Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About cmerriman
cmerriman
Super Champion
Member since:
09-10-2013
08-12-2025
Community Statistics
| Posts | 1453 |
| Solutions | 271 |
| Karma Given | 79 |
| Karma Received | 707 |
| Member Since | 09-10-2013 |
Activity Feed
- Got Karma for Re: DMA - datamodel artifacts filling up the dispatch dir. 10-15-2025 06:44 AM
- Got Karma for Re: Reset all inputs to default in dashboard studio?. 07-21-2025 10:38 AM
- Got Karma for Re: Reset all inputs to default in dashboard studio?. 06-16-2025 01:48 PM
- Posted Re: Reset all inputs to default in dashboard studio? on Dashboards & Visualizations. 06-16-2025 01:30 PM
- Posted Re: DMA - datamodel artifacts filling up the dispatch dir on Splunk Enterprise Security. 06-16-2025 12:28 PM
- Got Karma for Re: How can I create a query to find dashboard usage and top used dashboards of all the dashboards in my environment?. 05-20-2025 10:04 AM
- Got Karma for Re: How do you display a blank panel?. 05-19-2025 07:07 AM
- Got Karma for Re: Count of events based on two where conditions. 05-06-2025 04:45 PM
- Got Karma for Re: How to add final total count of results without adding another column?. 04-14-2025 06:24 PM
- Got Karma for Re: How do I add yesterday's date to an emailed report subject?. 03-13-2025 10:20 AM
- Got Karma for Re: Token substitues value with double quotes | unable to use panel token values in DB connect query to compare string values as they need single quotes. 02-25-2025 02:12 PM
- Got Karma for Re: What are the differences between append, appendcols, and join search commands?. 11-06-2024 02:19 AM
- Got Karma for Re: How to replace specific field value?. 06-20-2024 06:36 AM
- Got Karma for Re: "Other" in timechart. 01-11-2024 01:30 AM
- Got Karma for Re: Token substitues value with double quotes | unable to use panel token values in DB connect query to compare string values as they need single quotes. 12-14-2023 07:48 AM
- Got Karma for Re: If there are no results found, how do I get my search to return a field that has the value of zero?. 11-17-2023 07:09 AM
- Got Karma for Re: Search Query Help: Number of Events per Event Code and Total size of those events. 08-07-2023 06:54 AM
- Got Karma for Re: Stats (count(x) as countX, count(y) as countY) BY FIELD X. 03-16-2023 06:36 AM
- Got Karma for Re: How to reference a dashboard token in an HTML panel?. 01-30-2023 12:00 AM
- Got Karma for Re: "Other" in timechart. 01-13-2023 05:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
11-17-2016
06:23 AM
1 Karma
You might be able to edit the alert_actions.conf to remove it from all emails.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/Alertactionsconf
http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification#Configure_email_notification_settings
... View more
11-17-2016
05:00 AM
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Getstartedwithgettingdatain
have you looked through this doc to get data into Splunk? There are multiple ways. Are you doing this through the GUI or through .conf files?
... View more
11-16-2016
12:28 PM
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Getstartedwithgettingdatain
here is a doc that explains getting data into splunk using apps or forwarders and whatnot. I'm not sure how useful this is to your question, exactly, but I thought it might help.
... View more
11-16-2016
12:18 PM
1 Karma
sourcetype="abc" ViolationType="Overwrite Code" |eventstats count(PName) as ProgramCount by ViolationType DeviceName PName|eval ProgramNameCount=PName+" - "+ProgramCount|stats values(ProgramNameCount) as "Program Name" count(PName) as TotalProgramCount by DeviceName ViolationType|rename DeviceName as "Device Name" ViolationType as "Violation Type"| sort 0 - TotalProgramCount
I'm not sure if I completely understand the ask, but this is what I'm thinking you might want. The eventstats will count PName for every ViolationType, DeviceName and PName. I then created a concatenated field to combine the PName with the count, so you know which count goes with which program. Then the stats command values those by DeviceName and ViolationType. Another way to do it, if you don't want the programs in a multivalue is this:
sourcetype="abc" ViolationType="Overwrite Code" |stats count(PName) as ProgramCount by ViolationType DeviceName PName|rename DeviceName as "Device Name" ViolationType as "Violation Type" PName as "Program Name"| sort 0 - ProgramCount
... View more
11-16-2016
12:06 PM
You can go to Setting>User Interface>Time Ranges>Add New (or edit it, if you have one in place) and place the earliest time at @w0 and latest time to @w4 and you can make this a public global time range
... View more
11-16-2016
07:19 AM
4 Karma
http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Parsingsearches#Search_bar_shortcuts
On Linux or Windows use Ctrl + \
On Mac OSX use Command + \
... View more
11-16-2016
06:08 AM
1 Karma
sourcetype="thread.stats" | stats count by thread_id type| sort - count
try that
... View more
11-16-2016
05:11 AM
All exams are currently down this week for updates. They'll be available again on November 21st. You should email certification@splunk.com to request a new link to the exam.
... View more
11-15-2016
01:01 PM
after changing the summary index search to include _time, have you tried @somesoni2 answer? That might work also.
index=your_summary_index_name source="Your Summary index search Name" earliest=-30@d| stats avg(Count) as Avg_Count
... View more
11-15-2016
12:35 PM
it needs to be _time , try
index=Test |bucket _time span=1d |stats count(ip) as Count by _time
or
index=Test |eval _time=strftime(_time,"%D") |stats count(ip) as Count by _time
otherwise Splunk probably isn't recognizing it as the time field
... View more
11-15-2016
11:43 AM
try removing earliest from the |savedsearch syntax to run it for all time to see if you get more data back. You might need to change your summary index search to something like
index=Test earliest=@d |eval _time=strftime(_time,"%D") |stats count(ip) as Count by _time
OR
index=Test earliest=@d |bucket _time span=1d |stats count(ip) as Count by _time
to get the count by day and then do
|savedsearch searchName earliest=-30d@d|stats avg(Count) as avgCount
if it doesn't have a _time field to query off of, that's probably the problem.
