Splunk Search

Community Activity

Why does "mvexpand X" remove events with X=NULL? Why does mvexpand X remove events with X=NULL? As simple as that. It's illogical from my perspective, unless it's on... by macoo Explorer in Splunk Search 08-23-2018 4 3	4	3
How do I convert a country name to country code (or vice versa)? How do I convert a CC to a country name in Splunk, or vice versa? Since Splunk Answers won't let me post this quest... by nick405060 Motivator in Splunk Search 08-23-2018 1 6	1	6
How to use regex to reformat a field? Need assistance regex to reformat the field the field is Message. And the output is "Reason: Details: Attributes: ... by ronbuzon New Member in Splunk Search 08-23-2018 0 11	0	11
How to remove some extra options from a custom time picker? Hello, I am looking to remove some extra options from Time picker. I have disabled them through GUI (User Interface ... by AKG1_old1 Builder in Splunk Search 08-23-2018 0 7	0	7
Why are both of my new time fields are coming out as being the same when using streamstats? I'm running my search over the last 7 days and attempting to get the earliest time along with the value of the count ... by tb5821 Communicator in Splunk Search 08-23-2018 0 1	0	1
Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup) Hi, I am looking for some help on how to remove the malformed expression error coming from the query below, many th... by ChrisCLewis Communicator in Splunk Search 08-23-2018 0 7	0	7
Java SDK - Search strings syntax understanding Hello, I'm new with Java SDK and this is what I don't understand in my use of it so far : Question 1: I am using t... by michel_hc New Member in Splunk Search 08-23-2018 0 6	0	6
Combine multiple rows in one with a common key Hello, I have a log that records data bit by bit. I want to combine them to have only one row of data. ... by lyds Explorer in Splunk Search 08-23-2018 0 3	0	3
Performing Sum Calculation when Field values are combined Captured fields are Account, RequestorCode, Service, and ElapsedTime. An Account will have multiple RequestorCode, an... by limalbert Path Finder in Splunk Search 08-22-2018 0 14	0	14
how to combine more than three types of charts in one chart. hello everyone, I'd like to know how to combine three types of charts in one chart. I'd like to make just one chart ... by jenny_life Path Finder in Splunk Search 08-22-2018 0 9	0	9
On what user does splunk start after restarting it from deployment server Hi, When we restart splunk forwarder from deployment -server does it start 1) based on user defined in boot script O... by ankithreddy777 Contributor in Splunk Search 08-22-2018 0 3	0	3
Unable to get count when variable names has a "-" One of the queries i'm using has a variable with a "-" and splunk is unable to get me the stats count using the varia... by vjzone Path Finder in Splunk Search 08-22-2018 0 8	0	8
How to use regex to extract just the ID inside of the brackets? So I have this data Aug 22 09:13:46 someservername <118>1 2018-08-22T09:13:46.743+00:00 ip.address LOGSTASH - - - ... by thefuzz4 Path Finder in Splunk Search 08-22-2018 0 8	0	8
How do I filter results based on approximately 115 partial values of a field? I have a list large list of products. I need to search the list but filtering out some results based on the partial v... by faustof Explorer in Splunk Search 08-22-2018 0 2	0	2
count null timechart spans Hi, I have the following search that displays a table with time as rows and conferenceID as columns. i only want to... by mwcooley Explorer in Splunk Search 08-22-2018 0 2	0	2
How to sum two numeric fields resulting in a concatenation of the two fields? Hello Splunk Ninjas, First time I've seen this: I have two fields, clearly regognised as numeric fields by Splunk. T... by patouellet Path Finder in Splunk Search 08-22-2018 0 2	0	2
How can I combine two chart query outputs as 1? Part A: index=web splunk_server_group=hotel sourcetype=hotellog eventname=hotel-book earliest=-3d\| eval dateyearwe... by reetesh121 New Member in Splunk Search 08-22-2018 0 1	0	1
unable to extract all matching values in a single line; the interesting field only captures first matching value. The string is a single line, i am unable to extract all matching value in this line. The interesting fields that Splu... by syjayaraj Explorer in Splunk Search 08-22-2018 0 3	0	3
How can I join two searches on a common field? I'm trying to append a two tables on a common key. I am using \|appendcols but the two tables are not internally joine... by alanzchan Path Finder in Splunk Search 08-22-2018 0 1	0	1
lookuptable compare with new event I called all the errors and created to lookup-table. I want to create a job which would compare the last 5 minutes o... by Satsan Engager in Splunk Search 08-22-2018 0 2	0	2
Find Time between events, including current Time. Hello all, I've seen examples of how to find time between events using streamstats, and also to find the time since ... by jrnastase Explorer in Splunk Search 08-22-2018 0 1	0	1
Searching strings with accented characters Hello, I'm having an issue when trying to filter events based on accented characters. For instance if I look at th... by LordLeet Path Finder in Splunk Search 08-22-2018 0 6	0	6
View full source of the log file I have a need to view/export the source a log file. Requirement is to export all lines of the log file within a date/... by madsplunk123 New Member in Splunk Search 08-22-2018 0 2	0	2
What are some of the best practices for field extractions? Hi, There is some debate in our group regarding best practices for field extractions. We have a feed that has well ... by a212830 Champion in Splunk Search 08-22-2018 0 3	0	3
find max length where field name is firstName_1,firstName_2... My splunk entry is firstName_1="Tom" firstName_2="Jerry" firstName_3="Tom1" firstName_4="Jerry1" I would like to fin... by dummy1281 Engager in Splunk Search 08-22-2018 0 6	0	6