Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About synking
synking
Explorer
Member since:
10-18-2018
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-18-2018 |
Activity Feed
- Got Karma for Re: Why is my search to chart server errors per host over a 24 hour period not working?. 06-05-2020 12:50 AM
- Posted Re: How do you combine two fields from a username search into one field? on Splunk Search. 11-13-2018 04:48 AM
- Posted Re: How do you combine two fields from a username search into one field? on Splunk Search. 11-09-2018 08:23 AM
- Posted How do you combine two fields from a username search into one field? on Splunk Search. 11-09-2018 06:48 AM
- Tagged How do you combine two fields from a username search into one field? on Splunk Search. 11-09-2018 06:48 AM
- Tagged How do you combine two fields from a username search into one field? on Splunk Search. 11-09-2018 06:48 AM
- Posted Re: How do you create a regex expression which creates a field and returns text after a backslash? on Splunk Search. 10-22-2018 06:46 AM
- Posted Re: How do you create a regex expression which creates a field and returns text after a backslash? on Splunk Search. 10-22-2018 06:34 AM
- Posted How do you create a regex expression which creates a field and returns text after a backslash? on Splunk Search. 10-22-2018 06:19 AM
- Tagged How do you create a regex expression which creates a field and returns text after a backslash? on Splunk Search. 10-22-2018 06:19 AM
- Tagged How do you create a regex expression which creates a field and returns text after a backslash? on Splunk Search. 10-22-2018 06:19 AM
- Posted Re: Why is my search to chart server errors per host over a 24 hour period not working? on Splunk Dev. 10-19-2018 08:23 AM
- Posted Re: Why is my search to chart server errors per host over a 24 hour period not working? on Splunk Dev. 10-19-2018 04:52 AM
- Posted Why is my search to chart server errors per host over a 24 hour period not working? on Splunk Dev. 10-18-2018 11:21 AM
- Tagged Why is my search to chart server errors per host over a 24 hour period not working? on Splunk Dev. 10-18-2018 11:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-13-2018
04:48 AM
Hey thanks for the answer. When I use this search I still get nothing back. I show 0 events match and then no results found.
I am not sure what I am doing wrong. Thanks for the help.
... View more
11-09-2018
08:23 AM
I am trying to get only the stats of cs_username if it also has either TransID or ASP_NET_SessionId. For some reason when I try my above searchs I get zero results but if I search just aspid or trans id I get info.
... View more
11-09-2018
06:48 AM
Hey,
I'm having an issue trying to combine a field into one when searching a separate field. I have tried two separate searches, but I do not get results from either of them.
index=iis_aps cs_username!="-"| eval session1=coalesce(ASP_NET_SessionId,TransID) | stats count(session1) by cs_username
index=iis_apps | eval sessiongrp=case(ASP_NET_SessionId="*", "aspsess", TransID="*", "trans", 1=1, "Not Found") | stats list(host) by sessiongrp
I am trying to get the session id and transid from the results of searching for cs_username. So that the result would show the username and then the session id or transid. I am not sure what I am doing wrong. Any help is appreciated.
... View more
10-22-2018
06:46 AM
Wait nvm it worked I was just putting it in the wrong field.
... View more
10-22-2018
06:34 AM
Thanks but even when i try that it does not seem to work. I get the search to complete but it shows everything in every log.
... View more
10-22-2018
06:19 AM
Hey,
i need assistance in trying to figure out how to create a field and extract the text after that. I am not sure how to go about doing this. i have looked in the documentation and on here for questions that are similar, but nothing i try seems to work. Basically, in the logs I am searching, there is a string:
SERVERNAME\USERNAME
I want to create a field called username from the above entry. There is always a space after and before those two words and always the backslash. Here is what i have so far:
rex field=_raw "SERVERNAME\\:\s+(?<USERNAME>[^\s]+)"
But, I am not sure what i am doing wrong. Any help is gladly accepted. Thanks.
... View more
10-19-2018
08:23 AM
1 Karma
I was able to get the results I wanted by using the below command.
|bin _time span=1d | chart sum(sc_status) list(sort(sc_status)) by host,sc_status
... View more
10-19-2018
04:52 AM
Thank you this gets me more than I was able to before. But the chart will only show one server. Is there a way to show all servers and separate the status by status type instead of total count
... View more
10-18-2018
11:21 AM
Hey all,
I am trying to show all iis errors separated by host over a 24 hour period. But, when I run the below command, it completes and says it has 200,000 plus results, but nothing shows up in the graph. Can anyone assist?
Thanks.
host="**" | chart list(host) over time by count(sc_status) span=1d
... View more
- Tags:
- splunk-enterprise