... View more
11-15-2016
11:19 AM
The first part is producing results from your saved search that is created from your summary index? What are the results you get?
I edited my query because I hadn't capitalized Count if that was the issue.
... View more
11-15-2016
10:39 AM
|savedsearch searchName earliest=-30d@d|stats avg(Count) as avgCount
here's a doc on running saved searches in the search bar:
http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Savedsearch
... View more
11-14-2016
05:05 AM
http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Token_filters
try adding |n into the token. $Status|n$ It doesn't escape special characters. I'm not sure if it'll work, but it might.
... View more
11-11-2016
11:58 AM
you can try to use ...|appendpipe [stats count by clusterTitle |join max=0 clusterTitle [|inputlookup clusterTable.csv]|fields - count]|stats values(*) by clusterTitle
or something along those lines. Without knowing your actual syntax/data, that's the best I got.
... View more
11-11-2016
09:37 AM
try taking out tokens="true" encoded="true" in the html panels (or at least the tokens="true"). sorry that was specific to my dashboard and it might not work with yours.
... View more
11-11-2016
05:24 AM
try this:
<row>
<panel>
<single>
<search>
<query>.....</query>
</search>
<option name=...>...</option>
</single>
<single>
<search>
<query>.....</query>
</search>
<option name=...>...</option>
</single>
<single>
<search>
<query>.....</query>
</search>
<option name=...>...</option>
</single>
<html tokens="true" encoded="true">
<![CDATA[
<br/>
]]>
</html>
<single>
<search>
<query>.....</query>
</search>
<option name=...>...</option>
</single>
<single>
<search>
<query>.....</query>
</search>
<option name=...>...</option>
</single>
<single>
<search>
<query>.....</query>
</search>
<option name=...>...</option>
</single>
<html tokens="true" encoded="true">
<![CDATA[
<br/>
]]>
</html>
<single>
<search>
<query>....</query>
</search>
<option name=...>...</option>
</single>
<single>
<search>
<query>....</query>
</search>
<option name=...>...</option>
</single>
<single>
<search>
<query>.....</query>
</search>
<option name=...>...</option>
</single>
</panel>
</row>
... View more
11-09-2016
09:36 AM
My search | stats earliest(date_hour) as FirstHour latest(date_hour) as LastHour by user|eval accessTime=FirstHour+"--"+LastHour|fields - FirstHour - LastHour
try something like this.
... View more
11-09-2016
05:12 AM
source="EFFORT TRACKER REQUESTED.csv" host="BDC6-LX-6021DXD" index="level3" sourcetype="effort_tracker" | rename "Task Name" as task_name
|stats count(eval(match(task_name,"INC*"))) as "Incident Count" count(eval(match(task_name,"TASK*"))) as "Task Count" count(TaskID) as "Total Count" count(eval(match(task_name,"Vacation*"))) as "Vacations" count(eval(match(task_name,"T|training*"))) as "Training" sum(Effort) as "Total Effort" sum(eval(if(task_name like "INC%",Effort,null()))) as sumofinc sum(eval(if(task_name like "TASK%",Effort,null()))) as sumoftask by EmployeeGddLoginName|eval totalticketeffort =sumofinc+sumoftask|fields - sumofinc - sumoftask
try this. i think it's what you're trying to get
... View more
11-08-2016
12:11 PM
I've updated this to convert _time to epoch before the range.
... View more
11-08-2016
11:40 AM
UPDATED AGAIN
My Search | where date_hour>=16 OR date_hour<9| convert ctime(_time) as Date_and_Time |eval StartHour=strftime(_time,"%H")|eval EndHour=strftime(_time,"%H") |stats earliest(StartHour) as StartHour latest(EndHour) as EndHour by student_id
try something like that
UPDATED
My Search | where date_hour>=16 OR date_hour<9 | convert ctime(_time) as Date_and_Time|convert timeformat="%m/%d/%Y %H:%M:%S" mktime(_time) as time |eventstats range(time) as duration by student_id| stats dc(student_id) as TotalStudents avg(duration) as avgDurationPerStudent
this should get you (in seconds) the average duration each student was on the website.
... View more
11-08-2016
11:35 AM
<option name="charting.legend.labelStyle.overflowMode">ellipsisNone</option>
try that in your simpleXML
... View more
11-08-2016
07:18 AM
1 Karma
(index=a sourcetype=source1) OR (index=b sourcetype=source2) |eval IP=coalesce(c_ip,source_ip)| stats count by IP
try something like this
... View more
11-08-2016
06:58 AM
here is some documentation for removing users
http://docs.splunk.com/Documentation/Splunk/6.5.0/Security/BestpracticeforremovinganLDAPuser
... View more
11-08-2016
05:17 AM
Why are you renaming EmployeeGddLoginName in all of your appendcols if that's what you want to join them by? Can you try something like this instead of all of the appends?
source="EFFORT TRACKER REQUESTED.csv" host="BDC6-LX-6021DXD" index="level3" sourcetype="effort_tracker"
|stats count(TaskID) as "Total Count" count(eval(match("Task Name","INC.*"))) as "Incident Count" count(eval(match("Task Name","TASK.*"))) as "Task Count" count(eval(match("Task Name","Vacation.*"))) as Vacation count(eval(Phrase="Training")) as "Training by EmployeeGddLoginName
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-12-2025
10:31 AM
|
Karma given to
