Splunk Search

Discussions

Thread Info

How to find the latest event per device

Good day,I am trying to find the latest event for my virtual machines to determine if they are still active or decomm...

by Path Finder in

How to have multiple fields (non numeric) in x-axis on a bar chart?

My Splunk Search is as follows index="someindex" cf_space_name="somespace" msg.severity="*" | rex field=msg.message...

by Path Finder in

How to write a cron schedule to run Splunk alerts biweekly on Mondays?

I have a requirement to Trigger Splunk Alerts Bi-Weekly Mondays (Not 1st and 3rd OR 2nd and 4th weeks) and if a mont...

by New Member in

Issue with StateSpaceForecast from the MLTK app

I have a dashboard that a specific team uses. Today, they asked about why one of the panels was broken. Looking into ...

by Path Finder in

Regex Help

probably a basic question i have the following data 600 reason and this rex (?<MetricValue>([^\s))]+))(?<Rea...

by Engager in

Count X's in each field in a table and total them in the last column

Hello everyone, I have a table (generated from stats) that has several columns, and some values of those columns have...

by Explorer in

Yesterday data dashboard filtering -

An extension of this:https://community.splunk.com/t5/Splunk-Search/Looking-at-yesterdays-data-but-need-to-filter-the-...

by Explorer in

Lookup search wigh showing matched keyword

Hello SplunkersHow can i utilize a lookup in a correlation search showing the detected keyword in the search result ?...

by Explorer in

Adding a Total column (without using addtotals)

Sometimes I set myself SPL conundrum challenges just to see how to solve them. I realised I couldn't do something I ...

by Splunk Employee in

how to get statistical values for different fields

I have to create a base search for a dashboard and I am kinda stuck. Any help would be appreciated. index=serv...

by Explorer in

Is there a way to monitor the number of files in the dispatch directory over time?

Hi I am looking to monitor the dispatch directory over time. I know I can get the current results by using this ...

by Influencer in

eval percent line is not producing values in the table

I am working on obtaining all user logins for a specified domain, then displaying what percent of those logins were f...

by Explorer in

How to identify a skipped scheduled accelerated report ?

I have noticed that a saved search is chronically skipped, almost 100% but I cannot trace it back to the origin.The s...

by Communicator in

Filter for messages that contains text with quotation marks

Hi, I'm having a hard time trying to narrow down my search results. I would like to return only the results tha...

by Explorer in

How to join search results from two indexes based on multiple conditions

I have 2 indexes - index_1 and index_2 index_1 has the following fields index1Id currEventId prevEventId in...

by Engager in

Dynamic eval mvindex.

Good morning fellow splunkers. I have a challenge and was wondering if anyone could help me. In some logs with mult...

by Loves-to-Learn Lots in

Splunk dashboard table panel with dynamic token

hello, I have an issue when creating some visualization in splunk dashboard. Im using dashboard studio, and my object...

by Path Finder in

Why does Dashboard Classic not return result even though "Open in search" does?

Here is a really simple dashboard: <form version="1.1" theme="light"> <label>Simple input</label> <fieldset...

by SplunkTrust in

not getting output

Hi All I am using Office365, i have an office365 unified group and users are getting removed from this office365 gro...

by Explorer in

How to update enableSched in savedsearch.conf using python script

I have to create a custom command using python script to update a particular property(enableSched) from 1 to 0 or 0 t...

by Path Finder in

Produce single row by combining multiple row and column

Hi Splunk, I have a table like below Component Green Amber Red Resp_time 0 200 400 5xx 0 50 100 4xx 0 50 10...

by Engager in

Comparing results from two different dates vertically

I would like to compare specific response status stats vertically and not horizontally so that the values line up and...

by Path Finder in

Why does tstats command return different results with accelerated vs non-accelerated Data Models?

I was working with DataModels and I came across something strange about them when they are accelerated vs when they a...

by Engager in

Why does tstats command alter time stamps when I run it by _time?

I am wondering why tstats command alters time stamps when I run it by _time. | tstats values(text_len) as text_len...

by Path Finder in

Experiencing error :splunk: command not found

Hi, Kinda new to *nix o/s; its been about 10 years. Anyway I have READ the doc's and checked the answers pages, bu...

by Engager in

Get Updates on the Splunk Community!

Splunk Search

Discussions

How to find the latest event per device

How to have multiple fields (non numeric) in x-axis on a bar chart?

How to write a cron schedule to run Splunk alerts biweekly on Mondays?

Issue with StateSpaceForecast from the MLTK app

Regex Help

Count X's in each field in a table and total them in the last column

Yesterday data dashboard filtering -

Lookup search wigh showing matched keyword

Adding a Total column (without using addtotals)

how to get statistical values for different fields

Is there a way to monitor the number of files in the dispatch directory over time?

eval percent line is not producing values in the table

How to identify a skipped scheduled accelerated report ?

Filter for messages that contains text with quotation marks

How to join search results from two indexes based on multiple conditions

Dynamic eval mvindex.

Splunk dashboard table panel with dynamic token

Why does Dashboard Classic not return result even though "Open in search" does?

not getting output

How to update enableSched in savedsearch.conf using python script

Produce single row by combining multiple row and column

Comparing results from two different dates vertically

Why does tstats command return different results with accelerated vs non-accelerated Data Models?

Why does tstats command alter time stamps when I run it by _time?

Experiencing error :splunk: command not found

Developer Spotlight with Paul Stout

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

Data-Driven Success: Splunk & Financial Services

How to check MQ reconnects after a connection is d...

I cloned HTTP traffic collection from Splunk Strea...

Proactively stream data to different index after C...

Write Splunk log with Laminas

Issues in multiselect input dropdown