Splunk Search

Community Activity

ITSI \| itsi_service_id to service name mapping? I want to query the summary index and pull back KPIs with high alert severity. However, in order to do this I have to... by cspires64 Path Finder in Splunk Search 10-18-2017 1 1	1	1
How to extract a file name up to a specific character I have a list of files similar to this list: FileObjMgr_01235_567.log EIM_0080123_45.log EIM_01031234_56.log EIM_012... by sheloaha Path Finder in Splunk Search 10-18-2017 0 6	0	6
How to subtract 2 row sum total value How to get the Total difference amount from DP - RF Search used: index=elm-*** \| dedup transactionid \| eval amount=... by yograjpatel New Member in Splunk Search 10-18-2017 0 2	0	2
Splunk ingest SNMP traps Hi As per the documentation given in Splunk "http://docs.splunk.com/Documentation/Splunk/latest/Data/SendSNMPeventsto... by ankithreddy777 Contributor in Splunk Search 10-18-2017 0 1	0	1
Is there any way to compare multivalue fields to single value fields? Hello Splunk Community, I've tried to do my homework on the subject and I'm coming up short, so here I am. I'm a few... by jamesmoriarty Explorer in Splunk Search 10-18-2017 0 5	0	5
How to see if field values from index 1 shows up in index 2? Do I need to do some fancy joined search here? I have values that will show in index 2, and I want to check index ... by agoktas Communicator in Splunk Search 10-18-2017 0 3	0	3
Search Alias Hi I'm new on Splunk It's possible to give an alias to a search? I'm trying to do something like this: index=Obs1 A... by gmg1956 New Member in Splunk Search 10-18-2017 0 3	0	3
how to calculate endtransactiontime - starttransactiontime when starttransactiontime is in one event and endtransactiontime is in another event Hi !! I want to calculate TransactionEndTime-TransactionStartTime, where TransactionStartTime is in CaptureLocation=R... by smilingajay New Member in Splunk Search 10-18-2017 0 1	0	1
What is the best way to determine if a UFW is running without CLI access? Hi, I'm looking for options to validate that a UFW is running on servers, without actually logging into the server (... by a212830 Champion in Splunk Search 10-18-2017 0 3	0	3
Inconsequent field extraction behavior: works when eval'ed but not when used directly? I have defined a field extraction that seems to properly extract fields: EXTRACT-KVSAxis = KV(?:Blade)*(?<KVSAxis>[X... by jmartens Path Finder in Splunk Search 10-18-2017 0 9	0	9
Is there a function that concatenates result lines of strings? Hi everyone! I would like to format a result into a string and I don't even know where to start and if there even is... by koljalauterbach New Member in Splunk Search 10-18-2017 0 2	0	2
inputlookup error "line endings" I’m trying to troubleshoot my use of “inputlookup”. First I verify the following search works: index=ca cert_RN=”R... by mikefoti Communicator in Splunk Search 10-18-2017 0 6	0	6
How to update a chart drilldown with a token that updates dynamically? Hi I am updating a chart drilldown with a token, from "undefined" to "all" to "undefined". <option name="chartin... by robertlynch2020 Influencer in Splunk Search 10-18-2017 0 8	0	8
Why are my access_logs inconsistent? My access_logs files are not being pulled constantly. There are large gaps between the pulling of logs. The logs ar... by zadenaji Explorer in Splunk Search 10-18-2017 0 5	0	5
Is it possible to search for certain events within raw data? Would it be possible to search for certain events within the raw data? For example, I need to find events with C:\Win... by ecanmaster Explorer in Splunk Search 10-18-2017 0 6	0	6
How to sort source based on its earliest event indexing? I am in the log sources provisioning phase. I examine the "data summary" frequently to see the change in number of ... by devd25 Explorer in Splunk Search 10-17-2017 0 3	0	3
How does the Splunk internal search functionality work? Hello, Splunkers. I have been looking for information about how work internally the splunk searchs. Are they be tran... by nsanchezfernand Path Finder in Splunk Search 10-17-2017 0 8	0	8
How to write a search to find users that are actually connected with VPN from Cisco logs? Hi, I am creating a search to find the users that are actually connected with VPN. In the Cisco logs, I can only see... by fahrenheit New Member in Splunk Search 10-17-2017 0 8	0	8
How to adjust the time zone for an logs coming into splunk ? Hi All, Currently we are facing an issue time stamp for a firewall logs. We could see the logs are coming into splunk... by Hemnaath Motivator in Splunk Search 10-17-2017 0 26	0	26
Re-indexing multiple files using btprobe So we have lots of files -- one is created every day. We want to re-index this data. We have removed the data from th... by tc641 New Member in Splunk Search 10-17-2017 0 1	0	1
Help me with search for my use case I need to setup a alert if my count is zero on that day. my query is index= abc \| timechart span=1d count and I am ... by sravankaripe Communicator in Splunk Search 10-17-2017 0 2	0	2
Regex question Hi! if I can make groups from <VULN number ... to ... </VULN> with regex? <VULN number="MP-412750" severity="5... by sphc Explorer in Splunk Search 10-17-2017 0 7	0	7
The percentage of Read / Write utilization to get to 800 IOPS? I am trying to figure out the drive configuration to meet the recommended 800 IOPS noted in the Splunk documentation ... by maverick Splunk Employee in Splunk Search 10-17-2017 4 5	4	5
Only show logs where field value has a decimal place Hi all, I'm trying to run a search that only finds specific events in a log which have field X equal to a number wit... by bcarr12 Path Finder in Splunk Search 10-17-2017 0 2	0	2
Using lookup tables to create separate alerts for prod and nonprod hosts Hello Splunk community, My team is tasked with creating alerts for standard server monitoring metrics (CPU, memory, ... by danbutterman Explorer in Splunk Search 10-17-2017 0 2	0	2