Splunk Search

Community Activity

eval parsing issue? index=xyz CurrentAgentSnapshot.Contacts{}.State=ENDED \| table CurrentAgentSnapshot.Contacts{}.StartTime There is ... by mwibowo1 New Member in Splunk Search 05-24-2018 0 7	0	7
Need a help in creating a dashboard to get information on the IP address? Hi, I got a request to create a dashboard to get the information on the ipaddress, with multiple panels and one input... by Hemnaath Motivator in Splunk Search 05-24-2018 0 3	0	3
How to get only second field=value from all events? Hi. I have 500 events where only second line of event have value for me. How to get that information from all events? by test_qweqwe Builder in Splunk Search 05-24-2018 1 1	1	1
Why is the iplocation command not showing city/region for all ip? I have an index "index_A" that contains IP address of client. But when I execute the following query, it does not sho... by kapilbk1996 Explorer in Splunk Search 05-24-2018 0 3	0	3
How to retrieve the last occurrence of an event right before another event I have a log4j log as source on Splunk 6.2.2 As in the title, I would like to get the first event that matches a sear... by lbentin New Member in Splunk Search 05-24-2018 0 1	0	1
How to send mail to the user in one mail if the values are combined? Hi There, I'd like to send mails to the people from my search table, the table looks like below: No. username Si... by garujoey Engager in Splunk Search 05-24-2018 0 10	0	10
How to perform stats count on all three indexes, and combine them to show as a Timechart? I have log file say A,B,C and their corresponding index is say index_A,index_B,index_C. I want to perform stats coun... by kapilbk1996 Explorer in Splunk Search 05-23-2018 0 2	0	2
what are the possibilities of getting different results for same search what are the possibilities of getting different results for same search ( there is no change in query and time) ? by raghu0463 Explorer in Splunk Search 05-23-2018 0 2	0	2
remove column name from \|table result I have a search that provides a table result: host="host1" index="main" \| head 1 \| table index host Is it possible... by Chubbybunny Splunk Employee in Splunk Search 05-23-2018 4 5	4	5
How to remove a column if only one column exists from a search? I have a timechart that shows the timechart of errors in a timeframe. index=......\| eval error=if(apiHttpStatus!=20... by brajaram Communicator in Splunk Search 05-23-2018 0 1	0	1
How do I count users that have logged in at least once a month for the last 3 months? Hi everyone, I want to do a distinct count of users that have: 1) Logged in at least once a month AND 2) They've ... by sharonmok Path Finder in Splunk Search 05-23-2018 0 8	0	8
How to Extract Named Capture Groups Using a Single Line in Props.conf Trying to extract named capture groups in a txt file, with the stipulation that it must be done from a single line in... by Kcrowley55 New Member in Splunk Search 05-23-2018 0 1	0	1
splunk functions process list Hi Splunkers i am traying to execute the next search using the function process "list" search \| stats list(FullName... by evinasco Communicator in Splunk Search 05-23-2018 0 1	0	1
Return only events where field value is in lookup table Hi all, I am running a search that returns many events. Some of these events contain a field value that is also in ... by bcarr12 Path Finder in Splunk Search 05-23-2018 2 1	2	1
Why am I getting error "No module named splunklib.searchcommands" trying to run a custom search command? Hey Everyone, Been struggling with this for hours now, when trying to run a custom search command I get: 'import s... by joseph_caraccio Engager in Splunk Search 05-23-2018 3 8	3	8
Use lookup file to match IP address from SPL query field to IP range in CSV file and return pertinent information for the range I have a CSV file ip_ranges that contains a list of ip_ranges along with the appropriate tag for that ip range. The C... by luigilombardi New Member in Splunk Search 05-23-2018 0 1	0	1
How to create custom relative time periods? I'm wondering if there isn't some way to use custom relative times in Splunk. I suspect not, but I thought I'd ask. ... by mfrost8 Builder in Splunk Search 05-23-2018 0 15	0	15
timechart for multiple, but similar, itemnames I am attempting to grab data from a set of Items that all have relatively similar names, i.e.: ItemName = LocX_VarY.... by splunk_question Explorer in Splunk Search 05-23-2018 0 5	0	5
How to use "set diff" and "diff" commands to list out new values in a file comparing different days/weeks/months/years? I have data which add new files every day. I want to compare today's data with previous day/week/month/year data and ... by chandana204 Communicator in Splunk Search 05-23-2018 0 3	0	3
How to calculate percentage based on 4 different searches Hello everyone. Want to display the output only for the time which crosses 18 months (earliest time) by rajhemant26 New Member in Splunk Search 05-23-2018 0 2	0	2
eventcount - spanning over week I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetyp... by brdr Contributor in Splunk Search 05-23-2018 0 0	0	0
Regex on input change In a dashboard, I have a dropdown input where the user can enter an IP address (customs value). I want to validate th... by oriolcamp New Member in Splunk Search 05-23-2018 0 1	0	1
How to join using a wildcard? I have a lookup that contains host names with wildcards. I am trying to do a inputlookup to grab those host names wit... by kdimaria Communicator in Splunk Search 05-23-2018 0 6	0	6
How to lump data into two groups by a field for a trendline? So I have some data which looks similar to this: time="timevalue", name="name", measurement="value" And I have 7 d... by splunk_question Explorer in Splunk Search 05-23-2018 0 5	0	5
How can I compare two search results in one chart? I would like to compare the result count of two search queries in one column chart (one column for each query and day... by tiptobi Explorer in Splunk Search 05-23-2018 0 6	0	6