I want to execute a query in app1, but I want to get the data from app2 For eg: Execute query in app1 "index="abc",  This should get the data from app2 Please help! ... View more

Need help with a Splunk query  to display % failures  % failures = A1/A2 *100 A1= Total number of events returned by the below query: index="abc"  "searchTermForA1"   A2= Total number of events returned by the below query: index="xyz"  "searchTermForA2" Please help with the query. Thanks!   ... View more

I have to trigger an alert if total number of events are above 20 per second, continuously for 5 mins. Query : index=abc  host = "123" earliest= -5m latest=now |  bucket _time span=1s | stats count  as Total by _time  Alert should trigger only when 'Total' is above 20 for all the query results.   ... View more

I want to view bitbucket files changed , owners who changed bitbucket files in Splunk. Can someone please share the steps to do that. ... View more

I have 'BuildInfo' field as "ABCYYYY_Number|XYZ" for eg "ABC2020_17|XYZ.  Number will be keep increasing for a year( like 1, 2, 3, 4.....) . For next year the Number will again reset to 1 and then keep increasing. "ABC2021_1|XYZ" I want to compare "error1" in consecutive  "BuildInfo" . Please help ... View more

I got below warning: "'anomalydetection' command: limit for values of field 'message' reached. Some values may have been truncated or ignored." 1) Does this means that some events are removed. For eg, if there are 2000 events , then less than 2000 events are considered (like 1500) ? 1) Does it means all events are considered, but length of the event is truncated. For eg, if there are 2000 events, it will consider all 2000 events, "message" value will be truncated like "message"="ABC" then truncated value  "message"="AB"?    ... View more

I need to find "errors1" in server logs that occurred on or after last "Thrusday" as "count1" , and "error1" that occurred before last "Thrusday" as "count2" So, if today  is 16th, then all "error1" in server logs that occurred on 16th , 15th, 14th and 13th as "count1", and "error1" before 13th as "count2" Sat Sun Mon Tues Wed Thru Fri 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21   Please help! ... View more

  I need to calculate if more than 15% of "error1" in server logs are there since last release. Release is every Wednesday (weekly) Sat Sun Mon Tues Wed Thru Fri 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21   Release 1 cycle - from 6th to 12th , Release 2 cycle -  13th to 19th and so on for a month For examples: So, if splunk query runs on 14th , it should find "errors1" count in server logs from 6th to 12th as "count1". Then, it should find "errors1" count in server logs from 13th to 14th  as "count2". Then calculate the percentage increase in "count2" from "count1" If splunk query runs on 20th , it should find "errors1" count in server logs from 13th to 19th as "count1". Then, it should find "errors1" count in server logs on 20th as "count2" . Then calculate the percentage increase in "count2" from "count1". If splunk query runs on 18th , it should find "errors1" count in server logs from 6th to 12th as "count1". Then, it should find "errors1" count in server logs from 13th to 18th as "count2" . Then calculate the percentage increase in "count2" from "count1". Calculate if more than 15% of "error1" in server logs are there since last release. Please help!     ... View more