Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About cmerriman
cmerriman
Super Champion
Member since:
09-10-2013
08-12-2025
Community Statistics
| Posts | 1453 |
| Solutions | 271 |
| Karma Given | 79 |
| Karma Received | 707 |
| Member Since | 09-10-2013 |
Activity Feed
- Got Karma for Re: DMA - datamodel artifacts filling up the dispatch dir. 10-15-2025 06:44 AM
- Got Karma for Re: Reset all inputs to default in dashboard studio?. 07-21-2025 10:38 AM
- Got Karma for Re: Reset all inputs to default in dashboard studio?. 06-16-2025 01:48 PM
- Posted Re: Reset all inputs to default in dashboard studio? on Dashboards & Visualizations. 06-16-2025 01:30 PM
- Posted Re: DMA - datamodel artifacts filling up the dispatch dir on Splunk Enterprise Security. 06-16-2025 12:28 PM
- Got Karma for Re: How can I create a query to find dashboard usage and top used dashboards of all the dashboards in my environment?. 05-20-2025 10:04 AM
- Got Karma for Re: How do you display a blank panel?. 05-19-2025 07:07 AM
- Got Karma for Re: Count of events based on two where conditions. 05-06-2025 04:45 PM
- Got Karma for Re: How to add final total count of results without adding another column?. 04-14-2025 06:24 PM
- Got Karma for Re: How do I add yesterday's date to an emailed report subject?. 03-13-2025 10:20 AM
- Got Karma for Re: Token substitues value with double quotes | unable to use panel token values in DB connect query to compare string values as they need single quotes. 02-25-2025 02:12 PM
- Got Karma for Re: What are the differences between append, appendcols, and join search commands?. 11-06-2024 02:19 AM
- Got Karma for Re: How to replace specific field value?. 06-20-2024 06:36 AM
- Got Karma for Re: "Other" in timechart. 01-11-2024 01:30 AM
- Got Karma for Re: Token substitues value with double quotes | unable to use panel token values in DB connect query to compare string values as they need single quotes. 12-14-2023 07:48 AM
- Got Karma for Re: If there are no results found, how do I get my search to return a field that has the value of zero?. 11-17-2023 07:09 AM
- Got Karma for Re: Search Query Help: Number of Events per Event Code and Total size of those events. 08-07-2023 06:54 AM
- Got Karma for Re: Stats (count(x) as countX, count(y) as countY) BY FIELD X. 03-16-2023 06:36 AM
- Got Karma for Re: How to reference a dashboard token in an HTML panel?. 01-30-2023 12:00 AM
- Got Karma for Re: "Other" in timechart. 01-13-2023 05:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
10-27-2016
06:53 AM
try <option name="charting.legend.labelStyle.overflowMode">ellipsisNone</option>
http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/ChartConfigurationReference
... View more
10-27-2016
06:27 AM
My search |top 5 users|join users [search My search |stats values(field_1) as field_1 values(field_2) as field_2 by users]
it probably isn't the most efficient way but it should work.
... View more
10-27-2016
06:00 AM
2 Karma
https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Findingandremovingoutliers
this is a doc on removing outliers.
this might get your your average and stdev. create an eval to find the difference for n standard deviations above the mean.
My search
| timechart span=1h limit=0 count by city
|stats avg(count) as avg stdev(count) as stdev by city
... View more
10-27-2016
05:52 AM
to show it with the hour try this:
My search |bucket _time span=1h| stats count by user _time|eval date=strftime(_time,"%D %H:%M")|eval userHour=user+" - "+date|sort - count|head 5|fields userHour count
... View more
10-27-2016
05:48 AM
My search |top 5 users
that should do it, but it won't be hourly.
... View more
10-27-2016
05:08 AM
Quartz Scheduler Format, not Unix Standard. The doc has examples.
http://www.quartz-scheduler.org/documentation/quartz-2.x/tutorials/crontrigger.html
http://docs.splunk.com/Documentation/AddOns/released/MSPowerShell/Configuration
... View more
10-27-2016
04:55 AM
1 Karma
I don't think that's possible. To send out a dashboard on a schedule, it has to be through a PDF. You can send a report out on a schedule with an inline table in the email body, however.
... View more
10-26-2016
05:07 AM
Timewrap doesn't have a doc page in the Splunk Docs, so it's likely that you'll need the app in order to use the command. If the app is installed correctly, I don't think people will see problems with the command.
