Splunk Search

Community Activity

How to extract user behavior pattern during peak load from web access log From NFR perspective trying to figure out how to use Splunk to extract user behavior pattern during peak load conditi... by GaneshK New Member in Splunk Search 11-13-2017 0 2	0	2
How to make list(x) include all values? list(x) does not return all values. If I have white space as my value, list omits it. Here is a simplified example of... by jpayne1 New Member in Splunk Search 11-13-2017 0 2	0	2
Splunk Light Email Anonymization before Indexing Hello everybody, I am new to Splunk and I try to anonymize an email adress of my Logfile with the help of files pro... by mseidel New Member in Splunk Search 11-13-2017 0 2	0	2
We are getting error when we search with windows index , this is happening from past month Below is the error we got [hsplunkp01] Dispatch Runner: Configuration initialization for /opt/splunk/var/run/search... by Kaushikkatta03 Explorer in Splunk Search 11-13-2017 0 1	0	1
Session duration calculation Hi, I have this data Time Event 11/13/17 5:12:53.000 PM { [-] analyticType: SessionEnd bui... by dbcase Motivator in Splunk Search 11-13-2017 0 3	0	3
How to extract a dynamic String that is comma delimited (it comes directly after a constant)? The Splunk logs I'm working with are big and don't come with any predefined useful fields. I want to extract a dynami... by lordhans Explorer in Splunk Search 11-13-2017 0 2	0	2
How do we convert rex into makemv? The following \| rex "^(?:[^,\n]*,){8}\"\w+\":\"/(?P<apiURL3>\w+/\w+/\w+/\w+\.\d+/\w+\.\w+)" produces for us the desir... by ddrillic Ultra Champion in Splunk Search 11-13-2017 0 9	0	9
What is the right way to join fields from different rows into one? Within the same index and sourcetype, I have some rows containing type=master and many more rows containing type=slav... by shikhanshu Path Finder in Splunk Search 11-13-2017 0 1	0	1
How can I extract this email address field and name it "email_id"? What would be the correct expression to extract only the email address that follows "email="? I then want to call tha... by cyberhumint New Member in Splunk Search 11-13-2017 0 9	0	9
Why is my Base Search cutting off Fields in the Dashboard view? I made a dashboard with a single base search passing the results to downstream panels. When I make my panels dependen... by skoelpin SplunkTrust in Splunk Search 11-13-2017 1 8	1	8
How can I skip the first two "\n" letters from my fields? Hello Everyone! I want to remove the first two letters from my fields "\n" how can I do it? \nCDIARIA2 \nCDIARIAC \... by danielgp89 Path Finder in Splunk Search 11-13-2017 0 11	0	11
Regex for extracting email with a trailing whitespace Hi, I have log line according to the next template: [2017-11-03 13:55:52,945] [MYPROJ] [EMAIL=xxx@yyy.com] But I wa... by nmayafit Path Finder in Splunk Search 11-13-2017 0 4	0	4
Finding whether firewall hosts sending logs to splunk ? Hi , I have a list of firewall hosts names and some ips of firewall and i created the lookup of all host names of fir... by splunker969 Communicator in Splunk Search 11-13-2017 1 5	1	5
Is it possible find total of transactions in a lookup table I have a lookup table with personal financial transactions on it. They list like they do when you review transactions... by bcyates Communicator in Splunk Search 11-13-2017 0 3	0	3
Getting error in splunk cloud while running every search in the splunk cloud Error : " Error 'Could not find all of the specified lookup fields in the lookup table.' for conf '(?::){0}XmlWinEve... by samsingnok52 Engager in Splunk Search 11-13-2017 0 1	0	1
Using MVZip and MVExpand on MultiValue fields where one node sometimes exists Hello friendly Splunk community, May I ask your assistance in dealing with a multivalue field that sometimes contain... by blairmd New Member in Splunk Search 11-13-2017 0 4	0	4
How do I create a piechart visualization with the count of two field values and the sum of both displayed? I have a query that gives me the count of certain events with keyword 'ab' OR with keyword 'pq'. The query is like th... by zacksoft Contributor in Splunk Search 11-13-2017 0 7	0	7
How can I get the count of two different field values in the same search? My splunk query is , host=x OR host=y OR host=z nfs1 \| stats count as nfs1_count In the above case nfs1 field is s... by zacksoft Contributor in Splunk Search 11-13-2017 0 34	0	34
counting combination of fields Hi, How would I count a combination of fields in splunk? For example, I have a "from_ip_addr" and a "to_ip_addr" in ... by a212830 Champion in Splunk Search 11-12-2017 0 6	0	6
How to get percentages of value pairs I have a very large set of retail data. The significant fields for this query are store_no, transaction_amt, zip, eth... by behudelson Path Finder in Splunk Search 11-12-2017 0 3	0	3
Difference calculation different time in different column Hi I want to calculate/simulate a data to analysis price difference, my data set in picture, Process like this ... by abdulvehhaba Path Finder in Splunk Search 11-12-2017 0 5	0	5
Top 10 values for each field value Hi, I have a data that contains the field 'regression_target'. I want to get the top 10 rows by 'regression_tests' f... by matansocher Contributor in Splunk Search 11-12-2017 0 3	0	3
Nested Splunk Query - Time of event within consolidate events Hello All, Sorry relativly new to splunk - and so this query may be a pile of garbage! To sumerise, i have a query ... by JgTheGreat Engager in Splunk Search 11-12-2017 0 3	0	3
Maximum output of fieldsummary (or table *) Hi All, I have a large data set with lots of fields and I want that in a table. However this is not working correctl... by FrankSPL Path Finder in Splunk Search 11-12-2017 0 3	0	3
Usernames Failed to Login against an IP Address \| which other IP Addresses has that Username Failed to login against? Hello, I'm looking for a query, which looks for successful [ or unsuccessful ] brute force attempts, and then to ta... by JgTheGreat Engager in Splunk Search 11-11-2017 0 3	0	3