Splunk Search

Community Activity

Multiple stats counts on different criteria Hi all, first question on Splunk Answers. I just finished the Fundamentals I training and am now wanting to do some m... by guythomasdavis Explorer in Splunk Search 07-03-2018 0 4	0	4
How to limit runtime for a search? Hi, Is there a setting to limit max runtime for a search? I don't see anything obvious. by a212830 Champion in Splunk Search 07-03-2018 0 4	0	4
Fetch the latest _raw event I have query which goes like this sourcetype="A" host=B \|rex "^(?:[^ \n]* ){2}(?P<user>\w+)"\|rex "^(?:[^... by zacksoft Contributor in Splunk Search 07-03-2018 0 1	0	1
how to see pan and zoom selected in a chart when dashboard is copied Hi, i want to send a dashboard link to someone, after selecting a zoom/pan in a chart and i want that pan to be copie... by monteiroh Explorer in Splunk Search 07-03-2018 0 12	0	12
Is there a function to create MD5 hash? Hi, is there a function to create the MD5 hash of a value? Cheers Heinz by HeinzWaescher Motivator in Splunk Search 07-03-2018 0 1	0	1
Calculate percentage between 2 reports Hello I use 2 reports with the code below index="windows-wmi" sourcetype="wmi:DiskRAMLoad" host="$field1$" (Name="m... by jip31 Motivator in Splunk Search 07-02-2018 0 4	0	4
Event count mismatch when using using `field_name="*"` and `field_name!=""` in tstats query Why is there a difference between the number of events scanned in both these queries? Using below query getting stati... by jshah24 Explorer in Splunk Search 07-02-2018 1 4	1	4
When i add a lookup search, source field goes missing Here is my query > index="test" (source="28q" OR > source="29q") \| bucket _time > span=1d as day \| rex field=_r... by premraj_vs Path Finder in Splunk Search 07-02-2018 0 1	0	1
Missing subsearch results I've created a search that is composed of two subsearches. I have a dashboard where if I search an application name,... by gbwilson Path Finder in Splunk Search 07-02-2018 0 6	0	6
Populate dropdown menu using lookup and tokens with multiple field values I am trying to populate a dropdown menu using a lookup table that contains all my server's hostname in one column and... by johnward4 Communicator in Splunk Search 07-02-2018 0 7	0	7
how to use transaction command for event spanning multiple days I'm trying to show the total HVAC usage during the day using transaction command: name=thermostatoperatingstate \| t... by jassal New Member in Splunk Search 07-02-2018 0 2	0	2
Splunk - How do i build a timeline chart to trace a transaction that has multiple asynchronous processes I would like to create a timeline view that shows the begin/end time of every event for a given transaction. The tran... by eplate New Member in Splunk Search 07-02-2018 0 2	0	2
How to merge one query with another one that has the same field? I currently have this search query: source="C:\Users\ragate\Desktop\splunk\JsonDump.txt" \| eval "LicenseKeyID"=su... by Ragate Explorer in Splunk Search 07-02-2018 0 3	0	3
Can I pass an indexed Date value to the time picker? As far as I know the time picker searches based on the time that the data was indexed in Splunk. I need to search bas... by calarie001 Explorer in Splunk Search 07-02-2018 0 5	0	5
Hybrid Search not working in Splunk Cloud "The searchhead is unable to update the peer information. Error = 'Master has multisite enabled but the search head is missing the 'multisite' attribute' for master" When I join the Hybrid Search Head to Cloud clustermaster I get this error. The searchhead is unable to update the p... by khourihan_splun Splunk Employee in Splunk Search 07-02-2018 0 2	0	2
Why is my scheduled search so much quicker than my adhoc search? Hi, I have a number of scheduled searches which run significantly faster than the same search run from the search-ba... by a212830 Champion in Splunk Search 07-02-2018 0 7	0	7
Transaction with multiple down events but only one up event results in incorrect duration calculation I've created a dashboard showing downtime for BGP adjacencies and WAN circuits. It works (almost) perfectly, but rece... by NJL Explorer in Splunk Search 07-02-2018 0 4	0	4
avg many fields HELLO I try to do an avg on multiple fields but i dont succeed for one field i use this / stats avg(ReadOperation... by jip31 Motivator in Splunk Search 07-02-2018 0 3	0	3
How to build a lookup table with a condition? I have a lookup of epoch times: epoch_time_lookup.csv Start Time End Time 1529737700 1529737800 1529737600 15297... by joydeep741 Path Finder in Splunk Search 07-01-2018 1 2	1	2
Why is the query with 3 sub search returning several items? Hello there ! This is my first post here  I've already read a lot of query/answer, try a lot of things, but .... ... by tomtomFR Explorer in Splunk Search 07-01-2018 0 7	0	7
How to show a true value for the If function? Hello All i have the below query which is based on a ping request running on the back end. the data looks like this ... by ranjitbrhm1 Communicator in Splunk Search 07-01-2018 0 3	0	3
AND condition in Regex I need solution for the following example, My String : {<!-- -->{My_pa{ss}word}} In this string I want to select only star... by Piraisudan New Member in Splunk Search 06-30-2018 0 3	0	3
How can I split similar fields into multiple related events? I have some events like this. Wifi AP and DEVICE connected to it. A one to many AP to DEVICE relationship exists AP,... by pwild_splunk Splunk Employee in Splunk Search 06-30-2018 0 2	0	2
Spunk Search Query for Trimming and Grouping Hi, I have a CSV named Results2018. It has fields Group, Server, Issue. The field Issue has information about CPU ... by mbasharat Builder in Splunk Search 06-30-2018 0 6	0	6
How to configure Splunk statistics table to display more than 100 rows? Hi all, How to configure Splunk statistics table to display more than 100 rows? can this be achieved by editing a sp... by mjlsnombrado Communicator in Splunk Search 06-30-2018 1 1	1	1