Splunk Search

Community Activity

Assistance with search query on generator power Hello Splunk World, Back at it today trying to chart out some power data off of generators. I have 2 queries that nee... by dhardingatn New Member in Splunk Search 08-25-2017 0 2	0	2
stats min(count) not 0 if value never occurs If I have the following query foo \| timechart span=60s count \| stats min(count) as minCntFoo but foo never occu... by viggor Path Finder in Splunk Search 08-25-2017 0 1	0	1
How do I do a stats count for 2 diffrent interesting fields? am in a situation, I have 2 Interesting Fields Field1 has A,B values and Field2 has again A,B values I just want to g... by svemurilv Path Finder in Splunk Search 08-25-2017 0 2	0	2
How do I place two time values from two seperate logs as distinct variables per field name that they share? Let's say I have a search query that pulls up multiple logs and there are two logs for each JOBNAME. one that contain... by Toshbar Explorer in Splunk Search 08-25-2017 0 1	0	1
Regex to match string followed by varying formats (multi-line event) I am working with data from a database which produces information on transactions. The problem is that transactions ... by alexandermunce Communicator in Splunk Search 08-25-2017 0 2	0	2
Splunk search help: formatting a field Can somebody help me with a Splunk query to format the below MESSAGE field value MESSAGE=ABC-STATUS-COUNT={\"false\... by premvenud New Member in Splunk Search 08-24-2017 0 1	0	1
Are the job id and search id the same thing? What are the differences? please expalin clearly, as per my understanding both are different. if both are same then expalin. by Palrav12 New Member in Splunk Search 08-24-2017 0 2	0	2
How to index geolocation data from MaxMind? I am new to Splunk and I have been asked to bring IP info in for geolocation from MAXMIND. How is this accomplished? ... by pfabrizi Path Finder in Splunk Search 08-24-2017 0 1	0	1
How can I get the job id from Splunk? I need job id from Splunk. How to get the job id from Splunk? I execute the curl command but I didn't get the Job id ... by Palrav12 New Member in Splunk Search 08-24-2017 0 2	0	2
How to include a duration that started out of time range of the search into stats/timechart command? I have a dataset like below: Ticket#\| StartDate \| EndDate In my search, I am more into EndDate of the tickets as \|e... by akocak Contributor in Splunk Search 08-24-2017 0 2	0	2
Get a time range from subsearch to adjust main search time range Hi I captured an event, I want to do a search which the time range is based on the previous captured event time. For... by samlinsongguo Communicator in Splunk Search 08-24-2017 0 1	0	1
Merge Data from two indexes without using Join Hello, I know there are many answers on this topic, but I can't seem to find any answer that is working for me. I ha... by katzr Path Finder in Splunk Search 08-24-2017 0 3	0	3
Duplicate values causing conflict Hi Splunkers, below form (dynamic dropdown) creates "Duplicate values causing conflict" Any ideas? <form> <label... by splunk_UCL Explorer in Splunk Search 08-24-2017 0 3	0	3
Calculate time difference between events for distinct users in transaction log Hi We are hitting a wall here... we would like to show events where a user does more than x actions within a small ... by hgehrts_splunk Splunk Employee in Splunk Search 08-24-2017 0 2	0	2
How can I set a 5-minute +/- range for a list of timestamps without doing each search manually? Hi Guys I have a list of timestamp that some events happened, I want to search in each time is there any related eve... by samlinsongguo Communicator in Splunk Search 08-23-2017 0 2	0	2
What is a splunk search in "zombie" state? What does this mean? Sometimes when I review splunk logs or job inspector I see that I have searches in zombie state. What does this mean... by jrodman Splunk Employee in Splunk Search 08-23-2017 2 9	2	9
How can I combine 2 search strings onto 1 dashboard? I have 2 search strings that I am trying to combine to put on one dashboard. sourcetype=snmp_ta host=* \| eval fuel=c... by dhardingatn New Member in Splunk Search 08-23-2017 0 4	0	4
Can I use Eval to correlate two serial logs that have specific fields? Not sure if that titled made sense but hopefully I can explain it better here: I am receiving sFTP logs from a host ... by Jamaal Engager in Splunk Search 08-23-2017 0 4	0	4
Joining two sets of data by common field (numeric userID) We have two data sets in the same index returned by an AppMon tool that we are looking to stitch together in Splunk a... by blloyd67 Engager in Splunk Search 08-23-2017 0 2	0	2
How to write a search to exclude the top 10 or 15 error messages, but return the following top 10? Currently, about 80 to 90 percent of errors logged within a specific index I'm monitoring is made up of the top 10 to... by steeldol Explorer in Splunk Search 08-23-2017 0 6	0	6
Graph out an fields daily activity in relation to average usage and stdev I've been stuck on this for quite some time and I'm hoping someone here can help me. I'm re-purposing a stdev query ... by rwiltzius Explorer in Splunk Search 08-23-2017 0 3	0	3
How to write a field aliases using the EVAL command for a firewall device. Hi All, I need to write a field aliases using EVAL command for the below mentioned fields. Field Name : Val... by Hemnaath Motivator in Splunk Search 08-23-2017 0 4	0	4
Can you search for two strings in chronological order (in different log statements)? In every log statement, we write the user's session ID delimited by hyphens as follows: -S:ybiSmNiQxF- I want to... by jbrenner Path Finder in Splunk Search 08-23-2017 0 3	0	3
Unable to blacklist multiple patterns using "\|" in inputs.conf ? I have used the below configuration as part of my inputs.conf but am unable to blacklist the logs that end with clien... by pimco_rgoyal Observer in Splunk Search 08-23-2017 0 1	0	1
Java SDK: how do you return lookup fields in search results? How do I receive lookup values in results from the Java SDK? When I run this query in the GUI, I see my lookup fields... by scriv Explorer in Splunk Search 08-23-2017 1 4	1	4