Splunk Search

Community Activity

Convert #B/KB/MB/GB into bytes without a unit? Hey everyone. Searching around, I see tons of answers related to converting numerical bytes into KB/MB/GB/TB. However... by msarro Builder in Splunk Search 10-19-2017 0 5	0	5
How can I see the Data in a Metrics Index in Splunk 7? Hi everyone, I'm looking forward to do some Data Science with Splunk and was very happy to read about the Metrics In... by bojanisch Path Finder in Splunk Search 10-19-2017 0 1	0	1
Dispatch folder is only 284KB but I still encounter minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch I wanted to reduce my storage space. I have already set retirement policy but my used space did not reduce although t... by wuming79 Path Finder in Splunk Search 10-19-2017 0 1	0	1
hot_v* file not found but able to see file using locate Hi, Referencing to http://docs.splunk.com/Documentation/Splunk/6.2.1/Capacity/Estimateyourstoragerequirements, I'm ... by wuming79 Path Finder in Splunk Search 10-19-2017 0 1	0	1
How do I exclude fields with certain values from a table when the event has multiple values for the same fields? Hi, As the title says. Refer to the screenshot below too; The above is the log for the event. as you can see, ther... by ZacEsa Communicator in Splunk Search 10-18-2017 0 3	0	3
Field extraction of log file -- Each line has different format, how can I include all format in one regex? I am doing field extraction for a log file format as below: line 1: field1, field2, field3, field4 line 2: field1, fi... by samlinsongguo Communicator in Splunk Search 10-18-2017 0 3	0	3
How can I compare data between two dates? I have index data like below, and I want to calculate how many have a stock price higher than yesterday. date, stock,... by kennethyeung New Member in Splunk Search 10-18-2017 0 6	0	6
How to extract a repeating field from an event I have data that looks like this: AA=value1,BB=value2,BB=value3,BB=value4 AA=value5,BB=value6,BB=value7 AA=value8,BB... by stephenlclarke New Member in Splunk Search 10-18-2017 0 6	0	6
ITSI \| itsi_service_id to service name mapping? I want to query the summary index and pull back KPIs with high alert severity. However, in order to do this I have to... by cspires64 Path Finder in Splunk Search 10-18-2017 1 1	1	1
How to extract a file name up to a specific character I have a list of files similar to this list: FileObjMgr_01235_567.log EIM_0080123_45.log EIM_01031234_56.log EIM_012... by sheloaha Path Finder in Splunk Search 10-18-2017 0 6	0	6
How to subtract 2 row sum total value How to get the Total difference amount from DP - RF Search used: index=elm-*** \| dedup transactionid \| eval amount=... by yograjpatel New Member in Splunk Search 10-18-2017 0 2	0	2
Splunk ingest SNMP traps Hi As per the documentation given in Splunk "http://docs.splunk.com/Documentation/Splunk/latest/Data/SendSNMPeventsto... by ankithreddy777 Contributor in Splunk Search 10-18-2017 0 1	0	1
Is there any way to compare multivalue fields to single value fields? Hello Splunk Community, I've tried to do my homework on the subject and I'm coming up short, so here I am. I'm a few... by jamesmoriarty Explorer in Splunk Search 10-18-2017 0 5	0	5
How to see if field values from index 1 shows up in index 2? Do I need to do some fancy joined search here? I have values that will show in index 2, and I want to check index ... by agoktas Communicator in Splunk Search 10-18-2017 0 3	0	3
Search Alias Hi I'm new on Splunk It's possible to give an alias to a search? I'm trying to do something like this: index=Obs1 A... by gmg1956 New Member in Splunk Search 10-18-2017 0 3	0	3
how to calculate endtransactiontime - starttransactiontime when starttransactiontime is in one event and endtransactiontime is in another event Hi !! I want to calculate TransactionEndTime-TransactionStartTime, where TransactionStartTime is in CaptureLocation=R... by smilingajay New Member in Splunk Search 10-18-2017 0 1	0	1
What is the best way to determine if a UFW is running without CLI access? Hi, I'm looking for options to validate that a UFW is running on servers, without actually logging into the server (... by a212830 Champion in Splunk Search 10-18-2017 0 3	0	3
Inconsequent field extraction behavior: works when eval'ed but not when used directly? I have defined a field extraction that seems to properly extract fields: EXTRACT-KVSAxis = KV(?:Blade)*(?<KVSAxis>[X... by jmartens Path Finder in Splunk Search 10-18-2017 0 9	0	9
Is there a function that concatenates result lines of strings? Hi everyone! I would like to format a result into a string and I don't even know where to start and if there even is... by koljalauterbach New Member in Splunk Search 10-18-2017 0 2	0	2
inputlookup error "line endings" I’m trying to troubleshoot my use of “inputlookup”. First I verify the following search works: index=ca cert_RN=”R... by mikefoti Communicator in Splunk Search 10-18-2017 0 6	0	6
How to update a chart drilldown with a token that updates dynamically? Hi I am updating a chart drilldown with a token, from "undefined" to "all" to "undefined". <option name="chartin... by robertlynch2020 Influencer in Splunk Search 10-18-2017 0 8	0	8
Why are my access_logs inconsistent? My access_logs files are not being pulled constantly. There are large gaps between the pulling of logs. The logs ar... by zadenaji Explorer in Splunk Search 10-18-2017 0 5	0	5
Is it possible to search for certain events within raw data? Would it be possible to search for certain events within the raw data? For example, I need to find events with C:\Win... by ecanmaster Explorer in Splunk Search 10-18-2017 0 6	0	6
How to sort source based on its earliest event indexing? I am in the log sources provisioning phase. I examine the "data summary" frequently to see the change in number of ... by devd25 Explorer in Splunk Search 10-17-2017 0 3	0	3
How does the Splunk internal search functionality work? Hello, Splunkers. I have been looking for information about how work internally the splunk searchs. Are they be tran... by nsanchezfernand Path Finder in Splunk Search 10-17-2017 0 8	0	8