Splunk Search

Community Activity

Why is my column chart not displaying any data even though it is setup correctly? Here is my search query: index=jenkins* job_name="jenkins-representative-jobs_github_organization/math_utilities/ma... by cdgill Explorer in Splunk Search 02-01-2018 0 8	0	8
How do I return all events whether they're in Lookup table or not? I have the following search: index="foo" EventCode=* \| lookup windows_signatures.csv signature_id AS EventCode OUTPU... by jwalzerpitt Influencer in Splunk Search 02-01-2018 1 3	1	3
How do I have a single Total column without adding it to the stacked chart? I have created a nice stacked timechart that I would like to see the Totals of in the table under the chart. The add... by shargrave Engager in Splunk Search 02-01-2018 0 2	0	2
How to search multiple virtual indexes with Splunk Analytics for Hadoop? Hello, we currently have two virtual indexes with data in them retrieving data from Hadoop Distributed File System. W... by EricLloyd79 Builder in Splunk Search 02-01-2018 0 5	0	5
How can I join 2 tables to create a new table with the given conditions? So this is what I want to do, and I don't know if Splunk can do this. This is the result for Table A Table A hostA... by gts_ame_tfo_cty New Member in Splunk Search 02-01-2018 0 6	0	6
how can i exclude the results of table B from table A ? Here is my query: index="backup_script" conf_brand=ios OR conf_brand=nxos \| rex field=conf_hostname "(?P^[^.]+)" \| ... by gts_ame_tfo_cty New Member in Splunk Search 02-01-2018 0 5	0	5
How to update the lookup table before the scheduled search runs so it gives all lookup entries? I have scheduled search that periodically updates lookup table CSV file every 15 minutes. I updated this lookup with ... by Nam7Splnk Explorer in Splunk Search 02-01-2018 0 1	0	1
help with regex I have the below sample data, and I want to extract everything after the service URL till maxd=60&mind=60 into a new... by vrmandadi Builder in Splunk Search 02-01-2018 0 4	0	4
How to group the data by date and type, so each entry would count as 1, from SQL Datasource? I have a date in my SQL database that I want to group the data by that date and Type. The Year/Month/Week/Day each en... by Bbyers3 New Member in Splunk Search 02-01-2018 0 0	0	0
How to only display the top 3 hits from a values(field) command? I have web logs for my website and am trying to construct a table that shows the top visitors based on country and re... by DEAD_BEEF Builder in Splunk Search 02-01-2018 0 2	0	2
How to get statistics from few rows with the same task id? Hi, I have few rows in 1 log: 2018-01-25 13:49:40,107 INFO [com.wss.service.agent.AgentServlet] (default task-46) ... by niroren New Member in Splunk Search 02-01-2018 0 4	0	4
Merge Lines Query based on ID Hello, I would like to merge 2 lines which an ID is the unique Key. Ex Username Date ID M... by mnorindr Engager in Splunk Search 02-01-2018 1 5	1	5
How do you add dummy events to a search result? I'm currently producing a table from a search. There is some static data that needs to be added which is not in the i... by Marinus Communicator in Splunk Search 02-01-2018 7 7	7	7
i am unable to search the data with sourcetype name but i can search data by index name. i am unable to search the data with sourcetype name but i can search data by index name.Please tell what can i do to ... by Utkarsh_Singh New Member in Splunk Search 01-31-2018 0 2	0	2
How to make a bar chart from stats and divide it according to a field? I have counts of aging tickets which we have divided into different ranges .But I want to show it as chart which will... by chitreshakumar Communicator in Splunk Search 01-31-2018 0 8	0	8
Why is there a big difference in performance of searches run admin vs splunk system users? I have been investigating into searches for both admin user and splunk system user. Searched conducted by System User... by anupkpal New Member in Splunk Search 01-31-2018 0 1	0	1
How to view my error name in where clause? Now i am getting only count i need error messages and host index=test "java.nio.channels.ClosedChannelException"... by karthi2809 Builder in Splunk Search 01-31-2018 0 2	0	2
Can I add a priority field value as P3 for all the output? Hi I want to add a priority as P3 for the below output. Query index=nonprod sourcetype=port_availability \| de... by Mayanakhan Explorer in Splunk Search 01-31-2018 0 5	0	5
regex to find domain\account This is the regex I have, though not finding anything..: \|rex "(?<account>\w{2,6}\\.{3,15})" example of domain and... by zaynaly Explorer in Splunk Search 01-31-2018 0 3	0	3
How to sort results in a search by using a lookup table? So here is what I want to do. I want to be able to search an index and sort the results via subnet/location containe... by dbturner New Member in Splunk Search 01-31-2018 0 1	0	1
How to use calculated timeframe in splunk query? Hello, I am trying to write a query which results in the subtraction of $datetimepicker value events counts & $datet... by shehenshah14 New Member in Splunk Search 01-31-2018 0 2	0	2
"stats count" and other summary commands report ~2x the actual counts We have a new sourcetype that's using the AWS Add-on to grab data from S3 (SQS-based). Whenever we do a stats count ... by tschrantz New Member in Splunk Search 01-31-2018 0 4	0	4
How do I get the avg for each column in a Totals row at the bottom? Hello My base search uses CSV data and is very basic, simple field renames index=fp_dev_csv sourcetype=fp:dev:csv \|... by tkwaller_2 Communicator in Splunk Search 01-31-2018 0 2	0	2
I need an alert that triggers when it can't find a certain message in the logs within the last hour It always brings up no results. Here is my query: index=abc host = "123" OR host = "456" OR host = "789" OR host = ... by rgarbac1 New Member in Splunk Search 01-31-2018 0 5	0	5
Another Regex Question I'm trying to rex out a new field from the message.Exception field. What I'm trying to extract is in the brackets be... by kwkeefer Explorer in Splunk Search 01-31-2018 0 5	0	5

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Splunk Search

Why is my column chart not displaying any data even though it is setup correctly?

How do I return all events whether they're in Lookup table or not?

How do I have a single Total column without adding it to the stacked chart?

How to search multiple virtual indexes with Splunk Analytics for Hadoop?

How can I join 2 tables to create a new table with the given conditions?

how can i exclude the results of table B from table A ?

How to update the lookup table before the scheduled search runs so it gives all lookup entries?

help with regex

How to group the data by date and type, so each entry would count as 1, from SQL Datasource?

How to only display the top 3 hits from a values(field) command?

How to get statistics from few rows with the same task id?

Merge Lines Query based on ID

How do you add dummy events to a search result?

i am unable to search the data with sourcetype name but i can search data by index name.

How to make a bar chart from stats and divide it according to a field?

Why is there a big difference in performance of searches run admin vs splunk system users?

How to view my error name in where clause?

Can I add a priority field value as P3 for all the output?

regex to find domain\account

How to sort results in a search by using a lookup table?

How to use calculated timeframe in splunk query?

"stats count" and other summary commands report ~2x the actual counts

How do I get the avg for each column in a Totals row at the bottom?

I need an alert that triggers when it can't find a certain message in the logs within the last hour

Another Regex Question

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Event Series: Telemetry Pipeline Management

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation