python (65.2k questions)

javascript (44.3k questions)

reactjs (22.7k questions)

java (20.8k questions)

c# (17.4k questions)

html (16.3k questions)

r (13.7k questions)

android (13k questions)

Questions - splunk-formula

Splunk search by given timestamp not the time of ingestion to splunk

Is it possible to connect the timestamp given in the Data set to the Splunk date picker.
test-img

Enoy Lu

splunk

splunk-query

splunk-formula

splunk-calculation

splunk-dashboard

Votes: 0

Answers: 1

Latest Answer

Every event has a least one timestamp associated with it, _time, and that timestamp is what is connected to the time picker. If you want to use a different field then you'll have to filter the events...
test-img

RichG

Create a Splunk alert from a log file when a file with name hello.imp is below 10 bytes

I'm trying to write a Splunk query where it searches for a file called hello.imp from a log file and returns with a output if the file size is below 10 bytes. I have the index and log location but una...
test-img

MSC

splunk

splunk-query

splunk-formula

splunk-calculation

splunk-dashboard

Votes: 0

Answers: 1

Latest Answer

You can get the size of a source file by adding up the sizes of each event within that file. Like this: index=foo source=bar | eval size=len(_raw) | stats sum(size) as TotalSize
test-img

RichG

Splunk: Combining multiple chart queries to get a single table

As on today we have two queries that are running  1st query: Count of api grouped by apiName and status index=aws* api.metaData.pid="myAppName" | rename api.p as apiName | chart count BY api...
test-img

Vikhyath Maiya

splunk

splunk-query

splunk-formula

splunk-calculation

splunk-dashboard

Votes: 0

Answers: 1

Latest Answer

The challenge here is the two queries use different groupings - apiName and status in query1 and apiName alone in query2. Simply combining the two chart commands is not possible. We can, however, app...
test-img

RichG

Query to extract data

Here is a snippet of the logs: 127.0.0.1 - - [01/Dec/2020:00:00:11 -0500] "GET / url:"api/orderLaptop for customer id 123" 127.0.0.1 - - [01/Nov/2020:00:00:24 -0500] "GET / url:&qu...
test-img

user3376592

splunk

splunk-query

splunk-formula

splunk-calculation

splunk-dashboard

Votes: 0

Answers: 1

Latest Answer

Assuming that you already have the correct configs to extract the event time from the log event, you can format the month from the extracted _time with strftime(). Then, I would extract the other fiel...
test-img

Mads Hansen

Posts

Questions

Blogs

Jobs