Splunk Search

Community Activity

How can I group similar fields and count by field? I was wondering if is possible to group / filter based on a single field. Below is a field called user_agent for brow... by YTKme Engager in Splunk Search 08-11-2017 0 6	0	6
How to fetch data using rex command These are some below mentioned details which is present in splunk in exactly same format:- New Core 12 Month CTE (201... by m7787580 Explorer in Splunk Search 08-11-2017 0 5	0	5
How can I exract these error messages into one field? \|\| vasb05 \| PROD \| Availit \| \| 2017-08-11 08:54:01,420 \| ERROR \| http--10.100.108.48-8080-13 \| com.amerigroup.utilit... by karthi2809 Builder in Splunk Search 08-11-2017 0 2	0	2
Unable to configure Website Monitoring App Hi, I installed the Website Monitoring App. When I open the App, its taking me to the configuration page, I am unabl... by jagansrajan New Member in Splunk Search 08-11-2017 0 2	0	2
Grouping results with blank lines between each item in group Hi, Currently I am going through a logfile, grouping by source and displaying the errors for that source. It basical... by DanielWallace New Member in Splunk Search 08-11-2017 0 4	0	4
Convert YYYYMMDD number to DD.MM.YYYY format Hello, I am trying to convert a field value which contains a number in timeformat YYYYMMDD to DD.MM.YYYY I tried se... by ckunath Communicator in Splunk Search 08-11-2017 0 2	0	2
Extract both single-value and multivalue fields using rex I seem to be unable to comment on the similar questions, but as they haven't answered my question, here I go. With t... by jhuxley Engager in Splunk Search 08-11-2017 0 4	0	4
Eval Case Formula Hi, Struggling to complete an Eval Case syntax. I want to create a situation where I have a new field called provide... by jackreeves Explorer in Splunk Search 08-11-2017 0 5	0	5
LinkList switch using drilldown token from a table Hi, I have a linklist input, based on which some panels are getting enabled/disabled, link-switcher. What I am try... by nishantmishra21 Engager in Splunk Search 08-11-2017 0 1	0	1
How can I know if my heavy forwarder is processing the regex? Bonus: How can I check the memory and CPU consumption? Hi , I installed a heavy forwarder for regex processing a few source types, not for indexing. How can I know whether... by kteng2024 Path Finder in Splunk Search 08-10-2017 0 1	0	1
How to sort alphanumeric values? Hi, How can I sort the below alphanumeric values? From To ROBOT 1 ROBOT 1 ROBOT 10 ROBOT 2 ROBOT 2 RO... by auaave Communicator in Splunk Search 08-10-2017 0 6	0	6
Regex to return text over multiple lines Hello, I am trying to extract several lines of text using regex and whilst I can extract up to the first carriage re... by ahogbin Communicator in Splunk Search 08-10-2017 1 9	1	9
How do I use a value in an existing field to create a new field and assign output values? I'm trying to create a new field called TYPE, which is dependent on the word "summary" or "detail" appearing in the T... by ejohn Path Finder in Splunk Search 08-10-2017 0 15	0	15
Show hourly count as zero if no data found for all indexes I have a search: \| tstats count WHERE earliest=-2d@d latest=now index=* by index, _time \| makecontinuous span=1h _ti... by mkarimi17 Path Finder in Splunk Search 08-10-2017 0 2	0	2
Unable to get results for Splunk search after adding a field from the "interesting fields" list--why? I am unable to get any values for my search when I add a field from the interesting fields list. It is happening only... by rangineniarunku Explorer in Splunk Search 08-10-2017 0 2	0	2
How can I change the header so it displays the current date? Hi, I have a table output like below, OS Range1 Range2 Range3 Range4 AIX 10 ... by sbbadri Motivator in Splunk Search 08-10-2017 0 5	0	5
Why isn't my replace command working in this search? index=test TransactionId="xxx-xxx-xxx"\| replace "000" with "" in Status\| fields Status I want to replace the first... by nisha_kapoor Path Finder in Splunk Search 08-10-2017 0 3	0	3
How to convert string time to show the number of seconds? I have a string time in double quote and would like to convert it into duration so that I could sum it later. This is... by tamduong16 Contributor in Splunk Search 08-10-2017 0 3	0	3
Using top to get count and percentage by subgroup I am using the following code to get a count and percentage breakdown by x and y. I would like the percent returned ... by mschellhouse Path Finder in Splunk Search 08-10-2017 0 1	0	1
How can I remove 4 hours from my search? This is what I tried. The query runs but the hours are not removed. index=sse_gdia_local_idx "starting from log" \|e... by rgarbac1 New Member in Splunk Search 08-10-2017 0 4	0	4
How to find missing hosts and/or deployment clients? Hello all, I have a list of hostnames in a text file that need to be in Splunk. Some of them are already in splunk a... by j4adam Communicator in Splunk Search 08-10-2017 0 6	0	6
Return results where ClientID in first search DOES NOT match any ClientID in second search. Search 1: source=D:\\XSP\\importhelpers source=IH_Daily\\DebugImportHelper End \| rex field=source "importhelpers... by griffinpair Path Finder in Splunk Search 08-10-2017 0 8	0	8
How to chart a search that returns event with multiple facets that have a name/result pair. I am doing the following search: source="new_relic_insights://NRInsightsAPI_rc_ShopFront_Top10Transactions" \| search... by WeiseGuy Explorer in Splunk Search 08-10-2017 1 15	1	15
Breaking Weblogic logs when timestamps are different formats I am trying to parse Weblogic records with a sourcetype of weblogic_stdout, but some of the logged events have multip... by rkilen Explorer in Splunk Search 08-10-2017 0 7	0	7
Using a string delimeter to compare fields How do I get output for the following requirement? given a1=111,222,333,444,555 a2=111,222,444 output r... by srikarbaswa446 New Member in Splunk Search 08-10-2017 0 4	0	4