-
5 years, 11 months ago
tokenwander wrote a new post
index=_* search=* user=* user!=- user!=splunk-system-user
| rex field=search max_match=0 “indexs*=[s”]*(?.*?)[|s”)]”
| rex field=search max_match=0 “[+(|+]index%3D(?.*?)[+|)+]”
| eval […] -
6 years ago
tokenwander wrote a new post
I often get asked how much a certain dashboard gets looked at, or how many times a user looks at a specific app. I wrote this quick query to answer that question.
index=_internal sourcetype=”splunk_web_access” […] -
6 years ago
tokenwander became a registered member
-
6 years ago
tokenwander became a registered member
Doris,
You might want to copy the search to notepad/notepad++ first as I’ve noticed in general when trying to copy/paste searches some of the special characters don’t get copied correctly.
I copied this search to notepad++ and then copied from there to Splunk and was able to run the search