Splunk Search

Community Activity

	Sorting the legend in a graph newest date to oldest from top to bottom This is my search. It is multiple timecharts timewraped per week SEARCH: index=... earliest=@w1 latest=+7d@w1\| ti... by HattrickNZ Motivator in Splunk Search 05-18-2018 0 1	0	1
	Is there a list of unusable field names? Note: The question is not "how do I search for a field with the name of tag", but "what other field name(s) behave li... by krisreeves Path Finder in Splunk Search 05-18-2018 0 6	0	6
	Regex string end of the url and in between 10.1.151.100 [18/May/2018:09:09:57 +0200] "GET http://example.com/DCQ/templates/GetAggregated?channel=TV&contentId=4e... by panandshah New Member in Splunk Search 05-18-2018 0 2	0	2
	how to replace a lookup part in the splunk query with a saved search? I have a query as below which gives some output index="summary" search_name="ABC" \| dedup hostname \| join type=out... by pavanae Builder in Splunk Search 05-18-2018 0 1	0	1
	query help inputlookup map \| rest /services/authentication/users splunk_server=local \| search [\| rest /services/authentication/current-con... by surekhasplunk Communicator in Splunk Search 05-18-2018 0 3	0	3
	passing host field in custom script in alert. I am trying to run a custom shell script with the hostname returned in my results. How to get the hostname field pass... by praneshjan Explorer in Splunk Search 05-18-2018 0 1	0	1
	I am not seeing all my indexes with this REST call, what am I missing? All, I am using this command to read in my indexes.conf into Search. But for some reason it's not showing my index=... by daniel333 Builder in Splunk Search 05-18-2018 0 3	0	3
	Output lookup Hi, Im trying to output another column from a lookup table i have created named "threatlist.csv". The problem im ha... by hmrabet2 Observer in Splunk Search 05-18-2018 0 9	0	9
	Why am I getting this error "External search command 'WinAD' returned error code 1" ? I'm trying to 'Custom search command starter example' on the splunk's site. So, I'm getting this error "External sear... by seisuke New Member in Splunk Search 05-18-2018 0 0	0	0
	What is an easy way to display the last 30 days _time in a table? I just wanna display last 30days _time in a table I am using Index=_internal earliest=-30d \| bucket _time span=1d... by akhil4mdev Explorer in Splunk Search 05-18-2018 0 12	0	12
	Use of Outputlookup results in further search I am trying to find the list of packages installed in all hosts. if any host doesnt have that package installed, I am... by prsshini New Member in Splunk Search 05-17-2018 0 1	0	1
	Splunk shows "The lookup table does not exist" My splunk show the following message suddenly but I don know how to solve it. I tried to search 'ns_log' and 'ns_msg_... by peterchow Explorer in Splunk Search 05-17-2018 0 6	0	6
	How to extract a field with special characters? Hi, I have a log statement that prints service execution time like - Service Response : {"entity":"{\"transactionI... by mugilbala Engager in Splunk Search 05-17-2018 0 2	0	2
	How to use the earliest and latest date in Metadata, metasearch, and tstats command? I was wondering whether Splunk supports earliest and latest date in Metadata, metasearch, and tstats command? I trie... by rakeshksingh New Member in Splunk Search 05-17-2018 0 3	0	3
	How to find out difference between two fields and their tables? Hi All, I have two fields which consists of data of 48 hours and 24 hours, but couldn't able to find the difference ... by rakeshksingh New Member in Splunk Search 05-17-2018 0 3	0	3
	How to merge multiple events into single events? Hello Splunkers, I have one file whose starting line can be anything but that file ends with "Completed Backup" line... by kannu Communicator in Splunk Search 05-17-2018 0 4	0	4
	how to combine two sources from same index with a common field Hello, I have and index=A with two sources A and B and I want to get two fields(Geo_Name,Geo_Type) from source B us... by vrmandadi Builder in Splunk Search 05-17-2018 0 6	0	6
	Unable to find from where a field is being extracted I have checked all my forwarder and indexer and search head apps. but unable to find from where a field it's extracte... by maniu1609 Path Finder in Splunk Search 05-17-2018 0 3	0	3
	use of rex result in an eval, convert to number I have a long rex command that generates a bunch of fields, this works perfectly. In the left side field explorer in ... by grantsmiley Path Finder in Splunk Search 05-17-2018 0 3	0	3
	Search not showing all events Hi, i do have the following problem: index=atmo_pc sourcetype=SE10 Station=60 as you can see, my search is pretty... by EricMueller0619 New Member in Splunk Search 05-17-2018 0 4	0	4
	Search restriction to specific index issue in Splunk Cloud Hi All, Currently, I possess Splunk Cloud Environment. Currently, I am facing Search restriction to specific index ... by santosh_hb Explorer in Splunk Search 05-17-2018 0 0	0	0
	how to use mvfilter to find out three or more evals? suppose my search like this \| eval A1=mvindex(mvfilter(a1="1" OR a2="2" OR a3="3") \| eval B1=mvindex(mvfilter(b1="1"... by 90509 Engager in Splunk Search 05-17-2018 0 1	0	1
	Graph of rolling totals Hi, I want to create a graph that shows calculated values by time. Each value must be calculated as the number of u... by andrewbeak Path Finder in Splunk Search 05-17-2018 0 3	0	3
	Get count from multiple urls based on required properties I am having below content with different (4 sets)urls presented in my logs, having index="abc_uyt" RuntimeException... by arjun_krishna Explorer in Splunk Search 05-17-2018 0 10	0	10
	how to search same event occur four times in five minutes i got a mission from my manager, search the the same account login failure event occur four times in per five minute... by lllidan New Member in Splunk Search 05-17-2018 0 10	0	10