Splunk Search

Community Activity

Filtering on multiple fields based on a stats subsearch I have multiple log sources that are appended on a daily basis. All rows in one refresh have same epoch time. I would... by saboobaker New Member in Splunk Search 10-31-2017 0 3	0	3
How to apply regex to a field in lookup file? I have a lookup file query as follows \| inputlookup ABCD.csv which displays the results as follows Host efgh ijkl... by pavanae Builder in Splunk Search 10-31-2017 0 1	0	1
Use subsearch result as filter I have 2 indexes. 1 index has the price with product code Another index has product code and product name the subsea... by kennethyeung New Member in Splunk Search 10-31-2017 0 7	0	7
OR not working properly Hi, I tried to run a report on multiple number from a specific field named "finalCalledPartyNumber" using the OR oper... by lcharpentier New Member in Splunk Search 10-31-2017 0 4	0	4
Why doesn't dbquery as a subsearch produce expected results? I'm having problems with getting a dbquery command to filter the results of a search. When I run this search : \| db... by NigelCooke Explorer in Splunk Search 10-31-2017 0 4	0	4
Count of values per column I have a table like this that is generated by a \| stats values(value1) values(value2) values(value3) values(value4) b... by tawollen Path Finder in Splunk Search 10-31-2017 0 2	0	2
Regex to extract between these two characters, : and " Hi, Can anyone help with a regex to extract the string seen after a : and up to a final ". so for example..... "ev... by jacqu3sy Path Finder in Splunk Search 10-31-2017 0 1	0	1
Real-time inner join I have data that looks like this: I would like to join it in such a way to make it look like this: This must work ... by eroffol Path Finder in Splunk Search 10-31-2017 0 3	0	3
I want to split a field into two different fields for comparison split at whitespace I want to split a field into two different fields for comparission, my data is in the format: address= 5555 xxxxx yyy... by jaleelahmed94 New Member in Splunk Search 10-31-2017 0 3	0	3
Splunk search slowness and crashes We have Splunk version 6.5.2 installed back in March 2017. We are observing a problem related to slowness listing ob... by rbathla New Member in Splunk Search 10-31-2017 0 3	0	3
Is there a way to determine what are my most expensive field extractions? All, How can I determine which search time field extractions are my most costly? by daniel333 Builder in Splunk Search 10-31-2017 1 1	1	1
急に全てのサーチが遅くなりました 6.5.2を使っていますが、昨日まで速く実行できたサーチでも、今日になって急に遅くなりました。事象の特定としては、 1. サーチは、どのユーザから実行しても遅くなっている。 2. ブラウザのキャッシュを削除してからでも、サーチは遅い... by cwl Contributor in Splunk Search 10-31-2017 0 1	0	1
What's the best way to compare data in two different environments with outputlookup? Hallo splunk users, What is the best way to compare the same data in two different environments (producktion and la... by AydinCan Loves-to-Learn Lots in Splunk Search 10-31-2017 0 4	0	4
how to migrate my saved searches/dashboard/apps from non-cluster to a cluster? I have single Splunk instance and would like to migrate to a new search head cluster and the index cluster. I have... by danielwan Explorer in Splunk Search 10-31-2017 0 1	0	1
Splitting single lookup table column/field to filter on multiple fields We have JSON logs being stored in Splunk. A sample log record looks like : { data: { "hostname":... by technie101 Explorer in Splunk Search 10-31-2017 0 6	0	6
How to use append and join in same search Hi , I need to use both append and join in same commmand .Please help me to change the below sql to splunk search ... by umsundar2015 Path Finder in Splunk Search 10-31-2017 0 9	0	9
Passing dynamic value from stats to the remaining part of search I want to pass latest_date for null value so that inprogress count sits there as there is no completion date for inpr... by k_harini Communicator in Splunk Search 10-30-2017 0 5	0	5
xmlkv usage I have a log file entry that looks like this (this is the VERBATIM entry from the access log): 2012-08-06 13:25:02,1... by asarolkar Builder in Splunk Search 10-30-2017 0 2	0	2
Alternative to Joins I have 2 indexes say (A1 and A2) I have Fields a,b,c,d in index A1, In the index A2 I have fields b,e,f,g . I need t... by vikasreddy Explorer in Splunk Search 10-30-2017 0 5	0	5
How to improve automatic sourcetype extraction I'm building a Splunk App and I'd like my users to be able to point the import a single folder and have it accurately... by JacobCarrell Explorer in Splunk Search 10-30-2017 0 1	0	1
Field transformation on source not working Hi There, There is no content in dummy field although the regex works fine. Please could you help me with this? Ty... by archananaveen Explorer in Splunk Search 10-30-2017 0 8	0	8
Extract fields or define eventypes -- Which is better for large logs? Hi There, I have huge logs and there is not a definite pattern in the logs. Should I sit down to add each and ever... by archananaveen Explorer in Splunk Search 10-30-2017 0 7	0	7
Compare field from 2 sources and return when source1 has no match in source2 I am attempting to take IPs from 2 different sources and output a list for when Source1 has a unique IP that is not p... by axinjakson Explorer in Splunk Search 10-30-2017 1 6	1	6
How to get city or county names using latitude and longitude values in Splunk? Hi I have a CSV file with the list of latitudes and longitudes to display on the map. I want to get the count of even... by sravani27 Path Finder in Splunk Search 10-30-2017 0 5	0	5
Case with multiple matches Hello all, I am trying this search but it's not working. Only the first match count is returned. index=abc* sou... by maniishpawar Path Finder in Splunk Search 10-30-2017 0 2	0	2