Find Answers

Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

Category Activity

Is it possible to include metadata in keyword searches? It is a subtlety of the search language that keyword searches run against the raw event data only. To search metadat... by hulahoop Splunk Employee in Splunk Search 03-09-2010 1 2	1	2
What is the difference between a lightforwarder and a regular forwarder? Apart from the fact that a lightforwarder does not have a web UI, what are the main differences between the 2 apps? by Mick Splunk Employee in Getting Data In 03-09-2010 0 2	0	2
How can I limit the number of results that can be returned in a search (in UI)? I'd like to limit certain users from running expensive searches by limiting the number of results that can be returne... by the_wolverine Champion in Splunk Search 03-09-2010 2 1	2	1
Data from forwarder arrives at the indexer but does not get indexed Hi I have set up a light weight forwarder that appears to be getting data to the indexer. But I can't search for an... by chris Motivator in Getting Data In 03-05-2010 2 2	2	2
What time format do I use when setting srchTimeWin (in authorize.conf)? I'm trying to configure a search Time Window for my Splunk roles. I've read the documentation but can't find instruc... by the_wolverine Champion in Installation 03-05-2010 1 1	1	1
How do I change the default granularity on a chart? How do I change the default granularity on a chart? It appears I'm hitting a limit somewhere and I'm not getting as ... by dskillman Splunk Employee in Splunk Search 03-04-2010 5 2	5	2
How to open a log file with Splunk from Windows Explorer? While I browse my local drive in Explorer I would like to add and search some log files with Splunk without opening a... by Leo Splunk Employee in Splunk Search 03-03-2010 1 1	1	1
Incorporate something like this into a Splunk search builder (module)? There are some who are really good at regular expression, some okay, and the rest who downright are lost beyond a spl... by matt_1 Explorer in Splunk Search 03-03-2010 2 1	2	1
ERROR SavedSplunker - No record for that user Seeing this error in splunkd.log on a splunk indexer when running a saved search. What does it mean? by Jaci Splunk Employee in Monitoring Splunk 03-01-2010 2 1	2	1
AD is only returning 1000 entries. How do I get around this? I'm trying to configure LDAP auth for Splunk. I'm running into an issue where AD is only giving me 1000 entries and ... by the_wolverine Champion in Security 02-27-2010 2 2	2	2
maxresults and stats command Does maxresults in limits.conf have an effect when piping results to the stats command? For example, if I run a sear... by kbecker Communicator in Splunk Search 02-26-2010 2 1	2	1
How do I search across a specific or custom time range within each hour of the day? I have millions of events being indexed by Splunk now and I suspect something is happening within my IT environment a... by maverick Splunk Employee in Splunk Search 02-24-2010 1 1	1	1
Estimating storage requirements on a windows server In the installation manual it shows how once you have indexed some data by using the "du -shc hot_v*/rawdata" command... by Scott Engager in Installation 02-23-2010 1 1	1	1
Can I replicate a subset of the data to a non-Splunk destination? I need to do the following on my forwarder: Forward all data received and gathered by the forwarder to Splunk indexe... by Alan_Bradley Path Finder in Getting Data In 02-23-2010 1 1	1	1
retrying a scripted input after a failure [I heard this question on an internal mailing list, but it seemed generally relevant so asking it here too] I have a... by Justin_Grant Contributor in Getting Data In 02-22-2010 1 2	1	2
How to assign a value to a key when working with fields? Hi Splunkers, I have a sample Perforce log file and I'm trying to extract the code contributors. Here is an example:... by Nicholas_Key Splunk Employee in Splunk Search 02-22-2010 2 2	2	2
Add reports to dashboards I created a snazzy new report that generates a chart, how can I add this to my dashboard? by benstraw Splunk Employee in Dashboards & Visualizations 02-22-2010 1 3	1	3
How do i perform a UI search via the CLI How do i use the same search strings in splunks UI on the command line? by Chris_R_ Splunk Employee in Splunk Search 02-19-2010 0 4	0	4
How to I specify a minimum time between events? There are plenty of ways to specify the exact time range or maximum range between two events in a search. But I need ... by Tisiphone Engager in Splunk Search 02-19-2010 3 1	3	1
what does connected mean in transaction explain the significance of the connected flag in transaction by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 2 1	2	1
annotated raw field in transactions Dan Goldburt asks: I'm consistently getting the following request from customers: "can I see where each event came fr... by Ledion_Bitincka Splunk Employee in Splunk Search 02-11-2010 1 1	1	1
Is it possible to tell LINE_BREAKER to stop eating my angle bracket? The use of LINE_BREAKER is a bit cryptic to me... ok, a lot. But I think I've managed to figure out how to break my ... by hulahoop Splunk Employee in Getting Data In 02-10-2010 0 6	0	6
How to direct certain sourcetypes into a non-default index When I've created a new index. how can I direct certain sourcetypes to be indexed in that new index, rather than into... by Alan_Bradley Path Finder in Security 02-10-2010 0 1	0	1
NotImplementedError: Cannot find object mapper for panel type: form When attempting to make a Simple Form Search using the Developer Manual documentation, I encounter the error: Not... by Yancy Path Finder in Dashboards & Visualizations 02-09-2010 0 1	0	1
How do I group lines into a single event at index-time? What I'm trying to do: at index time, create a multiline event based on a unique ID. In the data sample below, I nee... by hulahoop Splunk Employee in Getting Data In 02-08-2010 2 6	2	6