Splunk Search

Community Activity

Extract fields using colon (:) except time field Hello, I'm trying to use the field extraction tool for a data file that where the fields are delineated by a colon(:... by richnavis Contributor in Splunk Search 01-22-2018 1 3	1	3
Exttract the first value for multivalue field events Hey, I have a sample event,which is a multivalue field,I want to extract Service ID and Ent_Provider Id from the t... by vrmandadi Builder in Splunk Search 01-22-2018 0 6	0	6
how to divide two fields in a search and print the result values in timechart Hi, suppose a query is like: index="demo1" total_bytes,total_time,date etc I need to divide total_bytes/total_... by sawgata12345 Path Finder in Splunk Search 01-22-2018 0 5	0	5
Chart and table of occurences of field by another field Hi I would like to have some chart ( bar etc.) and table of logs which contain two information titleID and userID. I... by swdowiarz Path Finder in Splunk Search 01-22-2018 0 11	0	11
Multisite Index replication question I must admit I am struggling with wrapping my head around multisite replication... We operate in AWS and do build inf... by brent_weaver Builder in Splunk Search 01-22-2018 0 3	0	3
How do I reference lookup table with a field that have dynamic value? I have a field value for IP address in the lookup dataset but the IP address from real logs are dynamic and constantl... by LeeZeeYuen New Member in Splunk Search 01-22-2018 0 5	0	5
How can I make this search faster and more efficient "index=_internal per_host_thruput \| timechart span=1d dc(series) as hosts" The search below yields a count of hosts each day. It works well but will be extremely slow and inefficient if I run ... by mattbellezza Explorer in Splunk Search 01-22-2018 0 2	0	2
How to move raw data with no field assigned to a table? This might be a really simple question, but I haven't been able to find an answer as of yet. I have some raw data fro... by cdhippen Path Finder in Splunk Search 01-21-2018 0 3	0	3
Sum fields I would like realize a sum of data like that par exemple : data = data + val1 But splunk dioesn’t recognize this s... by isachristophe New Member in Splunk Search 01-21-2018 0 8	0	8
I am looking for a functionality we can create csv look ups based on Month in splunk. Is this possible. Is it possible to delete data based on a certain conditions in lookup ? I need a handle a years data in splunk and looking for suggestions to split the dataset and then populate the dashboa... by priyanka0309 New Member in Splunk Search 01-21-2018 0 7	0	7
How to evaluate multiple values to a single answer . Like if value in(1,5,3,2,7) then Code1 else if value in(4,6,0) Code 2 else Code 3 Hello, I need to creating grouping of a results by error code . There are different type of error code like 1123, 0... by jagdeepgupta813 Explorer in Splunk Search 01-19-2018 0 3	0	3
Tricky regex Hi, I have this data "166.78.66.241" 70.121.107.109 "70.121.107.109" - - [19/Jan/2018:12:24:33 -0600] "POST /fil... by dbcase Motivator in Splunk Search 01-19-2018 0 2	0	2
How to determine the amount of logs per server per day I have about 25 servers to add to Splunk. Currently we run about 35 gig per day with our license at 50 gig. Can it ... by kekac00 Explorer in Splunk Search 01-19-2018 1 1	1	1
Why do I get "Invalid key in stanza..." Deploying app to collect IIS logs. When restarting the forwarder get the following: " Invalid key in stanza [monitor... by JarrettM Path Finder in Splunk Search 01-19-2018 0 4	0	4
How to add hyperlink in specific text? I want to have a hyperlink in my Title text but not all the text in the title will be clickable, the only clickable i... by katrinamara Path Finder in Splunk Search 01-19-2018 0 2	0	2
I want to ready value on specific time for last one week I want to read specific string between 9:15-9:45, each day for last 7 days. host=manana string \| stats dc(count) T... by manapuna New Member in Splunk Search 01-19-2018 0 5	0	5
Filter events from syslog Hi at all, this is a recursive question which I often I answered in past! I have to filter before indexing logs rece... by gcusello SplunkTrust in Splunk Search 01-19-2018 0 3	0	3
Generate Matrix from Table Data Hi, I am currently working with a table that looks like this: col1 \| col2 \| value xA \| yA \| 1.0 xA \| yB \| 1.5 xB \|... by jean_boulanger Explorer in Splunk Search 01-19-2018 0 4	0	4
How do I set a query to run overnight without it expiring before it completes? I need to run a search that will take around 6-8 hours. Just a lot of URLs with wildcards to look for in a terabyte o... by thisissplunk Builder in Splunk Search 01-19-2018 0 4	0	4
Include zero in the average Splunkers! I'm not able to solve a strange issue... Basically, the stats avg() is omitting values in the calculatio... by CarmineCalo Path Finder in Splunk Search 01-19-2018 0 5	0	5
How to add string on a field value? Hi Guys! I am creating a table with number of errors per robot. The field values of these robots are "IGH2001", "IGH... by auaave Communicator in Splunk Search 01-18-2018 0 5	0	5
Search on an eval variable - find filenames with yesterday's date I used eval to create a field with the yesterday's date: \| eval today=strftime(now(),"%Y%m%d") I want to search on ... by raziasaduddin Path Finder in Splunk Search 01-18-2018 1 9	1	9
mvcount and stats count give different results I have a log file where each line has an itemId and a clusterId. When I run the following sort of queries \| stats c... by viggor Path Finder in Splunk Search 01-18-2018 0 3	0	3
How to "join" two different searches with no common fields? Splunkers! I need to join the follow inputlookup + event searche in order to have, for each AppID, the full set of m... by CarmineCalo Path Finder in Splunk Search 01-18-2018 0 7	0	7
How to remove limitations of join command Hi, I'm using the join command to join to searches based on a common field called ITEM. Based on this join, I want t... by mahbs Path Finder in Splunk Search 01-18-2018 0 9	0	9