Splunk Search

Community Activity

How can I extract fields as an array? Dear friends, I have one event in my log file that my user want to extract fields as an array. The event is: Reques... by GersonGarcia Path Finder in Splunk Search 10-03-2017 0 1	0	1
Historic average of last 30 days I have a type of event that happens about 20 times a day. Each event carry a numeric value. Meaning is found in the s... by JeusTheHun New Member in Splunk Search 10-03-2017 0 8	0	8
Need help on predict command usage in graph I have a trend graph that shows some data then its predicting out that data a couple days forward. However, The predi... by kdimaria Communicator in Splunk Search 10-03-2017 0 4	0	4
Comparing results from three separate events Forgive my ignorance if this has been answered elsewhere, I did my best to search for an answer but have not found it... by venomousmoose Engager in Splunk Search 10-03-2017 0 3	0	3
How do I get the outer values in a transaction that has repeated startswith endswith parameters? Hi there, I've been trying to solve an issue I have when using transactions. Here's an example of the logs I am work... by nmulm Explorer in Splunk Search 10-03-2017 0 2	0	2
comparing min, max and avg of a field by host and application Hi All, I have been working on a search query but couldn't able to get desired results. I'm looking for a search ... by guru865 Path Finder in Splunk Search 10-03-2017 0 11	0	11
Can we use same property names (say "[setnull]","[setparsing]") defining the event data filtering criteria , in two different apps (having different filtering criteria) residing on same server ? I have two clustered environments consisting of 3 SH,3 Indexers and 1 HWF each running on Splunk 6.4.1.I need to filt... by jincy_18 Path Finder in Splunk Search 10-03-2017 0 2	0	2
How to collect performance statistics about search-time field extractions? I'm trying to collect performance information about search-time field extractions happening on different search-peers... by lfrit New Member in Splunk Search 10-03-2017 0 6	0	6
Splunk CLI remote search parse _raw into fields I am using a locally installed Splunk instance to perform a remote search using the CLI. splunk search "index=sandbo... by harishbajaj Engager in Splunk Search 10-02-2017 0 2	0	2
How to get a calculated column in a table Hi Splunk Experts, I need to create a report to display the table record count difference between two databases dur... by romoc Explorer in Splunk Search 10-02-2017 0 10	0	10
how to transpose 2 column ......\|\|addcoltotals \| table * \| reverse \| head 1 1_Ausgust_R, 2_Ausgust_R ,1_Ausgust_L,2_Ausgust_L 26 ... by kennethyeung New Member in Splunk Search 10-02-2017 0 3	0	3
How to combine multiple separate fields into one for graphing purposes 2017-09-12 12:31:11.817 INFO [RunMaster] stats: jif: 1, fif: 9, fim: 192, f2c: 183 paper: pc: 9129, uwr: ... by hapalmiter New Member in Splunk Search 10-02-2017 0 5	0	5
Drilldown: Use starttime of bar in timechart as `earliest` field in subsequent search After spending hours unsuccessfully searching the splunk answers for a solution I would like to phrase my question: ... by viggor Path Finder in Splunk Search 10-02-2017 0 3	0	3
JOIN should return multiple rows. How make final results show that data? My driver file has one row per key. The subsearch file can contain multiple rows for each key. I need my result set r... by pgifford New Member in Splunk Search 10-02-2017 0 5	0	5
How to compute the value of 2 different complex queries Ok, so I want to see the ratio between "interview.completed" and "interview.started", but filtering each event by uni... by renataque New Member in Splunk Search 10-02-2017 0 3	0	3
Can I filter a table based on cluster number or subsearch dynamically? I have a table of data that is clustered via KMeans, I am trying to filter down to only display the other items in a ... by oclumbertruck Explorer in Splunk Search 10-02-2017 0 3	0	3
Return information when there are no expected results. This search checks to make sure a certain process ended on time. I expect to have results for the 6 cases in the wher... by griffinpair Path Finder in Splunk Search 10-02-2017 0 5	0	5
Help with forming a table with sourcename next to the first column for each row? Hi, I'm searching multiple sources in a single index and getting the results as a table. I want to display the sourc... by charanramireddy New Member in Splunk Search 10-02-2017 0 8	0	8
Need help with regex in props.conf Hi all, Here is how my raw logs look. I need help with props.conf so that I can index by the second time field inst... by dmenon84 Path Finder in Splunk Search 10-02-2017 0 5	0	5
SSL error on non-SSL forwarder connection We're trying to add a new Forwarder (6.6.1) to our indexer (non-SSL connection), we're able to connect to the forward... by mmoermans Path Finder in Splunk Search 10-02-2017 1 1	1	1
Not extracting all Full GC events Could not be able to pull all the Full GC events. Is there any tweak requires in the regex? \| makeresults \| eval _r... by nagaraju_chitta Path Finder in Splunk Search 10-02-2017 1 14	1	14
Help with stats table output I have a dataset that can be represented as below: Region=A State=1 City=a Product=Apple Region=A State=1 City=b Pro... by adlireza Path Finder in Splunk Search 10-02-2017 0 2	0	2
How do I set conditions for calculating the duration of an event such that the end time is based on the way a user ends their session? Hi all, I am trying to extract usage duration patterns for our web app, from login to either logout, or when the use... by gertverhoog Explorer in Splunk Search 10-01-2017 0 7	0	7
How to rex out and substitute it with * I would like to substitute below kind of email address with * Original :- john.trava@gmail.com Expected:- Jo.*va... by m7787580 Explorer in Splunk Search 10-01-2017 0 10	0	10
Extract values from JSON array Hi everyone! I have a JSON output in raw format: {"result":{"addr":"456hR5drYrYrdY5wTYreYrdyerYe6y","workers":[["hos... by DimkoBilanko Explorer in Splunk Search 10-01-2017 0 1	0	1