I have extracted a numeric field and I want to count the fields by grouping them based on the range . For eg: Field A 1 4 6 10 15 26 29.... Result should look like something below : Field A - Range Count 1-10 4 11-20 1 21-30 2 Can this be achieved ? ... View more

I have a multi value field that looks similar to below [a,b] [a,b,c] [b,c] .... so on For each event , I want to compare this with an external file that maintains a list and my final result should be the values that do not match For eg : my external file contains the following values a b c d e f My final result should look like sonething below : [c,d,e,f] [d,e,f] [a,d,e,f] Can this be achieved in Splunk ? ... View more

Is it possible to use the commands like makemv or nomv in data models? I am using regular expressions while building the datamodel for extracting some of the fields. One of the fields is a comma separated list in the format [a,b,c] or sometimes it is just [d]. I want a single field which will have possible values as a,b,c,d etc. And all this in the data model. Is it possible to achieve this ? ... View more

I am using the Splunk Web environment. I am not sure how to access the CLI. When a splunk instance is installed on a server , it means we can access that instance via web as well as CLI. Is my understanding correct or do we need seperate setup for CLI. How does it work. ... View more

I have a log file containing information logged in the below format: Response Received from ABC service for Submit The following response has been received from XYZ for Submit and so on. I am interested in the values ABC , XYZ etc . SO I want to extract these values to a single field say Field1. How can I do this? ... View more

Hi, I have extracted from my logs the fields in the following format : Field 1 : Possible values true and false Field 2 : Possible values true and false I want to create a report which has the details of % of field 1 which is false and % of field 2 that is false. I am using something like this ; ... |stats count(Field 1) As "A1",count(eval(match,"false")) As "A2" | eval perc = (100*A1/A2) But this does not give the desired result. Can anyone please help on where I am going wrong ... View more

Hi, I am trying to read some systemout log files and extract data from it. Sample info in the log is as below : Field1 Accept Indicator :: true Field1 Accept Indicator :: false Field2 Accept Indicator :: true Field2 Accept Indicator :: false Total Time Taken by ReqA****156 etc I am new to Splunk and not sure what is the correct approach to get these fields extracted.. I tried using the regex generated by Field Extraction but it does not give accurate results. Can anyone help me with the regex as well? ... View more