Find Answers

Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

Category Activity

How do I group lines into a single event at index-time? What I'm trying to do: at index time, create a multiline event based on a unique ID. In the data sample below, I nee... by hulahoop Splunk Employee in Getting Data In 02-08-2010 2 6	2	6
How recent is recent? On the page 'Manager > Searches and reports,' enabled scheduled searches have a 'View Recent' link. I have 2 schedul... by hulahoop Splunk Employee in Reporting 02-05-2010 1 9	1	9
what will it take for MULTIKV to format a table (1 header row, 1+ data rows) properly? Such a helpful command, and yet doesn't work for me... by V_at_Splunk Splunk Employee in Splunk Search 02-05-2010 1 3	1	3
Why do I only see 10 results/columns in my count table? When I run this search - source="*conn.log" \| rex field=_raw "\.IP = '(?<connectionIp>[^']+)" \| fields host, connect... by Mick Splunk Employee in Splunk Search 02-05-2010 4 1	4	1
How do I report on message volume over time We are attempting to create a report that compares message traffic for the past two complete weeks. We have this as... by Mick Splunk Employee in Splunk Search 02-05-2010 0 2	0	2
Managing Eventtypes and Tags Any recommended best practices for managing eventtypes and their corresponding tags? I've found the Splunk Common In... by Yancy Path Finder in Splunk Search 02-02-2010 0 2	0	2
"Invalid Regex: no named extraction" in the interactive field extractor What is wrong with this regex? (?P<AUTH_PIN_TYPE>[^ ]+)( [^ ]+){2}$ The interactive field extractor gives this err... by dinh Path Finder in Splunk Search 02-01-2010 0 5	0	5
How do I refer to the first, nth or last value of a multivalue field? I am using the transaction command to sessionize web access log events and therefore have made referer, uri etc. into... by cfrln Explorer in Splunk Search 02-01-2010 4 3	4	3
How do I group and identify a set of events based on a time range? Let say I have events coming in everyday and I want to group the events as Monday's events, Tuesday's events, and so ... by hans Splunk Employee in Splunk Search 01-29-2010 1 2	1	2
What are the default sourcetypes and how are they determined? Sometimes Splunk sets the sourcetype on an incoming file as breakable_text or too_small. What determines these sourc... by Yancy Path Finder in Getting Data In 01-29-2010 1 1	1	1
How to best determine IP range membership? Use Case: Find Juniper firewall events where the source/destination IP (Src_Zone/Dst_Zone) does or does not belong in... by hulahoop Splunk Employee in Splunk Search 01-28-2010 5 5	5	5
Can the transaction command be used to group events where different fields have the same value? Use Case: Correlate logon events from a Windows desktop to events on the domain controller. Sample (shortened) event... by hulahoop Splunk Employee in Splunk Search 01-28-2010 2 9	2	9
Can I alert when the value of a field changes? I've got an application that logs status events. The values in these events generally will not change. Is there a s... by matt Splunk Employee in Splunk Search 01-27-2010 1 1	1	1
monitoring hundreds of metrics and/or configuration items: how to do efficiently? I'm trying to use Splunk to monitor both runtime metrics and configuration state of a server application like JBoss o... by Justin_Grant Contributor in Getting Data In 01-27-2010 2 4	2	4
Error on using eval in a subsearch What is wrong with the way I'm using eval here? source="/some.audit.log" "End" "/foo/baz" \| rex field=_raw "(?P<ReqI... by dinh Path Finder in Splunk Search 01-27-2010 0 5	0	5
Remove annoying restart messaging I don't want to restart splunk right now, but the UI is giving my and my users an annoying message saying I need to r... by benstraw Splunk Employee in Deployment Architecture 01-27-2010 2 2	2	2
How can summary indexing help improve the performance of my dashboards and reports I have a report on my dashboard that takes a very long time to build, how can I use summary indexing to improve the p... by benstraw Splunk Employee in Dashboards & Visualizations 01-25-2010 0 3	0	3
How do I search for a single specific event? Sometimes I come across an event in my index that I'd like to refer to later, either as part of an investigation or t... by Johnvey Contributor in Splunk Search 01-25-2010 1 3	1	3
performance characteristics of dedup command I'm thinking about using the DEDUP commend to solve the following problem: I have an event with an ID field and I'd l... by Justin_Grant Contributor in Monitoring Splunk 01-22-2010 2 1	2	1
I know the data is in the index, why didn't my scheduled search find all of the events? I have a saved seach setup to check every minute for file changes. I have the start time set for [-1m] to search bac... by Mick Splunk Employee in Splunk Search 01-22-2010 2 1	2	1
suppressing adjacent events with duplicate field values I have a log which often has redundant events, where "redundant" is defined as 2+ events, on subsequent lines, where ... by Justin_Grant Contributor in Splunk Search 01-22-2010 0 2	0	2
Will having lots of extracted fields increase my index size? I need to understand how adding fields to raw data will increase our index size growth. We are in the process of addi... by Mick Splunk Employee in Splunk Search 01-21-2010 2 1	2	1
How do I share all of the field extractions defined in a given app with all other apps? I need to share all of the field extractions in my app with all of the other apps on the system. What is the most ef... by matt Splunk Employee in Splunk Search 01-21-2010 2 5	2	5
What is the format of the Sources.data file? $SPLUNK_HOME/var/lib/splunk/defaultdb/db/Sources.data On a fresh install I see this file has something like this: ... by matt Splunk Employee in Splunk Search 01-21-2010 1 2	1	2
Can I monitor Windows Registry with Splunk? Are there ways in Splunk to monitor and index any activity on Windows Registry? by Ledio_Ago Splunk Employee in Getting Data In 01-20-2010 2 1	2	1