Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
158 results
Sort by:
03-31-2023
04:32 PM
...and I cannot use stats in a command by itself as I want to apply this k formula for each daily count. Can you please help? Many thanks,
04-03-2017
08:27 AM
...ddress" by user|sort -Count
I want to rename the user column to "User". I'm particular and like my words/heading capitalized. I've tried:
index=[my index] sourcetype=[my sourcetype] event=login_fail|stats...
- Tags:
- splunk-enterprise
08-20-2021
07:43 AM
New to Splunk and experimenting a couple of functionalities, especially data aggregation With the experimental file app_usage.csv, I was trying to see the percentile of Webmail using |i...
Labels
- Labels:
-
using DSP
04-18-2015
09:16 AM
...d with the stats command. Each time you
invoke the statscommand, you can use more than one function;
however, you can only use one by clause. For a complete list of stats
functions with d...
05-21-2016
06:35 AM
I might be going to deep here but I figured I'd give it shot...
I have a stats command keying off of a domain name. I have the values() of the uri's in the stats command as well:
| stats v...
09-13-2013
03:21 AM
Hi,
We are using Splunk version 5.0.4 in our application. In order to bucket our data and display the buckets in proper order, we use the chart command and then take substr of the field. The f...
- Tags:
- substr
07-21-2015
10:40 AM
...rocs{} = special
procs{} = C,B
The counts should be: A: 1, B:3, C:1, special:1
index=foo | rename procs{} as procs | eval numprocs=mvcount(procs) | mvexpand(procs) | stats count(eval((p...
04-01-2016
01:17 AM
1 Karma
...earch web UI like this :
index=my_index | head 1000 | iptoas asdataorigin=Ip | stats count by ASCountry
My problem is that in order to use my custom command with the stats command, I need to run the...
02-16-2022
06:43 AM
...rite my queries to tstats, and I think what I tried to do here is in line with the recommendations, i.e. I repeated the same functions in the stats command that I use in tstats and used the same BY c...
Labels
- Labels:
-
tstats
10-22-2010
01:22 AM
...OME_OTHER_FIELD==C),SOME_FIELD,0))) as SOME_TOTAL
But if I search like this, it doesn't:
index=SOME_INDEX | stats sum(eval(if(eventtype==SOME_EVENT,SOME_FIELD,0))) as SOME_TOTAL
For the sake of c...
- Tags:
- eval
