×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
RobK700000
Engager
Member since: ‎08-26-2025
‎12-10-2025
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-26-2025
Activity Feed
View All

Streamstats with rex and multiple "by" fields

by in Splunk Search
‎12-10-2025 08:50 AM
‎12-10-2025 08:50 AM
I am attempting to rex out some fields from a source log and then if FIELD1 changes in a 24 hour period when the other 4 FIELDS all remain the same then output that information. Basically we should only be issuing FIELD1 once every 24 hours and if we issue it more than once but the other fields are all the same during that time frame then we know something is wrong. Unfortunately I've been banging on this for a few hours and I cannot get it to work. Can anyone assist. Thanks  index=<index> AND source="source.log" | rex "\"field1\":\"(?<FIELD1>[^\"]*)\"" | rex "\"field2\":\"(?<FIELD2>[^\"]*)\"" | rex "\"field3\":\"(?<FIELD3>[^\"]*)\"" | rex "\"field4\":\"(?<FIELD4>[^\"]*)\"" | rex "\"field5\":\"(?<FIELD5>[^\"]*)\"" | fields FIELD1, FIELD2, FIELD3, FIELD4, FIELD5 | streamstats time_window=24h last(FIELD1) as prev_field_value by FIELD2,FIELD3,FIELD4,FIELD5 | where FIELD1 != prev_field_value | fields prev_field_value |table _time FIELD1 FIELD2 FIELD3 FIELD4 FIELD5 ... View more
Labels

Index Health and Welfare Tstats count

by in Splunk Search
‎08-26-2025 09:54 AM
‎08-26-2025 09:54 AM
I am trying to run a daily report that tells me all the indexes that have had 0 events in the past 24 hours. From other searches I have found the below query which seems to work fine except I want to not include certain indexes that I know will always be a 0 count. So for example if I know indexes named index1, index2 and index3 will always be 0 and want them not to show up in the report how would one accomplish that? This is the base search without removing any indexes from results. Appreciate any advice thanks. | tstats count where index=* by index | append [|rest /services/data/indexes | dedup title | fields title ```Discard internal indexes``` | search title!="_*" | rename title as index | eval count=0 ] ```Merge results, keeping the copy with a non-zero, if present``` | stats max(count) as count by index | where count==0 ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎12-10-2025 08:42 AM