Splunk Search

Community Activity

how to rex field number of infected file for clamav scan report? Jul 10 06:59:22 icopenstack01 clamav[9040]: Infected files: 0 source = /var/log/remote/icopenstack01.log sourcetyp... by cyberportnoc Explorer in Splunk Search 07-11-2017 0 3	0	3
How do you make output from xyseries generate the same _time-based X-axis labels as timechart? The following search: sourcetype=my_log_type \| timechart count by conn_type generates the chart I want, with one e... by Graham_Hanningt Builder in Splunk Search 07-11-2017 3 4	3	4
What kind of syntax is limit and span? I noticed that limit and span always turn green. What kind of component are they? For instance: blue is used for com... by cotyp Path Finder in Splunk Search 07-11-2017 0 3	0	3
Work of OR/AND condition search query based on the match & should give the result. Hi Team, I am trying to populate a panel on the dashboard on the basis of two input fields Profileid & Transactioni... by rakshithreddy Explorer in Splunk Search 07-11-2017 0 1	0	1
Unrelated lookup table goes missing after setting [replicationBlacklist] Hi all, we have a non-clustered distributed Splunk. It has a number of big lookup files that are updated regularly. A... by Motoko89 Path Finder in Splunk Search 07-10-2017 0 5	0	5
Regex help in transforms : key-value extraction and assigning to key I'm trying to match key-value pair within an SNMP trap message whereby the KEY and VALUE are present in two fields #... by koshyk Super Champion in Splunk Search 07-10-2017 0 7	0	7
How to edit my search to create a table grouped by User based on multiple events? Hi, I am struggling with the correct way to approach this. I have VPN data that performs 5 posture checks before cl... by MattSmith129 Explorer in Splunk Search 07-10-2017 0 3	0	3
How to edit my search to get new errors from today, and that not occurred in last 7 days? Can you please help with the following search? It returns 0 events. I want all the errors that occurred today, and no... by manjulanam New Member in Splunk Search 07-10-2017 0 3	0	3
Best practice for forwarding data to a differently named index? I have three independent geographic sites, A, B, C. A forth site, Z, needs a searchable copy of all data from A, B,... by msellery Engager in Splunk Search 07-10-2017 0 7	0	7
Does transforms.conf support a regex group based rerouting? Hi all; I am trying to build some logic for a docker/k8s integration that we are doing through fluentd. Basically w... by paimonsoror Builder in Splunk Search 07-10-2017 0 3	0	3
How to edit my search to add the total count for the number of times process appears in the logs per host? index=GenericHostName host=GenericServerName process="GenericServiceName" \| fields _time, host, PID, process, source,... by davideberling New Member in Splunk Search 07-10-2017 0 3	0	3
Which online, regular expression editors can I use to validate a regex I generated? I have extracted regex for a log, need to validate it on programming editor. Which platform do i need to use? Any Onl... by bhargavimusigma New Member in Splunk Search 07-10-2017 0 2	0	2
How to set the X-axis range in a time chart Hi all, I am a relatively new user of splunk, so do be patient with me if you think that my questions had been answe... by Alex210984 New Member in Splunk Search 07-10-2017 0 4	0	4
Using head command I have the query with stats, and I want to use head command to retrieve limited events for everyday. But head command... by nidhiagrawal Explorer in Splunk Search 07-10-2017 0 5	0	5
Top 10 for every timespan I have data of mail sending activities of 1000s of customers and need to find the top 10 mail sending customers for e... by AshimaE Explorer in Splunk Search 07-10-2017 0 2	0	2
how to iterate a column's values like python in command? "daily.cld" \| rex field=_raw "version: (?\d+.)," \| rex field=_raw "sigs: (?\d+.)," \| convert timeformat="%Y-%m-%d" c... by cyberportnoc Explorer in Splunk Search 07-10-2017 0 1	0	1
How to get " stats count as hitcount " for logs saprated by commas in rows Hi All, Requesting your help with Log Example. I have 54 fields separated by comma The field data is variable and ... by krdeepu New Member in Splunk Search 07-10-2017 0 4	0	4
What are the consequences of disabling real-time searches or converting them to saved searches for a Prod environment? Hello All, We are in the process of cleaning up unused and Real Time Searches from the system. I can see there are t... by gagandeep_arora Path Finder in Splunk Search 07-09-2017 0 3	0	3
splunk monitoring console output Can anyone please explain what is instance freezing due to size , median data age , oldest data age , instances freez... by kteng2024 Path Finder in Splunk Search 07-09-2017 0 2	0	2
Highlight with color if SLA missed Hi Team, Below my search from which i am getting the completion time of job. I need ur help for couple. 1 - If Belo... by harsush Path Finder in Splunk Search 07-09-2017 0 6	0	6
Splunk Data Input Whitelist: Regex not matching I am trying to add a directory input monitor to Splunk. In this directory I have many different CSV files. Since ther... by beat_grob Engager in Splunk Search 07-09-2017 0 2	0	2
"Cannot seek to rawdata offset 0" running a search in Splunk Web after upgrading Splunk Enterprise from 6.4.2 to 6.5.1 When I upgrade Splunk from 6.4.2 to 6.5.1 and search in Splunk Web, then get error: JournalSliceDirectory: Cannot se... by leo_zhao New Member in Splunk Search 07-09-2017 0 2	0	2
How to find which group was matched in a regex when multiple groups are extracted to the same field? I am using multiple capturing groups in regex and extracting the value of multiple groups to same field. For ex: (g... by girrajubharath New Member in Splunk Search 07-09-2017 0 3	0	3
How can I use a dashboard form to search an index for multiple single field values space delimited simultaneously, such as usernames and then in my output match them against another field such as phonenumber, address etc? Basically looking to create a table with matching items ie if I search for the following field username in active dir... by cdurk Engager in Splunk Search 07-08-2017 0 6	0	6
What is the correct way to edit conf files and propagate changes in a search head cluster ? Let's say I've made an action that triggers configuration replication across the SH Cluster (e.g: created a field ext... by sylvainlectra Explorer in Splunk Search 07-08-2017 0 8	0	8

