Splunk Search

Community Activity

Limit on size of event/data passed to 'collect' command? We have a number of scheduled searches that run every few minutes to search for events recently indexed that match ce... by elliotproebstel Champion in Splunk Search 12-01-2017 1 9	1	9
How to calculate the average of a field value for n number of days? I have the below query index=abc sourcetype=xy.. \|timechart span=1d count as events by host \| addtotals time ... by vrmandadi Builder in Splunk Search 12-01-2017 0 21	0	21
Search with several joins taking too long I am trying to create a dashboard of CPU and Memory usage from some log files. Because of the way the data is inputte... by minura Engager in Splunk Search 12-01-2017 0 7	0	7
Can you help fix the output of appencols and stats list in this search? Hi, I'm trying to list data per field. I've used stats list which works partially, it lists all the data for both fi... by mahbs Path Finder in Splunk Search 12-01-2017 0 11	0	11
Help to modify existing regex to mask senstive PII? Hi Splunkers, I am looking for some help in modifying current regex to meet our updated project criteria. Link: htt... by smakwana Explorer in Splunk Search 12-01-2017 1 5	1	5
Help in creating regex for encryption/masking of data at index time? Hi Splunkers, I am looking for some help in creation of regular expression to Anonymize data with a regular expressi... by dreschke Explorer in Splunk Search 11-30-2017 0 5	0	5
Chart Top Seller Between Three Regions Per Year Hello I'm new to Splunk and I'm stuck trying to create what should be a simple table. Basically, I have a database o... by rfernandez2010 New Member in Splunk Search 11-30-2017 0 1	0	1
Restrict access so users can only view specific lookups Hello, I have a new set of users who I want to only be able to access 2 specific lookups. However, those lookups nee... by katzr Path Finder in Splunk Search 11-30-2017 0 6	0	6
Trying to slip SNMP data on index or through rex All, I have the following Data: (192 of these) and trying to split the data into a multi-lined event, to extract th... by srobinsonxtl Path Finder in Splunk Search 11-30-2017 0 9	0	9
Can I loop through all my fields* using the foreach command, or in some way reduce the number of eval case statements in my search? Hello Splunk experts, I'm trying to figure out a better way to handle the large number of case statements that I wou... by splunker1981 Path Finder in Splunk Search 11-30-2017 0 1	0	1
How to retrieve the values of the existing column based on eval result dynamically? i have a data like below.... ID \| Name \| 2017-12 \|2018-01\|2018-02\|2018-03 X123 \|aaa \| 90 \| ... by 9738078959 Engager in Splunk Search 11-30-2017 0 9	0	9
Are counts form the cofilter command "symmetric"? Hi all, As I understand it, the cofilter command counts how many times pairs of items occur. If the same user views... by JacobPN Path Finder in Splunk Search 11-30-2017 0 1	0	1
show/where the result from count when result is odd or even number Is it possible to search results from a count when they are odd or even? So the results only show the lines/events wh... by Mike6960 Path Finder in Splunk Search 11-30-2017 0 6	0	6
Query to check if log has not been updated in last 24 hours We have a requirement wherein we want to check if logs have not been updated in last 24 hours. There are around 20 in... by AnmolKohli Explorer in Splunk Search 11-30-2017 0 1	0	1
Doing calculations using eval command with fields generated by timechart command. Hi, I'm doing some search query where I used timechart command that creates fields. Now, what I want to do is to som... by jvmerilla Path Finder in Splunk Search 11-30-2017 0 3	0	3
regex問題のトラブルシューティング方法について以下のサーチ文で、regexreplacementプロセッサーがかなりのCPUリソースを使用していることまではわかりましたが、どのように問題のREGEXを特定できますでしょうか。 index=_internal source=*me... by cwl Contributor in Splunk Search 11-30-2017 0 1	0	1
Purging lookup table of old entries Hi All, I have a lookup table where I am maintaining States of a field. It's rather a chatty table and grows to a la... by saurabhkunte Path Finder in Splunk Search 11-29-2017 0 1	0	1
Untable data form a search used to compute an average duration from events with 2 dates I have the following SPL that is used to compute an average duration from events with 2 dates for the last 3 months. ... by timcolpo Explorer in Splunk Search 11-29-2017 0 4	0	4
what is the use of substr in my macro? I have defined a field extraction in a macro as below my_search \| eval field_A="EventCode: " + EventCode + "; Event... by pavanae Builder in Splunk Search 11-29-2017 0 2	0	2
combine different fileds from different events Hello, I'm trying to combine values from two events and to make a table with them. Let me explain you. I have the sa... by mvagionakis Path Finder in Splunk Search 11-29-2017 0 9	0	9
How to capture URL information Hello All, I want to create a report for top 10 URL's visited by the users. However, when I see the events in Palo... by bagarwal Path Finder in Splunk Search 11-29-2017 0 7	0	7
How to identify if a transaction is stalled All, I have this search: index=main sourcetype=app \| transaction jobId jobExecId startswith="Starting IgniteUpdater... by GersonGarcia Path Finder in Splunk Search 11-29-2017 0 4	0	4
Distinct count of machine names for the last 7 days I want to count distinct machine names only once for each day for the last 7 days. The machine name is signified in t... by davidcraven02 Communicator in Splunk Search 11-29-2017 0 6	0	6
How do you compare the hostname in security logs to computers in active directory (AD)? I would like to create a query (and later a real time alert) that shows when a hostname/workstation in the log files ... by heathramos Path Finder in Splunk Search 11-29-2017 0 2	0	2
How to efficiently search for a specific message in my data without aggregating millions of useless logs? I'm running a search on the same index and sourcetype with a few different messages, but one particular message has s... by SplunkIsLife Explorer in Splunk Search 11-29-2017 0 4	0	4