Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
1,000 results
Sorted by:
07-24-2018
02:24 AM
Hi all,
I have below query and the results like below table, is there a way that only search and display total count for the Users who have error(User1, User2, User3)?
index=aaa sourcetype=...
- Tags:
- appendcols
- stats
- total
03-27-2019
06:55 AM
...ith this approach is that there is a join row limit and with my dataset being so large it is not feasible as there is far more Process Events than the join limit.
The next approach I had was to use subsearch...
05-27-2020
07:06 AM
My first subsearch – and its not going well. I have two queries I need to combine to get a single results table.
My first query finds how many changes there have been and when the most recent c...
11-05-2018
05:37 PM
I'm trying to sort smartsheets by certain combinations of row/column values. If I remove one of the 'foreach' blocks, the search works, outputting a new field. With both, however, the search returns ...
02-06-2015
07:36 AM
...ourcetype=ironport mailto=%form_var%
which will result in a fields that I can use (icid) to then find the mailfrom field. So I am thinking about a subsearch like:
index=email sourcetype=i...
09-10-2019
02:19 PM
Need some advice writing a subsearch...
I have an index=email with two sourcetypes
sourcetype=MTA
sourcetype=MSG
both contain a field with a common value that ties the msg and mta logs t...
08-05-2018
09:06 AM
index="internal" user!=admin | [search index="internal" | stats count by user]
I am trying to run above query but it fails with an error that "Error in 'SearchParser': Subsearches are only valid a...
- Tags:
- subsearch
12-16-2015
03:28 AM
1 Karma
Hello,
I would like to run a scheduled report once. A very log time search, I don't care about performance or time to complete.
I set in local limits.conf
[subsearch]
# maximum number of r...
08-30-2016
07:37 AM
...n the metadata results but I need to have them show in the final results.
I was thinking a subsearch would work but it fails to match up all the records. I only get about 20 matching records but it d...
