Splunk Search

Community Activity

How do I write a search with a subsearch? Hey everyone, Trying to write a search to find Firewall allows by Previous Drops I am very new to Splunk (love it s... by jb1982 Path Finder in Splunk Search 09-04-2017 0 5	0	5
Stats cannot generate alerts? I am trying to generate alerts. I have a search query as index=abc-index host="XYZ123*" collection="AppServer:OrderT... by dban2005 New Member in Splunk Search 09-04-2017 0 4	0	4
Extracting multiple fields from events I want to extract 2 separate fields from the below events : the event is : 2017-09-01T23:50:49.325-04:00 INFO m_gch... by bharpur183 Explorer in Splunk Search 09-04-2017 0 8	0	8
Replace First Two Digits Hi, I wonder whether someone may be able to help me please. I have a telephone number field "telnofac" with the fir... by IRHM73 Motivator in Splunk Search 09-03-2017 0 9	0	9
timechart command changing my column data HI Team, I am facing some weird thing. Upto table command, am getting whatever i want. After doing timechart values... by prathapkcsc Explorer in Splunk Search 09-03-2017 0 13	0	13
Are there any good tutorials for splunk search queries? Hi, I would like to know the link, or any document where from I can learn how to write search queries for different r... by subhadipc Explorer in Splunk Search 09-03-2017 1 8	1	8
Applying Field Extractions to Several Sourcetypes Hi, Per a policy I've inherited, we're separating our business groups' web server logs into separate sourcetypes. It ... by niall_munnelly Path Finder in Splunk Search 09-03-2017 1 8	1	8
How to add total percentage to rows and columns I have the following query : ... \| search service_name=$service$ \| dedup name, jenkins_data.JOB_NAME, jenkins_data.U... by vshakur Path Finder in Splunk Search 09-03-2017 0 13	0	13
Can appendcols be used for grouping? I have the following query index="XXXXXXXXXX" Device="FPB" OR Device="VAV" Point_Name="ActFlow" \|bin span=15m _... by tccooper Explorer in Splunk Search 09-02-2017 0 2	0	2
How to display date info from past weeks? My Query: \| tstats count where index=p___ AND error* by sourcetype,_time span=1d \| eval count=tostring(count,"commas... by senthamilselvan Engager in Splunk Search 09-02-2017 0 4	0	4
Searching a particular field and performing actions based on its presence and value My application logs will print each record with id. If the record has any error, it will display the Error field else... by kdulhan Explorer in Splunk Search 09-02-2017 1 9	1	9
Is it possible to create a multivalue field out of fieldnames with a specific pattern Hi, is it possible to create a multivalue field out of fieldnames with a specific pattern? Let's say we have sever... by HeinzWaescher Motivator in Splunk Search 09-02-2017 0 7	0	7
Incident Review Incidents Disappear when search completes This is an odd issue. After a restart of Splunk my incident review dashboard will show all of my incidents as long as... by miront Explorer in Splunk Search 09-02-2017 0 1	0	1
Cannot View data in Splunk Console Hi I am new to Splunk and we have to complete POC . We have two server : Server A ( Index Server where Splunk Enterp... by vivekg72 Explorer in Splunk Search 09-02-2017 0 6	0	6
How to generate a search to find license usage for a particular index for past 7 days sorted by host and source? How to generate a search to find license usage for a particular index for past 7 days sorted by host and source? Par... by lwaddep1 New Member in Splunk Search 09-02-2017 0 6	0	6
How to rank data based on field within event? and output whole event while displaying I've got data say in following format name,department,location,score jack,finance,houston,220 jill,finance,london,49... by koshyk Super Champion in Splunk Search 09-01-2017 0 7	0	7
Why am I unable to populate a token with the result of a search with my current Simple XML? Hello there guys, I'm trying to populate a token with the result of a search so I'm able to use this value at vario... by felipetavares Path Finder in Splunk Search 09-01-2017 1 6	1	6
How to search user search history by keyword Hi there, Is there any way to find out who are the users queried for a particular word in Splunk? For example, i wou... by kteng2024 Path Finder in Splunk Search 09-01-2017 0 4	0	4
How to extract the host name and database name Hi, I would like to extract the Host Name and Database Name from the below string. URL : jdbc:sqlserver://WBMSSQLOP... by dkannanjanakan New Member in Splunk Search 09-01-2017 0 1	0	1
How to send same data to multiple separate splunk instances- UF I have a splunk UF on a Linux server. (4.3.6) I want to send the local log files to 2 separate splunk instances, so ... by r999 Path Finder in Splunk Search 09-01-2017 3 4	3	4
rename everything not included in case() I have eval category=case(false(),'category',like('test',"test_11%"),"11tests",like('test',"test_22%"),"22tests",like... by zkenaga New Member in Splunk Search 09-01-2017 0 8	0	8
Is there a way to trim URL string from a table? So, I want to create a table where it shows the time, source IP, and URL. sourcetype=* src_ip=* url=* \| table _time,... by jrevolorio Explorer in Splunk Search 09-01-2017 0 3	0	3
I require rex which stops search on first match of word in string. I have below raw text. \"LDCAccountNumber\":\"4346780895\",\"BudgetBilling\":\"N\",\"TaxExempt\":\"N\",{\"field\":\"B... by shukan Explorer in Splunk Search 09-01-2017 0 1	0	1
How to merge multiple searches and combine the result in a tabular format Hi All, I have the below independent search queries giving the count. ns=app1 Service='trigger1' id=100 \| Search Re... by kdulhan Explorer in Splunk Search 09-01-2017 0 19	0	19
How does subsearch work? Is it possible to create a new search based off of results of previous search. My example below I use regex to extra... by AHEARNJ Explorer in Splunk Search 08-31-2017 0 4	0	4