to show values and percentages on hover over columns in 100% stacked column chart? Hello, I have a graph that I'm displaying as a 100% stacked column chart. Even though the Y-Axis is set to 0-100 I ... by AlexMcDuffMille Communicator in Splunk Search 09-11-2018 0 3	0	3
Can you help me with my filtering search? Hi, I am trying to create a list of customers based on one event type but then show stats from all the events by tho... by simbug New Member in Splunk Search 09-11-2018 0 1	0	1
Problem Sourcetype - Extraction Hello, I receive logs from my server and I want to extract manually some field but I get this error : The events ass... by geantver0000 Engager in Splunk Search 09-11-2018 0 1	0	1