Splunk Search

Community Activity

	Need help with regex, mvindex, or other option for field-extractions Dec 5 18:04:51 192.168.69.50 pfsp: Host Detection alert #22049413, start 2017-12-06 00:03:45 GMT, duration 66, direc... by avishek_08 New Member in Splunk Search 01-12-2018 0 6	0	6
	How to exclude the events ? I have set of events from which there are a few events that starts with a three digit number (for example 200 23 45 ... by zacksoft Contributor in Splunk Search 01-12-2018 0 15	0	15
	How do I get the failure status for that percentile? i want to calculate failure status 404 for service name .when the status is reached 90% .I need to trigger email? in... by karthi2809 Builder in Splunk Search 01-12-2018 0 3	0	3
	Splunk ES seperating source types I want to run a single search head using the ES app module. My question is I have many different log sources feeding... by neely_hpe New Member in Splunk Search 01-12-2018 0 1	0	1
	getting stats from a query where match is found. Hi, \| rest /services/authentication/users splunk_server=local \| search [\| rest /services/authentication/current-cont... by surekhasplunk Communicator in Splunk Search 01-12-2018 0 6	0	6
	Apply search field extraction to props.conf and/or transforms.conf so extraction done at index-time I have some BIG-IP data that I am ingesting as plain text files, as I can't directly connect to the BIG-IP servers du... by gjlewis Explorer in Splunk Search 01-12-2018 0 1	0	1
	Conditional Lookup Hi Team, This appears to be a complex scenario to me to implement on Splunk Below is the table i have on Splunk ... by ashish9433 Communicator in Splunk Search 01-12-2018 0 3	0	3
	Left Join search with lookup over inputlookup Ciao , I'm trying to solve the following problem. I've a main search like this index=major _static \| fields _time, i... by CarmineCalo Path Finder in Splunk Search 01-12-2018 0 5	0	5
	Table not populating all results in a column I am trying to create a dashboard panel that shows errors received. I am using a field alias to rename three fields t... by sheloaha Path Finder in Splunk Search 01-12-2018 0 4	0	4
	Display day wise results for a stats count Hello I have a below query. sourcetype=ProcessStart OR sourcetype=ProcessEnd \| transaction RunID \| table RunID, Robo... by maria2691 Path Finder in Splunk Search 01-12-2018 0 4	0	4
	Parsing a field in csv having key value pairs and displaying it as header and value in table We are trying to parse an entry in the csv which is of the below format, 2018-01-11 00:00:00,default.MS_2016,shekhar.... by swarjs Explorer in Splunk Search 01-11-2018 0 10	0	10
	how can I map dhcp log to firewall log in real time in ES app how can I map dhcp log to firewall log in real time in ES app I am mapping dhcp IP with firewall Ip and saving the c... by ayushi_kaushik New Member in Splunk Search 01-11-2018 0 0	0	0
	How to check field values are valid?? I have field which is having sequence number .I want to check if it is valid and make a new field that will give if s... by chitreshakumar Communicator in Splunk Search 01-11-2018 0 1	0	1
	inputlookup in a map search Hi splunk fellows, Struggling a bit with the map command I never used before : \| inputlookup myfile1.csv \| append ... by cardinalga Explorer in Splunk Search 01-11-2018 0 6	0	6
	Conditional field alias / rename I'm attempting to rename a field of windows data that will be put into a datamodel, however There seems to be a catch... by tmarlette Motivator in Splunk Search 01-11-2018 0 2	0	2
	Regular Expression to Extract a username out after matching a Specific String of Characters Hi All, I am attempting to do a field extraction using regular expression and I am having some trouble. I have the ... by zzaveri Explorer in Splunk Search 01-11-2018 0 11	0	11
	Why does my simple search return a variable number of events with each run? I have a simple search against my firewall logs. the search looks like index=firewall session_id=1234 src_ip=10.10.0... by MonkeyK Builder in Splunk Search 01-11-2018 0 8	0	8
	Simple extraction regex to parse out space seperated logs? I'm dealing with a highly customized access log that isn't being processed properly by access_combined sourcetype dur... by thisissplunk Builder in Splunk Search 01-11-2018 0 5	0	5
	How to combine wildcard results into one field? index=perfmonitor sourcetype=dc_perfmonitor source="f:" \| fields + host, "Processor Time" \| stats avg("*Proces... by splunklearner9 Engager in Splunk Search 01-11-2018 0 3	0	3
	Modification of _time value Hello, When I create a new index with an old index I would like to have an _time with a time different than the time... by isabellechristo New Member in Splunk Search 01-11-2018 0 10	0	10
	LEFT JOIN not working The below left join identified by ** is what i am trying to join onto the search but it is not listing all product_na... by davidcraven02 Communicator in Splunk Search 01-11-2018 0 5	0	5
	Extracting field value gets encoded. Why? I have extracted value from the message log. So I have custom field with its value. In the log, it displays "* myName... by jkim34 New Member in Splunk Search 01-11-2018 0 10	0	10
	limits.conf - any settings we can change from defaults to improve performance on server with 24 CPUs and 256GB memory? We have 9,255,277,001 events indexed for 90 days of hot/warm data. We need to run on a single Splunk instance. Our se... by simpkins1958 Contributor in Splunk Search 01-11-2018 0 1	0	1
	Do you think we can optimize this long search? The search: index=queues sourcetype="jms:queues" "Queues.name"="road.sa**" earliest=-5m@m \| stats max("Queues.pendi... by venkatesh296 Explorer in Splunk Search 01-11-2018 0 25	0	25
	Invalid FORMAT when creating a field transformation I have these events that come with a source attribute something like source = /var/collectd/csv/sv3vm5b/cpu-0/cpu-idl... by DUThibault Contributor in Splunk Search 01-11-2018 0 5	0	5