Get Updates on the Splunk Community!

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Splunk Search

how to rex field number of infected file for clamav scan report?

How do you make output from xyseries generate the same _time-based X-axis labels as timechart?

What kind of syntax is limit and span?

Work of OR/AND condition search query based on the match & should give the result.

Unrelated lookup table goes missing after setting [replicationBlacklist]

Regex help in transforms : key-value extraction and assigning to key

How to edit my search to create a table grouped by User based on multiple events?

How to edit my search to get new errors from today, and that not occurred in last 7 days?

Best practice for forwarding data to a differently named index?

Does transforms.conf support a regex group based rerouting?

How to edit my search to add the total count for the number of times process appears in the logs per host?

Which online, regular expression editors can I use to validate a regex I generated?

How to set the X-axis range in a time chart

Using head command

Top 10 for every timespan

how to iterate a column's values like python in command?

How to get " stats count as hitcount " for logs saprated by commas in rows

What are the consequences of disabling real-time searches or converting them to saved searches for a Prod environment?

splunk monitoring console output

Highlight with color if SLA missed

Splunk Data Input Whitelist: Regex not matching

"Cannot seek to rawdata offset 0" running a search in Splunk Web after upgrading Splunk Enterprise from 6.4.2 to 6.5.1

How to find which group was matched in a regex when multiple groups are extracted to the same field?

How can I use a dashboard form to search an index for multiple single field values space delimited simultaneously, such as usernames and then in my output match them against another field such as phonenumber, address etc?

What is the correct way to edit conf files and propagate changes in a search head cluster ?

Value Insights: Now Generally Available in the CMC

What’s New in Splunk AI: Volume 02

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation