It seems like something that has been answered before but i have been unable to find the answer. Is it possible to run a query that provides unique IP source addresses when searching for a particular string? I've tried this however i'm not having any success: splunk_server=* index="mysiteindes" host=NXR4RIET313 SCRAPY | stats dc(src_ip) Would be particularly helpful if a portion of the IP (Host, Network) could be queried. ... View more

I would like to display the time taken for a page to load in Splunk. Here is my query: splunk_server=* index="myindex1" host=NA*P* host=COSERVER313 | convert num(time_taken) | sort 100 -time_taken Here is the result: splunk_server=* index="myindex1" host=NA*P* host=COSERVER313 | convert num(time_taken) | sort 100 -time_taken 2/28/19 1:59:28.000 AM 2019-02-28 06:59:28 W3SVC21 10.121.3.95 GET /en/mypage1/publications/documents/2016-documents/w112-document1.aspx - 443 - 10.121.3.101 Mozilla/5.0+(compatible;+search-crawler-EXTERNAL;++null;[email protected]) - 200 0 64 0 555 265525 54.88.115.238 host = COSERVER313 source = E:\ywlogs\company\IIS\W3SVC21\u_ex190228_x.log sourcetype = iis 2/28/19 ... View more