Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About chimell
chimell
Motivator
Member since:
12-11-2014
09-30-2025
Community Statistics
| Posts | 348 |
| Solutions | 22 |
| Karma Given | 9 |
| Karma Received | 93 |
| Member Since | 12-11-2014 |
Activity Feed
- Got Karma for Re: How do I get the current logged in username in Splunk?. 08-06-2025 05:35 AM
- Got Karma for Re: extracting the first 3 characters from a field?. 07-28-2023 07:39 AM
- Posted How can I created dashboard for my entities like image belong in IT Essentials work app? on Security. 02-15-2023 08:26 AM
- Posted Re: Rollback during Installation Splunk Enterprise in Windows 64 bit on Getting Data In. 11-15-2022 08:01 AM
- Posted Rollback during Installation Splunk Enterprise in Windows 64 bit? on Getting Data In. 11-12-2022 01:20 PM
- Got Karma for Re: How can we move alerts from one app to another?. 10-13-2022 12:24 PM
- Got Karma for Re: Copy Dashboard from one App to another. 08-09-2022 12:49 AM
- Got Karma for Re: How do I get the current logged in username in Splunk?. 01-24-2022 01:26 AM
- Got Karma for Re: How to timechart the count of a field by day?. 10-12-2021 04:34 AM
- Got Karma for Re: Copy Dashboard from one App to another. 08-19-2021 09:24 PM
- Got Karma for Re: How to edit my search to get the total count by week and by month?. 03-09-2021 11:30 PM
- Got Karma for Re: How to search events with matching IP addresses from two different indexes?. 11-23-2020 03:28 PM
- Got Karma for Re: How to write a search to calculate percentages for success and failure rates from my user log data?. 06-05-2020 12:48 AM
- Got Karma for Re: How to extract LAT and LONG from a string?. 06-05-2020 12:48 AM
- Got Karma for Re: How can we move alerts from one app to another?. 06-05-2020 12:48 AM
- Got Karma for Re: How can we move alerts from one app to another?. 06-05-2020 12:48 AM
- Got Karma for Re: How can we move alerts from one app to another?. 06-05-2020 12:48 AM
- Got Karma for Re: time token conversion and displaying in title. 06-05-2020 12:48 AM
- Got Karma for Re: time token conversion and displaying in title. 06-05-2020 12:48 AM
- Got Karma for Re: How to search events with matching IP addresses from two different indexes?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
02-15-2023
08:26 AM
How can I created dashboard for my entities like image belong in IT Essentials work app.
I download the manuel named:
- Entity Integrations Manual
- Overview of Splunk IT Essentials Work
But i can not find my answer
Thank you for your help
... View more
- Tags:
- dashboard
Labels
- Labels:
-
audit
11-15-2022
08:01 AM
window 10 splunk 9.0.2 thank you
... View more
11-12-2022
01:20 PM
Rollback during Installation Splunk Enterprise in Windows 64 bit
Please i need the help.
... View more
Labels
- Labels:
-
Windows
06-06-2019
01:55 AM
Thanks you to up vote my answer, therefore i want you to accept it.
... View more
05-09-2017
12:15 PM
Hi ankithreddy777
Try this search
|set union[search index=index1|fields a b c][search index=index2|fields c d]
... View more
05-05-2017
02:43 AM
Hi
To remove duplicate data : use
............ |dedup field1 field2
... View more
01-05-2017
12:24 AM
Hi
Try this search code :
index=xxx|transaction transid startswith="Request" endswith="Response" Keeporphans=t |timechart avg((count(eval(Result="FAILURE"))/count(eval(OperationName)))) as TotalCount , count(eval(Result="SUCCESS")) as SuccessCnt , count(eval(Result="FAILURE")) as FatalCnt by OperationName |eval FailurePercentage= (FatalCnt/TotalCount)*100
... View more
01-05-2017
12:12 AM
Hi
Verify if loadAvgIni field is well extracted .
