Splunk Search

Community Activity

Most efficient way to exclude two fields from a lookup Hi, Whats the most efficient way to use a lookup table within a query to exclude results where 2 fields exist, i.e. ... by jacqu3sy Path Finder in Splunk Search 05-21-2018 0 7	0	7
Search query taking ages to finish in Splunk 7.0.1 Hello, I have upgraded Splunk Enterprise to 7.0.1. One of the search query is taking ages to finish it. Same query f... by AKG1_old1 Builder in Splunk Search 05-21-2018 1 13	1	13
Extracting the data from Table Hi All, I am new to SPLUNK and building dashboards and I have requirement to count the records from the table No of... by varunapj New Member in Splunk Search 05-21-2018 0 1	0	1
Trellis Display of two values? I am currently using a trellis layout successfully for a timechart. These show activity today. I'm interested in h... by mfrost8 Builder in Splunk Search 05-21-2018 0 2	0	2
Forwarder throughput - Metrics vs TSTATS We are having issues with a OPSEC LEA connector. The Checkpoint firewall is showing say 5,000,000 events per hour. ... by john_glasscock Path Finder in Splunk Search 05-21-2018 0 4	0	4
Search Events with "\" character I was making some SQL dashboard and i can't use some variables cause one of them is the kerberos USER that comes like... by jnahuelperez35 Path Finder in Splunk Search 05-21-2018 0 4	0	4
help with using table and stats to produce query output I need to take the output of a query and create a table for two fields and then sum the output of one field. The two ... by ebailey Communicator in Splunk Search 05-21-2018 2 5	2	5
Pushing certain syslog messages to an Index Trying to separate leostream "broker" events that come from syslog into it's own separate index called leostream. Wh... by dcroteau Splunk Employee in Splunk Search 05-21-2018 0 5	0	5
How to remove field names displaying in the pie chart? I have written a query which produces a pie chart but I do not wish to display fields name in the pie chart. Can some... by bollam Path Finder in Splunk Search 05-20-2018 0 3	0	3
How to create a column/field based on the max or value of another column This is my sample search and corresponding output: \| makeresults \| eval data = " 1 2017-12 A 1557... by HattrickNZ Motivator in Splunk Search 05-20-2018 0 3	0	3
How to expand table based on click to the column Hello there, I've generated a table with data as below showing the % of data computed for various type of products. ... by krusovice Path Finder in Splunk Search 05-20-2018 0 4	0	4
Splunk Realtime report I am trying to create a dashboard in realtime , a savedsearch that ouputcsv then used that in the dashboard (20panel... by jadengoho Builder in Splunk Search 05-20-2018 0 3	0	3
How can I remove the fields X which has all zero values? OR how do I show only fields with non-zero values? This is may sample search and ample dataset: \| makeresults \| eval data = " 1 2017-12-01 00:00:00 A ... by HattrickNZ Motivator in Splunk Search 05-20-2018 0 7	0	7
Can I just do a timewrap on just 1 field/column? docs http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Timewrap Can I just do a timewrap on just 1 f... by HattrickNZ Motivator in Splunk Search 05-20-2018 0 2	0	2
About spliting events For example, the following logs are available. 2018-05-17 10:00:00.000 columnA columnB columnC 1111111 2222222 3333... by hasehiro New Member in Splunk Search 05-19-2018 0 2	0	2
How to stop field extractions from within path and url fields How do you stop Splunk pulling fields out of paths and url fields like this one path="/portal.php?mod=portalcp&ac=co... by proylea Contributor in Splunk Search 05-18-2018 0 4	0	4
Scheduled Base Search only showing several hours of events. I have a base search ("BaseSearch-SyslogsBro") that is scheduled to run daily in the morning which is utilized within... by splunkninga New Member in Splunk Search 05-18-2018 0 2	0	2
How to calculate start and end time from two different searches Hello, I am trying to calculate the total time it takes for a request to be processed. I have two searches, the fi... by kaphie2002 New Member in Splunk Search 05-18-2018 0 7	0	7
how to display only those rows which have the fillnull values index=abc \|chart sum(" Views") by "Site" ,"Event Date" \| fillnull value=0 how can I display only those rows which... by vrmandadi Builder in Splunk Search 05-18-2018 0 3	0	3
average calculation sourcetype="MATIZ" host=A OR host=B or host=C \| base search \| timechart span=1d eval(round(avg(response_time),2)) by ... by zacksoft Contributor in Splunk Search 05-18-2018 0 1	0	1
How to search logs for values on multiple lines? I have a log (IPs and user name altered): Time - ID - Command - Argument 2018-05-16T18:06:23.680096Z 225 Connect ... by richnsanders_70 Path Finder in Splunk Search 05-18-2018 0 15	0	15
Sorting the legend in a graph newest date to oldest from top to bottom This is my search. It is multiple timecharts timewraped per week SEARCH: index=... earliest=@w1 latest=+7d@w1\| ti... by HattrickNZ Motivator in Splunk Search 05-18-2018 0 1	0	1
Is there a list of unusable field names? Note: The question is not "how do I search for a field with the name of tag", but "what other field name(s) behave li... by krisreeves Path Finder in Splunk Search 05-18-2018 0 6	0	6
Regex string end of the url and in between 10.1.151.100 [18/May/2018:09:09:57 +0200] "GET http://example.com/DCQ/templates/GetAggregated?channel=TV&contentId=4e... by panandshah New Member in Splunk Search 05-18-2018 0 2	0	2
how to replace a lookup part in the splunk query with a saved search? I have a query as below which gives some output index="summary" search_name="ABC" \| dedup hostname \| join type=out... by pavanae Builder in Splunk Search 05-18-2018 0 1	0	1