... View more
10-25-2016
12:46 PM
also, you can use case instead of a nested if
...|eval Asset_status= case(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server", Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop",1=1,"Others")|stats count by Asset_status
... View more
10-25-2016
08:35 AM
try placing the append at the very end.
index=eapi_cloud_system_qa id-swiftid-green-ITE-app sourcetype=monitor OR sourcetype=monitor_log|rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P[\w]+)" | rex field=_raw "(Host-ProcessCPUUtilization-Percent)[\w | ^:](?P[\w]+)" |chart values(ec2cpu) as EC2_CPUUtilization values(processcpu) AS Process_CPUUtilization by _time span=1m | appendpipe [ stats count | eval "NoResults"="No Data Found" | where count=0 |table "NoResults"]
... View more
10-25-2016
08:04 AM
1 Karma
| rex field=productId "(?<field1>.*)_text_(?<field2>.*)"
try it without the \ does it work?
... View more
10-25-2016
07:52 AM
1 Karma
i just helped someone with this the other day
https://answers.splunk.com/answers/467823/if-there-are-no-results-found-how-do-i-get-my-sear.html#answer-468832
use | appendpipe [ stats count | eval "NoResults"="No Data Found" | where count=0 |table "NoResults"]
... View more
10-25-2016
07:11 AM
this should get you the count and distinct list of users by hour
base search | bin span=1h _time | stats count values(user) as users by _time
... View more
10-25-2016
06:59 AM
ahh alright, that picture looked like there was a pipe in there.
I assume it's ...|timechart span=1d sum(eval...
I'd double check the _raw data to make sure that _time is being indexed correctly.
... View more
10-25-2016
05:18 AM
http://docs.splunk.com/Documentation/Splunk/6.5.0/Installation/Systemrequirements
Here is the Splunk Doc about system requirements. Windows Server 2016 isn't on it yet.
At the bottom of the doc, though, you can provide comments and they might get back to you about when 2016 will be available.
... View more
10-25-2016
05:12 AM
if it is always going to be those eventcodes, host=domaincontrollers* EventCode=>4944 EventCode<=4945 should be fine, you shouldn't have to list out all of the other codes.
... View more
10-24-2016
01:51 PM
try creating a tag or alias? it won't change the raw data, but it'll help you search the data easier?
http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Abouttagsandaliases
... View more
10-24-2016
10:43 AM
try this
<search base="root">
<query> search filter1=A filter2=B
</query>
</search>
You're not going to be able to remove that pipe. it's either add the filters to the base search or do a |search in the base="root"
... View more
10-24-2016
09:03 AM
1 Karma
In advanced XML, the module for adding pages is <module name="Pager"> , but advanced XML is deprecated, so if you're able to recreate this dashboard in simple XML, that is recommended.
this is a sample of one of my leftover advanced XML dashboard that uses Pager in a SimpleResultsTable
<module name="PostProcess">
<param name="search">QUERY</param>
<module name="Pager">
<module name="SimpleResultsTable" />
<param name="cssClass">table-chrome table-striped</param>
<module name="SearchControls">
<param name="sectons"/>
<module name="Pager" />
</module>
</module>
</module>
</module>
</module>
as for the timechart, you might be able to add |sort - count |head 50 to the end of your search, or something similar to grab the top 50 'count' (insert correct field name).
... View more
10-24-2016
05:36 AM
can you share an example of the log or the regex you've tried?
also, regex101.com is an excellent place to try to work it out.
... View more
10-24-2016
05:34 AM
8 Karma
index=ad source=otl_adgroupmemberscan memberSamAccountName=jbloggs
|dedup memberSamAccountName, groupSamAccountName
|table groupSamAccountName, memberSamAccountName
| appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]
you could name the "NoResults" field to groupSamAccountName or memberSamAccountName and it would replace that field value if there are no results.
... View more
10-20-2016
01:31 PM
this should not be so complicated. they have a doc on this.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/Dynamicdrilldownindashboardsandforms#Dashboard_linking_to_a_form
Maybe you need to put the link in CDATA?
... View more
10-20-2016
01:06 PM
it doesn't say latest= in the url
Not sure if that's why?
http://XXXXXXX-01:8000/en-US/app/dazzler/system_summary?earliest=%24default_earliest%24&latest=%24default_latest%24
... View more
10-20-2016
11:32 AM
is earliest misspelled? You have it $default_earlist$ instead of $default_earliest$
if that isn't it, I'll keep noodling.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-12-2025
10:31 AM
|
Karma given to