And try using this search code :
index=os host=PC2 sourcetype=vmstat |timechart avg(loadAvgIni)
... View more
12-28-2016
07:31 AM
Hi
Try this search code :
index=xyz sourcetype=123 Message ="*"|stats count by host , Message |fields - count |appendcols[search index=xyz sourcetype=123 Message ="*"|stats count as Total ]
... View more
12-21-2016
11:59 PM
Hi
try something like this
index="price" |chart limit=0 count by productId , product_name
... View more
12-12-2016
01:33 AM
Hi
Try this search code
.........................|rex field=_raw "1min\=(?<one_min>[^\;])\;5min\=(?<five_min>[^\;])\;60min\=(?<sixty_min>[^\;])\;24hr\=(?<twenty_four_hr>[\d+])"|table one_min five_min sixty_min twenty_four_hr
... View more
12-12-2016
01:13 AM
Hi
Try this search code
index=prd sourcetype="nodecheck"|rex field=_raw "System\s+(?<SystemStatus>[^\$|^\!]+)"|chart count by SystemStatus
... View more
12-11-2016
07:44 AM
hi
try this search code :
...................................|rex field=_raw "count\(domain\)\=(?<count_domain>[^\,]+)"|table count_domain
... View more
12-11-2016
07:12 AM
Hi anoopambli
This search code work well
...................................|rex max_match=0 field=_raw "\[Linux\]\[[a-zA-Z\s+]+\]\[(?<monitor_name>[^\]]+)\]"|mvexpand monitor_name|table monitor_name
Look at my result
... View more
12-05-2016
03:22 AM
1 Karma
Hi
In gokadroid answer, replace
(?<license>[^"]+)
with
(?<license>[^\"]+)
to have a good answer. He forgot to escape " character
... View more
12-03-2016
02:19 AM
Hi jhusum
Try the following search code :
.............................. | rex field=_raw "Read:\s+(?<read>[0-9]+)\s+Imported:\s+(?<imported>[0-9]+)\s+Failed:\s+(?<failed>[0-9]+)"|stats dc(read) as read_count , dc(imported) as imported_count , dc(failed) as failed_count
... View more
11-23-2016
07:49 AM
Hi ASISH_9
Use the search like this with appendcols command :
search 1 |appendcols [search 2]
example :
index=_internal |stats count by source |appendcols[index=_audit |stats count by sourcetype]
... View more
11-23-2016
04:45 AM
Hi
Try the following search code using dedup command :
where acc="Inc" AND Stage = "NewBusiness" |dedup quoteNumber | stats count(quoteNumber) AS Quotes count(eval(processStatus="ManualRatingRequired")) as Referrals |eval perc=round(Referrals/Quotes*100, 1)."%"
... View more
11-21-2016
08:43 AM
Please can you extend your sample logs , for permitting me to see well your events ?
... View more
11-21-2016
08:40 AM
Hi splgeek
The following search code give you : Linux; Android 6.0.1;
index="your index_name"|rex field=_raw "(?<myfield>[\w+\;\s+\w+\s+\.\d+]+\;)"|table myfield
... View more
11-13-2016
06:23 AM
Hi
Your xml code syntax is correct just verify if your search code works well.
Verify if the following search code works :
index=ssi_app_index TATL message.facets.url="*ValidateClaim*" message.facets.url="https://me.myself.com*"|stats median(message.facets.duration) as ValidationAvg | eval ValidationAvg=round(ValidationAvg/1000,2)
... View more
03-24-2016
06:13 AM
Hi
try this search code
............................. | rex field=_raw "/[abcd/=/[type/=(?<Type>[^\/]]+)" | stats count by Type
... View more
03-24-2016
05:53 AM
Log in with sudo su permission
Then go to /bin repertory
enter
./splunk start
Example
write
ubuntu@hostname: sudo su /opt/splunk/bin
on the following line type
./splunk start
... View more
03-24-2016
05:36 AM
1 Karma
Hi
put your search in this form using appendcols command
index=_internal|eval date1=strftime(_time, "%Y-%m")|stats count(sourcetype) as count1 by date1 , source|table date1 source count1 |appendcols[search index=_* and index!=_internal|eval date2=strftime(_time, "%Y-%m")|stats count(user) as count2 by date2 , sourcetype|table date2 sourcetype count2]
Look at result
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-30-2025
10:51 AM
|
Karma given to
