Splunk Search

Community Activity

DF details not rolling in servers We are trying to get df details in our log. these details are rolling in few servers but it is not rolling in few ser... by Manoshanni New Member in Splunk Search 01-05-2018 0 1	0	1
i want to keep the SSED_BUS-number as it is and i want mask other number and email id SSED-BUS-0123 the package is failed to accept SSED-BUS-1466 master id 1-fjdfh23 SSED-BUS-13583 master 85793 SSED-BUS-... by DataOrg Builder in Splunk Search 01-05-2018 0 2	0	2
pls help with regular expression i want to keep the pattern of specific word which starts with OS0003/SSED-BUS-0015 as it is and want to mask others n... by DataOrg Builder in Splunk Search 01-04-2018 0 3	0	3
the search job terminated unexpectedly This search take only a few second to come back index=* sourcetype=* (source="/opt/data/-AA_.csv" OR source="/opt/dat... by srobinsonxtl Path Finder in Splunk Search 01-04-2018 0 4	0	4
Convert multi-value expression to field names and values I have a string, "one:isone,two:istwo,three:isthree" The goal is to convert these to fields and values, without k... by rharrisssi Path Finder in Splunk Search 01-04-2018 0 1	0	1
Rex extraction I have a field called "user", i'm trying to extract the username from the string and create a new field called extrac... by redferrari New Member in Splunk Search 01-04-2018 0 4	0	4
Run Alert Every Few Hours Between Specific Hours/Days I have some events that only happen every few hours between the hours of 8AM and 6PM, M-F. So, I want to set up a lo... by SplunkLunk Path Finder in Splunk Search 01-04-2018 0 2	0	2
Changing of management port still pointing to DS & receiving the logs. My question might be weird. I change the management port on one of endpoint(universal forwarder)from multiple forwar... by N92 Path Finder in Splunk Search 01-04-2018 0 1	0	1
Why Doesn't Coalesce work in an If/Case Statement? I am trying to write a search that if the field= Email then perform a coalese, but if the field isn't Email- just put... by katzr Path Finder in Splunk Search 01-04-2018 0 10	0	10
How do you include a literal double quote character in a Splunk Regex I'm using the _rex command and I want to create a regular expression that contains a literal double quote character. ... by jbrenner Path Finder in Splunk Search 01-04-2018 1 4	1	4
Sort and Sum...a more elegant way? New to dbs and Splunk. Querying against a CSV file of buy events. Want to return top 10 Users by purchase totals. ... by JamesPineda New Member in Splunk Search 01-04-2018 0 1	0	1
How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text? Hi, I have URIs like this: /appliance/detail/v3.0/vendor/3423434erts/fridge /appliance/detail/v3.0/vendor/6757dfs32... by xvxt006 Contributor in Splunk Search 01-04-2018 0 5	0	5
Combine Dynamic Fields Starting with same value So I have multiple fields whose field names could end with a different values. Examples of these fields are below: fo... by DanielWick New Member in Splunk Search 01-04-2018 0 1	0	1
How to split and retrieve a value ? I think we may need regex for this and I am not good at it. I need to be able to extract the last part i.e. (TMNT-17... by zacksoft Contributor in Splunk Search 01-04-2018 0 19	0	19
SPLUNK Search if word form file appears in logs Hi I have the following issue. I'm using SPLUNK for real-time monitoring of chat bot. I have as well file with bann... by swdowiarz Path Finder in Splunk Search 01-04-2018 0 9	0	9
AddColTotal value in a new column I use addcoltotal for one of my columns . But my result has a lot of rows, so I have to browse a lot of pages to find... by zacksoft Contributor in Splunk Search 01-04-2018 0 9	0	9
How to extract the fields for the Multiline- Each line has different Formats I'm having problem with a multi-line field extraction which I have been struggling to figure out. Below the log file... by rajeswariramar New Member in Splunk Search 01-04-2018 0 5	0	5
How to count the number of eventts starting at 9 am each day? Hi Guys, I have the below query using that is using the shared timepicker: today, which is counting the events from ... by auaave Communicator in Splunk Search 01-03-2018 0 5	0	5
Check values exist within two columns I tried to apply this logic as I want to check if the values from con_splunkUL exists within con_UL, but for me it se... by davidcraven02 Communicator in Splunk Search 01-03-2018 0 8	0	8
Splunk dashboard base search gives result which is different from that of an identical non-base search I am using Splunk Enterprise 6.6.2, and today I noticed an alarming problem. In order for me to troubleshoot the pro... by patng_nw Communicator in Splunk Search 01-03-2018 0 16	0	16
How to search comunication between a inputlookup with some ip's and traffic of an index ? Hi, I have a doubt about an inputlookup, i have a inputlookup with some ip's and i want to know how can see comunic... by Said7 Explorer in Splunk Search 01-03-2018 0 6	0	6
regex help I'm trying to configure a field extraction but am getting some strange incisions in the output. I'm running the below... by alanhowlett New Member in Splunk Search 01-03-2018 0 7	0	7
Basic math operation applied to stats Hi all, Student, new to Splunk and dbs. I need some help performing basic math operation against stats results. I... by JamesPineda New Member in Splunk Search 01-03-2018 0 2	0	2
Writing a regular expression to capture null values Hi, I've got fields which contain null values. I'm writing a regular expression to capture instances where fields co... by mahbs Path Finder in Splunk Search 01-03-2018 0 3	0	3
Number of events found not matching number of events displayed Our Splunk Enterprise deployment has started returning inconsistent results, and I've been unable to track the source... by elliotproebstel Champion in Splunk Search 01-03-2018 1 6	1	6