...utomatic lookup table so it has to be replicated to the search peers. The lookup table file is static and rarely changed. My questions are: - Once the replication bundle syncs successfully, will Splunk SH t...
I'm finding some splunk commands can detecting unusual event.
For example, each event has username field, usually usernames are same or similar, but sometimes there are some unusual username. So, I...
Hi,
I'm trying to find least common agent useing two commands:
1) sourcetype=access_combined| rare useragent
2) sourcetype=access_combined| stats values(useragent) count by useragent | sort c...
Hey everyone
i have a little bit of a problem with some of my searches, as I am only rarely able to execute them. Splunk Web just keeps showing the "new search" page (in a dashboard it shows "C...
Hi,
I want to know if it's possible to get rare and top value on the same table search.
index=_internal |top limit=5 sourcetype
index=_internal |rare limit=5 sourcetype
thx
I added iplocation lookup into my CIM data model. I found there's a rare handling when I validate the result by running | from datamodel: SPL The result SPL is like following an i...
...op), and other stats too.
I am also interested in other stats for each field:
Rare 10 values and their counts and percents
Values which deviate from the standard pattern
Table:
Type F...
I'm running -
index=<indexname> | fields
or
index=<indexname> | fieldsummary
They don't show the fields which are very rare in the content. Is there a way to see all f...
Hello!
I'm fairly new to Splunk, and I'm using my Minecraft server logs to chart some data. I am having a hard time charting rare values. Here is the search I'm trying:
index=minecraft action=b...