Splunk Search

Community Activity

Monitoring Static file Hi there, I am trying to monitor a file that doesn't change often - WebSphere nodeagent monitor.state file. I unders... by aina_sloan New Member in Splunk Search 02-09-2018 0 9	0	9
Why am I getting a "extracting multiple fields" error when try to extract fields on a log file that contains XML? Hi, I am trying to do a field extraction on a log file that contains XML as below however when I try to extract the ... by bradleycruicksh New Member in Splunk Search 02-09-2018 0 3	0	3
How can I return a list of distinct users and the number of connections from IIs logs? I want to get a list of distinct Users from IIs logs using the CS_USERNAME field Any examples out there for me to get... by lbonnes Observer in Splunk Search 02-09-2018 0 1	0	1
How to count the number of occurrences of a string in multiple fields? I have a team of Unix admins, each of which manages multiple applications. I created a CSV lookup file that contains ... by pfhendr Explorer in Splunk Search 02-09-2018 0 6	0	6
Comparing two files and output the difference for one column Hope you can help ! I have two CSV files: RESULTS1 and RESULTS2 RESULTS1 has two columns CAR T... by Derben New Member in Splunk Search 02-09-2018 0 10	0	10
Why is streamstats resetting incorrectly twice in the dataset when it should not be? Hey all, we are having a bit of trouble with the streamstats command, as the title indicates. The following code retu... by DigitalBibleSoc New Member in Splunk Search 02-09-2018 0 5	0	5
How do I formulate a regex to discard events when applying sourcetype? Hello, I'm currently creating a new sourcetype that has a TRANSFORMS-null setting with value discardit. Within my tr... by andrewtrobec Motivator in Splunk Search 02-09-2018 0 8	0	8
Does splunk user should query data using Index value? Hello All, can users in splunk query data without using the index defined in search query? i mean can user search da... by saifuddin9122 Path Finder in Splunk Search 02-09-2018 0 3	0	3
eval,passing a value in eval Hi all, Please help me … not been success in passing the output of the search into a new search (different table).... by jaygamini New Member in Splunk Search 02-09-2018 0 1	0	1
How to split a table-formatted event into multiple events during search time? Is it possible to have each piece of software as an event of its own so that I could search for a particular item? C... by davidcraven02 Communicator in Splunk Search 02-09-2018 0 2	0	2
Field extrations from XmlWinEventLog Hi, I've been trying to find a good solution to extract fields from some XML windows event logs. For instance sourcet... by hcpr Path Finder in Splunk Search 02-09-2018 0 4	0	4
How to remove all null fields to prevent gaps in my table of results? Hi there, I have a table with four fields inputted, but the issue is that some are blank in some of the events so it ... by gracemaher Explorer in Splunk Search 02-08-2018 2 11	2	11
Search inside the files based on keywords to do sub search in splunk I have following types of txt files in my source and contents of each files are mentioned below in CAPS: a1.txt: ... by rojit Explorer in Splunk Search 02-08-2018 0 9	0	9
Cannot Call A Search Command from Search Macro Hello everyone; I am trying to call a search command from a search macro. Does anyone have a suggestion. Example: Ty... by spraus Explorer in Splunk Search 02-08-2018 0 6	0	6
Why does Splunk suggest using Regex101.com? The Regex I create extract fields inside the Regex101 site, but do nothing in Splunk. What gives? Regex in use on R... by panderla Loves-to-Learn Lots in Splunk Search 02-08-2018 0 9	0	9
How can I reverse grouping in nested JSON block? I have a JSON block that contains one account id and a number of nested resources. I can easily get a list of resourc... by a238574 Path Finder in Splunk Search 02-08-2018 0 0	0	0
Is it possible to add "starting the search" to the link switcher option? Hi, I would like to implement some options to show/hide panels in a dashbaord. Currently the plan to have an option ... by HeinzWaescher Motivator in Splunk Search 02-08-2018 0 4	0	4
How to join two tables? Hi All, I have a search: \| savedsearch Cycle_11 \| append [\| savedsearch Cycle_10] with the results: ... by jvmerilla Path Finder in Splunk Search 02-08-2018 0 10	0	10
evaluation with condition I have two values x and y. Both values are dynamic (keeps on changing). x indicates _time and y indicates a value tha... by zacksoft Contributor in Splunk Search 02-08-2018 0 23	0	23
Lookup match Hi, I am trying to do the following: 1 - Search an index; 2 - For each result, search for matches in lookup table 1,... by robettinger Explorer in Splunk Search 02-08-2018 0 14	0	14
Map a field to a value within the log file I am working with clock sync log files. The top 3 lines have the ip address -> MAC address mapping... The rest of the... by neltonk Path Finder in Splunk Search 02-07-2018 0 1	0	1
How can I tie together Windows Logon and Linux SSH Events to monitor root and other linux admin accounts? Hi! My goal is to be able to tie together events from Linux events and Windows events in order to track Windows user... by matthewssa Path Finder in Splunk Search 02-07-2018 0 4	0	4
What is an alternate way to do this query: count(eval(like('some.field',"A"))) AS accepted? SPLUNK NINJAS! I NEED YOUR HELP! I have a firewall issue where any IP outside of our intranet, Splunk throws errors ... by charliedgz Path Finder in Splunk Search 02-07-2018 0 2	0	2
Transacting with High Cardinality Groups and Memory Consumption of stats Data Set Characteristics We have an index containing ~100k events that are each about 1k in size, making a roughly 1... by kulick Path Finder in Splunk Search 02-07-2018 0 0	0	0
How can I analyze different events where the field is the same but different keywords and get a count of events where one event led to another? Hi Experts, I have got a requirement where I have a few events where one of the fields contains some keyword say "Un... by macadminrohit Contributor in Splunk Search 02-07-2018 0 6	0	6

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Splunk Search

Monitoring Static file

Why am I getting a "extracting multiple fields" error when try to extract fields on a log file that contains XML?

How can I return a list of distinct users and the number of connections from IIs logs?

How to count the number of occurrences of a string in multiple fields?

Comparing two files and output the difference for one column

Why is streamstats resetting incorrectly twice in the dataset when it should not be?

How do I formulate a regex to discard events when applying sourcetype?

Does splunk user should query data using Index value?

eval,passing a value in eval

How to split a table-formatted event into multiple events during search time?

Field extrations from XmlWinEventLog

How to remove all null fields to prevent gaps in my table of results?

Search inside the files based on keywords to do sub search in splunk

Cannot Call A Search Command from Search Macro

Why does Splunk suggest using Regex101.com?

How can I reverse grouping in nested JSON block?

Is it possible to add "starting the search" to the link switcher option?

How to join two tables?

evaluation with condition

Lookup match

Map a field to a value within the log file

How can I tie together Windows Logon and Linux SSH Events to monitor root and other linux admin accounts?

What is an alternate way to do this query: count(eval(like('some.field',"A"))) AS accepted?

Transacting with High Cardinality Groups and Memory Consumption of stats

How can I analyze different events where the field is the same but different keywords and get a count of events where one event led to another?

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Event Series: Telemetry Pipeline Management

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation