Hi,
I'm trying to find least common agent useing two commands:
1) sourcetype=access_combined| rare useragent
2) sourcetype=access_combined| stats values(useragent) count by useragent | sort c...
Hey everyone
i have a little bit of a problem with some of my searches, as I am only rarely able to execute them. Splunk Web just keeps showing the "new search" page (in a dashboard it shows "C...
Hi,
I want to know if it's possible to get rare and top value on the same table search.
index=_internal |top limit=5 sourcetype
index=_internal |rare limit=5 sourcetype
thx
...op), and other stats too.
I am also interested in other stats for each field:
Rare 10 values and their counts and percents
Values which deviate from the standard pattern
Table:
Type F...
I'm running -
index=<indexname> | fields
or
index=<indexname> | fieldsummary
They don't show the fields which are very rare in the content. Is there a way to see all f...
I am want to improve the response time for search with rare event and searching with date variable. Note: I am interested in latest 500 event only. Here "local date" is other than _time variable. F...
Hello,
I use the Splunk Machine Learning Toolkit. I would like to predict a rare event. The predicted variable has two values : "GOOD" and "BAD". The "BAD" only represents 13% of the data.
I...
...he rare limits of the field ip_source and the field ip_destination such that I can graph them both and see if any ip addresses overlap.
This is my most recent search:
set diff [search h...
...earches are now starting to make an impact on performance.
I'd like to identify saved searches that have search acceleration turned on, but the searches are never or rarely invoked, and/or the a...