Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
83 results
Sorted by:
09-17-2020
11:31 PM
1 Karma
Hi, I tried the below query to fit my model, sourcetype=files command="*cmd.exe*" earliest=-90d@d latest=-1d@d|stats count values(file_path) values(user_name) values(action) by device_name,command...
Labels
- Labels:
-
other
09-22-2017
01:42 PM
...on' understand why my case statement default to putting every event in the other category. I have tried multiple commands, shown below, but they all end with the same results where every event is placed i...
- Tags:
- splunk-enterprise
05-31-2021
05:15 PM
Hi, I want my data presented in a very specific way, which means I can't go the typical route of just adding the field I want presented after the by in my stats command as I'm using t...
12-01-2017
08:00 AM
Hi,
I have this data
Properties: { [-]
analyticsConfigs: { [+]
}
appVersion: 9.0.0
buildTarget: blah
category: E...
01-30-2020
11:44 AM
...he impact.
So I wanted to use a custom generating command that gives me flexibility to generate the SeviceNow incident with additional fields as parameters. Here is my search (My alert condition i...
05-26-2021
06:22 PM
...he averages by category together in a stats table, is there an easy way to do this?
09-13-2018
02:43 AM
...ount by category | sort -count
I've tried searching around and trying a few other commands (like useother but can't seem to get it to work out how I want it.
Thanks in advance for any help.
08-13-2016
09:06 AM
...ourcetype' with the following configuration:
[mySourceType]
DATETIME_CONFIG = CURRENT
KV_MODE = json
AUTO_KV_JSON = true
category = Custom
pulldown_type = 1
The custom command builds a record with the J...
06-21-2012
09:52 AM
1 Karma
...ebAsset
EventCode=10001
EventType=4
Type=Information
ComputerName=dev-web
Category=0
CategoryString=none
RecordNumber=90606
Message=Message=Save
@objId=641
@user=Admin1
@rqstrName=James Doe
@alt1RqstrName=J...
- Tags:
- failure
- transaction
